Org level tab values

Hello,
In one of the single roles, field BUKRS was individually maintained and hence there is a mismatch between the values in the org level values tab. To make it uniform, how do I reset BUKRS so that it is filled with values from the org level tab? I did a select all, delete of the BUKRS field values then saved and generated the role but the values are not populated.
Any inputs is appreciated.
Mani

Hi,
If you delete the BUKRS filed values from the object using the delete button that will show up only in the manually maintained object BUKRS filed value. Delete the same using the trash icon. Immediately the org level value will popup in the BUKRS orgfiled. (No need to generate or save the role to see the BUKRS value from Org level)
As you have mentioned you have "select all " no such option. individually you have delete for each BUKRS filed in the objects if you maintained manually.
Regards,
Shrinivasan. KV

Similar Messages

Mass role Import in ERM "unable to determine matching org. level" Error

I am trying to upload the Derived Roles into the ERM. I have already uploaded all the Parents Roles. The volumes of the Derived Roles is huge in my SAP Backend system.
I am not able to understand what should be the content of Org File which we upload. Please correct if I am wrong
1>Example a role Z_TEST_D is derived from Z_TEST on the org levels EKGRP,KOART,GSBER,WERKS.
2>I have run Org Synchronization Job in the ERM
3>Downloaded Z_TEST (Parent Role) and uploaded it into ERM(It was easy because there was no org file)
4> Downloaded Z_TEST_D(Derived Role) through /VIRSA/RE_DNLDROLES Tcode in backend.
5>Downloaded the AGR_1252 information for this role which contained the Org levels and values
6>I put all those information into the Org File and then tried to upload it throws me the error Role Z_TEST_D : not imported; unable to determine matching org. level for WERKSin the system
So I again tried with the another method by changing the input sheet for the Org File
Z_TEST_D BUKRS 0* 9*
Z_TEST_D EKGRP *
Z_TEST_D KOART *
Z_TEST_D GSBER *
Z_TEST_D WERKS *
and tried to upload it again gave me the same error. I have checked the ERM all these Org Levels are fetched into the ERM. I am not sure if I am missing any basic things.
Current Support pack: SP10 Hot Fix 2.
Please share your experience and best practice to upload the roles,

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

Basic Information about Organizational Level & Org. level value.

Hello Experts,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
2. What is a derived role and what is its usage?
I appreciate your help regarding this. If you could point me to some documentation regarding this that will be very helpful.
Regards, Ben

Ben,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
if you want to restrict on region vice (best use org level & values (plant,company code, sales org)
In role u will notice them in red color
2. What is a derived role and what is its usage?
Derived role inherits menu struture and the function from the parent role. Derived role do not differ in their functionalities(identical menu & trans) but have different characterticts with regard to Org levels.
Eg1; Master role
PFCG -> role name -> create->menu->enter tcodes-.Auth tab->export mode->read old status and merge with new data->Pop for org levels (give a full access)->see to that everything is green->generate it.
http://e-mory.blogspot.com/2007/12/sap-pfcg-create-role.html
Eg2: Derived role
pfcg->role name->create->in describtion tab towards right enter the master role name->Auth tab->export mode->read old status and merge with new data->you will get a pop for org levels (here you can restrict on plant lvel,purchasing group,company code....)
->let say for plant : 1000 ->generated / user comparssion
Once the role is added to the user. User will be albe to see only those plant related details (1000) (i.e he will have access to only plant 1000)
suppose if the user enters 2000,he will get a error message saying no access to 2000
NOTE: Any changes to the role should be done in master role (like adding tcodes)
.http://www.rssfeeddirectory.org/directory/items/346239.aspx
https://cw.sdn.sap.com/cw/docs/DOC-12021
http://help.sap.com/saphelp_wp/helpdata/en/1c/c38028816c11d396bc0000e82de14a/content.htm
Re: Authorization error after transport
Thanks,
Sri

Adjust manually changed Object field as per org level values

HI,
I have a role wherein a field maintained at org. level has been changes in object manually. hence it no more follows the the org. level values assigned.
The requirement is "this object should get adjusted for its field to have values as per the org. level values" As I remember there is a SAP standard report that when executed for this role, will correct the object and we will be able to again have it's field values aligned with org. level values.
I am not able to recollect or find the name of the report.
Need help!!
Thanks.
~ Pranali

