Org Level Roles / Authorization Object Roles

Hi board,
I have heard of the concept to use roles with "Organizational Values" only and no other authorization values contained. Similar the idea to exclude special authorization objects from common roles and combine them in dedicated special ones to prevent accidential "double usage".
The first may help to control the overall number of roles coming up after deriving single/composite roles for many levels.
My questions are:
- Is it technically feasible (for a large-scale company)?
- What is your experience?
- Drawbacks?
Kind regards and many thanks for your help,
Richard

Richard Hösl wrote:
> Hi there,
>
> that was fast, amazing. Thanks a lot and my appologies for not finding the other thread from the beginning. I can see drawbacks, nevertheless it is still temptating due to the fact that derivation for over 30 countries will produce a huge number of roles. Not from the system performance point of view, just to handle this amount will be painful.
>
> Given the assumtion that it is not a good idea to use "Org Value Roles", are you deriving on on composite or on single level?
>
> Kind regards,
>
> Richard
Hi Richard,
It is a very tempting approach, but completely wrecks the standard auth concept and unless you are 100% tight on controlling it, can get very messy.
A good way of looking at it is that you have 2 roles - one contains transactions & the other one a big bucket of authorisations which support those transactions. That bucket invariably contains more authorisations than the transactions require. Given that it is at the authorisation object level that the important security is provided, this method has it's drawbacks........
If you have organisational complexity then you should look elsewhere to simplify.
By consolidating your roles (e.g. if we take a risk based design approach, typically around 80% of an accountants role will be the same anywhere in the business) and building at a higher level, you need to create fewer variants (which you might be able to use derived roles for).
Put the effort in the design stage and it will pay dividends later on down the line.
Building at a higher level than task also forces the business to look at roles and responsibilities and to standardise as much as possible.
Cheers
Alex

Similar Messages

Question on org level values in derived roles

I have a set of derived roles for a retail org.
They have set the org level for the WERKS object to the store number i.e. 0012. in the M_MSEG_LGO, M_MSEG_WMB, and M_MSEG_WWE but set it to "" in the M_MRES_WWA and M_MSEG_WWA. Needless to stay the "" is overiding the site restriction.
My question is, how can they allow store to store transfers and goods issues for other sites but only do POs and goods receipts for their default store?
If the transactions in the role are using the same object, it doesn't seem like it can be done but I am told it can! I can't figure it out. Can anyone assist?
Thanks

If you are talking about straight authorization object ( then your design cannot go with derived role concept )
If your controls are only through the organizational object only then derived role design will help
If its a mix of both standard object + organizational level object derived role will not help you.
Please note
the WERKS is the organization level in your case the plan value is 0012
do not set the values in parent role and also do not populate this value were its "$werks"
what is TCODE you are using ?
Edited by: Franklin Jayasim on Jul 21, 2010 11:45 PM

New Org Level impact in existing roles

Hi,
I would like to set/create 2 fields as organizational levels. For example KLART and DOKAR. Checking these I realized there is a big amount of roles "affected" by this change.
Because I plan to use the organizational level only for new roles , I would like to know which impact could have this change for existing roles, should one modify the existing roles after creating the Org Levels ? or in contrast they still work as always an no changes / adjustments is needed?
Thanks and regards
FedeX

Thanks Bernhard,
I have a question
As I mentioned before my goal is that the existing roles keep working after running that program... and do not want to perform any adaptation....only if there is a real error that avoid work correctly.
In these 2 cases the role will keep working properly ( I mean restricting in the way that it uses to do).
1) In case field is copied to the Orglevel area after running the program and the value(s) will stay in both places (OrgLevel and Original place)
2) In case field is NOT copied to the Orglevel area after running the program but the value still in the original place .
right?
Thanks
FedeX

Link users - positions - roles - authorization objects

Hi guys,
I want to write a report that would link USERS to POSITIONS to ROLES and finally to AUTHORIZATION OBJECTS. The user would enter the SAP username in the selection screen and the report should extract all the information listed above.
I am able to link the following:
+ Users to positions via function module RH_BRANCH_GET
+ Users to roles via table AGR_USERS
+ Roles to authorization objects via function module PRGN_1251_READ_FIELD_VALUES
Unfortunately, I dont know how to link positions to roles
Does anyone know how to do that?
Also, is there a more efficient way, than the approach highlighted above, to complete this requirement
Thanks for your time
-TR

Hi,
you can find a link between role and HR object in table HRP1001. The field SOBID contains name of the role. You need to find way how to convert object ID into position role. Be careful about additional fields from that table.
Cheers

Authorization object/Role

We would like to have a new authorization object in order to allow other XXX Sales companies to reprint other YYY Sales companies intercompany invoice based on the Sold to party. The check behind this object should be field KUNAG and FKART with activity 03 and 04. The VA03 program should be modified to include this user exit if a document falls into the intercompany invoice (FKART=ZVIV), let it display for that specific Sold to party and reprint for all those people who has this object no matter in which sales company they are. If it is not a good proposal to modify the standard VA03 then it should be copied to ZVA03.
At the moment it is not possible to reprint intercompany invoices if we do not give access to the other sales organization fully. If we give then they can reprint all the invoices there not just the intercompany related ones.
Can you please suggest how to go about this.
Thanks
Ramki

Hi Ramki,
Surely this is the fuctional spec that you give to your dev team to solve?
An additional check on document type (IC etc) for reprint would allow you to restrict people to only reprinting what they need to

Authorization in APO: org level concept (parent role -- derived role) ?

Hello experts,
we want to introduce some authorization / roles in APO using the typical R3 concept of having a "parent role" and derive "single roles" from such a parent role and change the "org levels" inside the single role. Testing this with master data objects like C_APO_LOC (location in APO) it seems to me that APO doesn't know about "org levels".
Whenever I create a parent role (lets say "Z_PAR_ROLE_LOC_MASTER") to access /SAPAPO/LOC3 (Location master data) and create a single role out of it (derive it into Z_SINGLE_ROLE_LOCMASTER_1234") and enter the location ID 1234 ... regenerating and populating a change from the parent role "Z_PAR_ROLE_LOC_MASTER" does immediately wipe out the location ID 1234 maintained before in the single/derived role "Z_SINGLE_ROLE_LOCMASTER_1234".
My question: is this by design that APO does not know about "org levels" or is there something special I have to consider using PFCG correctly in SCM (I can see the "Org Level" button but it says there are no org levels) ?
Regards
Thomas

I got the solution - the profile generation was missing !

Role creation and authorization objects in sap

Hi
i want to know the full relationship between creation of roles , authorization objects ,authorizations in web as abap
Please explain the process in detail the use of PFCG and all its options and how to create Z roles

Although, It would be a very long document to explain the query, I have briefed you on the concept. I hope it leads you well.
- Roles are nothing but a container for authorizations. A role represents a specific part of an employeeu2019s job.
- The R/3 authorization concept permits the assignment of either general and/or finely detailed user authorizations. These assignments can reach down to transactions, field and field value level.
For e.g. If a user wants to create a PO we can restrict him on:
u2022     Activity : Create/Change/Display
u2022     Org elements like Company Code, Plant, Purchase Organization etc
u2022     Document type etc.
- Authorization objects are grouped in an object class such as Materials Management: Master Data (MM_G). Each Object Class may have several authorization objects and within each object we can have several authorizations (max. up to 99).
- Fields :The permissible values for the fields constitute the authorization. For e.g. ACTVT (Activity) is a field with permissible values of 01 (Create), 02 (Change) & (03 Display) for the object M_MATE_CHG (Material Master: Batches/Trading Units). Value * for field BEGRU signifies all possible values.
- An authorization allows you to carry out an R/3 task based on a set of field values in an authorization object. By themselves authorizations do not exist and they only have a meaning inside a profile
- Authorizations are contained within profiles and these profiles are assigned to users manually or automatically via role assignment. When you assign the field values for all the authorization objects and save system will auto generate a profile name.
- Authorization check are included in the transactions source code in standard SAP R/3.A user may carry out an action if the authorization check is successful for each field in the object.
Edited by: Subramaniam Iyer on Nov 27, 2008 12:08 PM

GRC BRM: Update Org Levels of derived roles

Dear GRC experts,
we are using the GRC BRM Master Derived concept and have around 100 Master roles in place.
I understand that the Org Levels of derived roles are only once set per Org Value Map during the initial (Mass) Derivation.
If we add a transation like VA01 to a Master role this also adds some new Org Levels to the Master role. Via "Propagate to Derived roles" the new transaction and object values are added into the Derived roles.
For the new Org Levels these are added also but the values are not the one from the Org Value Map of the Derived role but exactly the same values of the Master Role.
Using "Derived Role Org. values Update" does not help us here to update the corresponding Derived roles as no change to the Org Value Map has been done.
In case a Master role has 40 different Derived roles associated this would require to update manually any of the Derived roles for adjusting the new Org Levels.
Does anybody know how to automate this task?
Many thanks for your help!
Regards,
Markus