That this option is available in any authorization which is not copied from a standard one is still a mystery to me...
I normally just check for them to see whether someone toasted the role and solve the root cause problem. Training is the hard way.
Solution: Delete the authorization and open the role again to maintain the org. level.
As this is in a development system generally, there are some pre-requisites though to be able to avoid it. Role admin is a very specialized task and everyone always wants more.
Sandbox systems are cool places to mix the two of them and let people be creative with prototypes etc. Development systems also have feelings and enemies...
Cheers,
Julius

Question on org level values in derived roles

I have a set of derived roles for a retail org.
They have set the org level for the WERKS object to the store number i.e. 0012. in the M_MSEG_LGO, M_MSEG_WMB, and M_MSEG_WWE but set it to "" in the M_MRES_WWA and M_MSEG_WWA. Needless to stay the "" is overiding the site restriction.
My question is, how can they allow store to store transfers and goods issues for other sites but only do POs and goods receipts for their default store?
If the transactions in the role are using the same object, it doesn't seem like it can be done but I am told it can! I can't figure it out. Can anyone assist?
Thanks

If you are talking about straight authorization object ( then your design cannot go with derived role concept )
If your controls are only through the organizational object only then derived role design will help
If its a mix of both standard object + organizational level object derived role will not help you.
Please note
the WERKS is the organization level in your case the plan value is 0012
do not set the values in parent role and also do not populate this value were its "$werks"
what is TCODE you are using ?
Edited by: Franklin Jayasim on Jul 21, 2010 11:45 PM

Add checkbox on header level Tab Org.data

Dear All,
My requirement is I need to add checkbox on header level Tab Org.data in ME21n or ME21.
And if checkbox is checked in the tab Org.data, it should display Terms and Conditions in the print preview.
Please suggest how to write code? Is there any user exit for transactions ME21N or ME21.
Thanks,
Rana.

hi praveen,
search this forum on how to implement a badi if you haven't done one before. also, go to transation SE18 and read the documentation on badi_fdcb_subbas01 which clearly says that its used for FB60... see the example how they have used it by going to menubar Implementation->Overview then choose FI_FDCB_SUBBAS01_EX (Example for Screen Enhancement 1 on FDCB Basic Data Screen)...you should look at the method PUT_DATA_TO_SCREEN_OBJECT and tab Subscreens where the screen exits are available to use.
In FB60, if you go to menubar System->Status and check the Program (Subscreen) and Screen Number, you'll see it'll match the program name and screen no. provided in the Subscreen tab of the BADI.
Hope this helps.
Cheers,
Sougata.

ERM -- unable to determine matching org. level for BRGRU in the system

Hello,
I have a problem.
When I trY to import in the ERM (SAP GRC AC 5.3 SP5) a mass import of roles (derived roles) using the template Organizational Template.
Some of the roles gives me this error:
"Role not imported; unable to determine matching org. level for BRGRU in the system".
In the file I put for example
ZAPVAPINTE BUKRS 0083
Am I doing it right? or do I have to put $BURKS?
Best regards.
Pablo Mortera.

I have found that when you run the background job "syncronization of the organizational values" it pulls the org value name and all "values" assigned to it. If you don't have values specified (on the table level) for the org name, you get this error. We have many fields that we use values for these fields but they aren't specified in the table.
For example: We have the org value "PLVAR" with the values "AL", "01", "02", "03", and "GB" assigned to it. You can actually see these values in the backend system using SE11. We do not get this error on this org value. However, we have another org value "SACHZ" that we use, but we do not have any values assigned to it on the table level, so it is giving us this error. We are trying to find out how to populate the "values" field since this was not done through configuration.
Here are the steps: (1) Go to SE11 in your backend system. (2) Put your org value (example: PLVAR) in the "DATA TYPE" field and click display. (3) Double click on the Domain name. (4) Go to the Value Range Tab and click on the "Value Table" name if there is one. This is the table that has the org values assigned in it - normally done through configuration. (5) go to Utilities --> table contents --> display. (6) execute the table contents. These are the values that the sync job pulls over. If there are no values there or if there is no "values table" name, you get the error. If there are values there, you don't get it.
We are working with our technical team to get the values in these fields to see if that works. Another quick way to see if there are values assigned to the org field is to use "Org Value Mapping" in ERM. Select the "derived org level field" you want to see and click on the "org value from" magnifying glass. If no values are there, a "values table" hasn't been populated in SE11.
It doesn't make much sense to me though because we can still use values for these fields for our derived roles....we just don't populate the table with them.
I'll update this message if we find a solution.
Thanks,
Peggy