Hi Markus Richter
Once you maintain the imparting role and propagate to the derived role, the derived roles will inherit the new org values from the imparting. So that at least has the org values in the derived roles but not the correct values
Next up is to try to use the Mass Maintain Roles to update the derived roles with correct values from the org map (ensure org maps were updated first) mentioned in post
Mass Child role Org value update in GRC 10
Does this work for you as an approach?
Regards
Colleen

Job role design - transaction role and auth object role

Hi all, please kindly comment following job role design:
(1) transaction role:
Keep transactions in single job role to represent business processes in different application areas, e.g.MM: maintain PR, PO, OA. CO: maintain cost center, internal order HR: maintain org structure, personnel management.
The single job role will only keep role menu, object S_TCODE and inactivated all other application related authorization objects.
(2) authorization role
Keep application component related authorzation objects except S_TCODE in single job role by different application area, e.g. Objects of MM_B, MM_E, MM_G in MM role. Objects of K_CCA, K_CSKS_SET in CO role. Objects of HR in HR role.
Then maintain org level of MM, CO, HR roles for different companies, e.g. Company A MM role, company A CO role, company A HR role, company B MM role.;....
User will be assigned transaction role + auth object role. For example, user of company A to perform MM and CO functions will be assigned
with MM transaction role + company A MM role + company A CO role.
Please let me know the pros and cons of above design. Thanks.
Regards,
Donald
* I can see the disadvantage of this design is during SAP upgrade (SU25), revised of authorization object will not reflect in authorization role

Brent Van Dyck wrote:
Keep in mind the project was for an HCM implementation where there's already hardly any connection between tcodes and authorization values so it may have made more sense in that context than it would in a classic SD/MM.
That is correct - but it still exceeds "horrible" beyond imaginable boundaries if you try to split the fields of the objects into different roles and expect it to work or that there will be less roles.
In the case of HCM and also BW the auths admin needs to know more about the data and organization than what classic ERP auths admins can get away with. That is why they take longer to migrate away from manual profiles and have a greater tendency to have manual authorizations inserted into roles - which could however also be achieved by maintaining fields proposed without values and at least proposing those (such as activity type fields) which are known.
But splitting cube / characteristics / key figures or infotype / personel group / auth code into different roles can only go wrong.
Another mistake some "value role experts" sometimes make is that they don't want Su24 proposals in PFCG because they don't understand them. So what they do is that they clean out the SU24 tables completely... Well... the side affect of that is that all SU24 check indicators flagged as "no check" suddenly become alive in their system although there are mostly good reasons not to have the checks active.
Cheers,
Julius

Maintaining the authorizations for parent role and derived role

Hi Experts,
Kindly advice me the Pro and cons of the parent role and derived role.. below is the scenario
Currently we have created the 700 role in our regionally organization and we want to dervie the roles for each country
1 ) we want to do the Auth field (activity level) settings in parent role and Org levels in the derived role .
2) But one my collegue says do the default Auth filed ( activity values) common to every country in the parent role and diff activity one in the derived role .
please advice me wat will be the best scenario for mantaining the authorizations filed values like (activity level one)

I will try to answer both your queries here:
"my collegue says they are some NON ORG values different from each country ..suggest us to maintain all the default values in Parent role and auth with diff values needs to be maintained in derived role (child role).. "
The only set of values which should/can be different in a child role (when compared with its parent) will be the org level values. So if this filed is NON_ORG you will not be able to maintain it directly inside the child roles.....this is the basic principle of derived role conceptu2026 that the only item you will directly maintain in a child role are the org levels(which will come as u2018organisational levelsu2019 in the upper tab in the auth data of a role).
All NON_ORG fields inside a child role is acquired from the parent role. You should never change the values of any such fields (non-org fields) in the child role. these changes will get lost the next time you run the parent child inheritance from u201Cgenerate derived roleu201D function in your parent role.
Coming to the second question on how to run the program, you just need to enter the technical name of the field you want to convert (tech names like BUKRS, WERKS etc u2026 figure out the name of the concerned field you have in hand)u2026.executeu2026 you will that the field will now onwards appear as an org level value in all roles in the system and not just as a field inside the auth objectsu2026.I would suggest you take one field and try running it in ur dev or sandbox..see how the field changes in your roles.... the change can always be reverted by using PFCG_ORGFIELD_delete. ... you will understand it better....
Soumya

Master role and derived role concept

Guys,
1) How to assign the organizational levels for the derived role?
Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
Greatly appreciate for some body's help.