Org Level Help

I tried searching the threads and Google for an answer first - no luck.
System: ECC 5.0
Release 640
The Org Level CO-OM Responsiblity Area is greyed out and I cannot edit it to enter a new Profit Center. When I select change mode I receive an error message which says "Authorization Object is invalid." Further information is "Table KBEROBJ does not contain authorization object.
How do I resolve this? Do I need to create a new blank Object field in the table and run PFCG_ORGFIELD_CREATE for RESPAREA?
I'm looking for a definitive answer and correction to this issue as I am flying in the dark.
Thanks!
Todd

Here is how I fixed it - well tested in SBX that it works:
Created a new entry in table KBEROBJ as follows:
OBJECT: (EMPTY)
CURRENT OBJECT: (KN)
OBJ1: (KS)
OBJ2: (HI)
OBJ3: (PC)
OBJ4 (PH)
Next, I ran PFCG_ORGFIELD_CREATE for RESPAREA. Then went into the role, change mode, Org Levels and I was able to change the value on the Profit Center Group tab as desired.
So far so good - we'll test a little more in SBX before I make the change in DEV and transport it.
Todd

Org Level in ERM

Hi ,
In Role Management Tab, under Roles when we go to search and try to assign the derived roles the system is not able to display any values in the dropdown in Derived Org. Level. These values are already maintained in Configuration.
Thanks in advance.
Srinivas

Srinivas,
This means that org level sync job has not finished successfully or there was some issue with the org level data. Can you try to reboot the server and test the scenario again. If it still doesn't work then I will recommend you to just run the org level sync job again.
Regards,
Alpesh

Help With Ora-19046:Out-of-line table cannot be shared by two top-level tab

Hi!
My tutor asked me to store and query the xml files in a "native" way in xml db. First I tried to register the schemas on which those xml files are based. There are about 30 of schemas asscociated with each other, and I have to use "FORCE" to register them , like this:
BEGIN
DBMS_XMLSCHEMA.registerSchema(
'http://www.isotc211.org/gmd/metadataEntity.xsd',
bfilename('ISOGMD', 'metadataEntity.xsd'),
TRUE,
TRUE,
FALSE,
TRUE,
TRUE);
END;
Then no tables are created automaticly. And when I wanted to create a XML table based on thses schemas manually, it proped the error: ORA-19046:Out-of-line table cannot be shared by two top-level tab. This has confused me for about a week. Does anyone know what's wrong with the registration? Waiting eagerly on line! Thanks!

First of all, i create a "filename.txt" that contains all my schemas' names. the names are:
acquisitionInformation.xsd
applicationSchema.xsd
basicTypes.xsd
catalogues.xsd
citation.xsd
codelistItem.xsd
constraints.xsd
temporalTopology.xsd
topology.xsd
units.xsd
uomItem.xsd
valueObjects.xsd
xlinks.xsd
there are 72 schemas. Then I register them using "force":
GRANT EXECUTE ON utl_file to fld;
create table test (
fld1 VARCHAR2(50));
declare
isto_file utl_file.file_type;
fp_buffer varchar2(4000);
begin
isto_file := utl_file.fopen('MYXMLDIR', 'filename.txt', 'R');
loop
begin
utl_file.get_line (isto_file , fp_buffer );
insert into test values(fp_buffer);
Exception
when no_data_found then
exit;
end;
end loop;
utl_file.fclose(isto_file);
end;
declare
cursor my_cursor is select fld1 from test;
v_name varchar2(50);
begin
open my_cursor;
loop
fetch my_cursor into v_name;
dbms_xmlschema.registerSchema(
schemaurl=>v_name,
schemadoc=>bfilename('MYXMLDIR',v_name),
local=>TRUE,
gentables=>true,
force=>true,
csid=>nls_charset_id('AL32UTF8')
exit when my_cursor%NOTFOUND;
end loop;
close my_cursor;
end;
at last, when I check the types generated during registration, I found that only a small number of types are automatically generated. When I try to create table manually ( based on certain element of one schema), it props errors, sometimes "31079. 00000 - "unable to resolve reference to %s \"%s\"" ", sometimes other errors.
If I manually register them one by one from the base schema, then the registeration fail at some point. this is the script:
BEGIN
DBMS_XMLSCHEMA.registerSchema(
'geometryAggregates.xsd',
bfilename('XSD', 'geometryAggregates.xsd'),
TRUE,
TRUE,
FALSE,
TRUE);
END;
ERRORS
22881. 00000 - "dangling REF"
Is that something wrong with my schemas? I wonder how can i paste them here. there are 72 files.......