> 1) How to assign the organizational levels for the derived role?
> Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
Only if you assign the master roles to users. (and maybe for testing, see 3)
>
> 2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
Nope, but if one of it's derived roles is transported the master is automatically included in the transport. You'll have to make sure all derived roles are transported yourself.
>
> 3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
Best order is to do all unit testing wit the master, with all org levels at * and create the derived roles only when the master is tested and corrected to satisfaction. In that way the derived roles only have to be tested for organizational shielding.
>
> 4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
See 2, it goes there automatically. No choice.
Jurjen

Basic Information about Organizational Level & Org. level value.

Hello Experts,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
2. What is a derived role and what is its usage?
I appreciate your help regarding this. If you could point me to some documentation regarding this that will be very helpful.
Regards, Ben

Ben,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
if you want to restrict on region vice (best use org level & values (plant,company code, sales org)
In role u will notice them in red color
2. What is a derived role and what is its usage?
Derived role inherits menu struture and the function from the parent role. Derived role do not differ in their functionalities(identical menu & trans) but have different characterticts with regard to Org levels.
Eg1; Master role
PFCG -> role name -> create->menu->enter tcodes-.Auth tab->export mode->read old status and merge with new data->Pop for org levels (give a full access)->see to that everything is green->generate it.
http://e-mory.blogspot.com/2007/12/sap-pfcg-create-role.html
Eg2: Derived role
pfcg->role name->create->in describtion tab towards right enter the master role name->Auth tab->export mode->read old status and merge with new data->you will get a pop for org levels (here you can restrict on plant lvel,purchasing group,company code....)
->let say for plant : 1000 ->generated / user comparssion
Once the role is added to the user. User will be albe to see only those plant related details (1000) (i.e he will have access to only plant 1000)
suppose if the user enters 2000,he will get a error message saying no access to 2000
NOTE: Any changes to the role should be done in master role (like adding tcodes)
.http://www.rssfeeddirectory.org/directory/items/346239.aspx
https://cw.sdn.sap.com/cw/docs/DOC-12021
http://help.sap.com/saphelp_wp/helpdata/en/1c/c38028816c11d396bc0000e82de14a/content.htm
Re: Authorization error after transport
Thanks,
Sri

Authorization object tables

Hi,
I am building a cusom security report which will have user id, roles, authorization objects, and info objects inside the authorization object(s). I have been able to get users and their roles with tables (usrefus, usr21, adrp, usr02, agr_users) but am having problems finding the following -
Can someone tell me the table names? Any additional info would be appreciated.
Thank.

Hi Clark
Check this Click for authorizations in reporting
http://help.sap.com/saphelp_nw70ehp1/helpdata/en/55/2bb33b90131e73e10000000a11402f/frameset.htm
Regards
Jagadish

Authorization object to WRITE/ADMIN all projects in cProjects

Hello Everyone,
Am looking for an authorization object/Role to WRITE/ADMIN all projects in cProjects (know from previous threads regarding ACO_SUPER object for READ access,looking for WRITE/ADMIN as well)
Regards,
Pradeepkumar Haragoldavar

Hi,
You can use the same object ACO_SUPER, by specifying WRITE or ADMIN activity instead of READ.
BR
Matthias

Roles in BW (Authorization Objects)

Hi,
I want to create a role in BW which will provided access to 9 reports on a particular info cube.
What are the authorization objects do i need to use to achieve this purpose
Level of authorization:
Execute any report on that particular data target
Thanks

Hi BW KING,
1.before going to authorizations u have to decide on which Infoobject u have to apply authorizations.
EX: SD--- Sales Org, MM -> palnt ,purorg,FI> companycode.
first u ahve to decide which area & on which Infoobject.
2.goto that Infoobject --> change there check the checkbox Authorization relavent object cahechbox
2.after that U Have to goto RSSM there u have to create authorization object
Ex: Zxxx ( XXX is Infoobject Name ).
3. In the same transaction Screen u have Infocube selection radio Button check that then select on which cube(cube means under that cube all Quaries) u have to make authorization for that perticuler Infoobject.
4.next goto PFCG create role & save it
5.goto Authorization tab in that selct edit authorization it will give automatiaclly authorization Templates in that u have to select only S_RS_RREPU & press Enter.
6. Select manual pushbutton it will ask authorisation object enter ur authorization object what u have created ( zxxx) .
7.click generate +enter
8. goto user tab Enter userId+enter + click on usercomparision+ enter
9.save the role.
Thanks,
kiran

Org Level Roles / Authorization Object Roles

Similar Messages

Maybe you are looking for