New Org Level impact in existing roles

Hi,
I would like to set/create 2 fields as organizational levels. For example KLART and DOKAR. Checking these I realized there is a big amount of roles "affected" by this change.
Because I plan to use the organizational level only for new roles , I would like to know which impact could have this change for existing roles, should one modify the existing roles after creating the Org Levels ? or in contrast they still work as always an no changes / adjustments is needed?
Thanks and regards
FedeX

Thanks Bernhard,
I have a question
As I mentioned before my goal is that the existing roles keep working after running that program... and do not want to perform any adaptation....only if there is a real error that avoid work correctly.
In these 2 cases the role will keep working properly ( I mean restricting in the way that it uses to do).
1) In case field is copied to the Orglevel area after running the program and the value(s) will stay in both places (OrgLevel and Original place)
2) In case field is NOT copied to the Orglevel area after running the program but the value still in the original place .
right?
Thanks
FedeX

Release strategy determination for PO item level characteristic value

Hi Experts
I have user material group as release characterstic for PO.
I have created two line items with two different material groups.
How the release strategy determination occurs when the two different material groups are linked to two different strategies?
regards
ramSiva

Hi,
in this case system is NOT able to find the release startegy.
Please take care of the following explanation (see note 365604)
o For OVERALL RELEASE (purchase order and purchase requisition) the
   item fields such as Plant and Material Group will be aggregated
   to header level.
   For example you use Plant/material group
as one of your characteristics. If all
items do not belong to the same plant/material group
then
*******the relase strategy will not be found***********
unless you have maintained a blank value as one
of your allowed values for the characteristic Plant/material group
. If all items
belong to the same plant7material group
then that plant is aggregated to the
header; if one or more is different then a blank is aggregated to
the header.
If you use an overall release strategy all
characteristics which you have defined in the customizing (CEKKO-MATKL
must have the same value. If one item has material class x and the
other y the system does not know with which material class it should
look for a release strategy. Now the system sets the material class
to 'blank' and tries to find a release strategy. If you do not have
defined a blank entry in the customizing (Transaction: OMGS
: OLME >release procedure for PO > rel. strategy ) the
system won't find a release strategy.
you need
to add a blank value to your allowed characteristic values in your
release strategy. To do this you can define a blank value in your
characteristic (CT04). On the values screen leave the char.value
blank and add a description and save. Now in OMGS you can select
this value as an allowed value for the characteristic.
(Example:
To avoid this you can do the following:
- go into transaction CT04
- enter the characteristic 'CEKKO-MATKL'
- click on the tab 'values'
- set a flag in 'additional values'
- in the column 'Char. value' do not enter anything
- in the column 'Description' enter a text like 'no material class'
- save this setting
Now
- go into transaction OMGS -> button 'release strategy'
-> button 'classification'
- double click on CEKKO-MATKL' and set a flag in 'no material class' )
Please also have a look into the attached note 365604 point 2d).
BR
Nadia Orlandi

How to distribute new object from org level

Hi Expert,
I'm trying to create a new object: MATKL to org level through program: PFCG_ORGFIELD_CREATE. But I find there are only distribute to all roles. Could you advice if it can be distribute by selected role instead of all roles? Any advice on hierarchy problem?
Rdgs,
Emily

Hi Colleen,
Actually I want to grant authorization on MM section by separate material group. It's to fulfil some special users are able to access particular material group. So I'm thinking to create new material group org value and distribute from the top level (org level). Could you advice if there is any method can achieve my purpose more safety or easily?
If I want to control some users access some particular material number which limited by control different material group. Can I just assign object: M_MATE_WGR and control the value for access? If yes, where to assign?
Rdgs,
Emily

User group [$CLASS] not an Org level field in IA, whereas it is in DA

Hi All,
We have an authorization problem that we faced while SAP Upgrade. In the development system while we upgraded all the roles, we did not face any issue. User group field [$CLASS] was actually an org level field in that system and the roles were upgraded based on that condition.
When the Integration system was up and the upgraded roles were transported to IA, we noticed that they ended with a warning. On checking the logs we found out that User group [CLASS] actually was not an Org level value in the INtegration system, whereas it was an org level field in the development system.
Can someone tell me the reason why it is different? Is there any settings we have to change to make User group an org level field in IA. Thanks a lot for your help.
Vijith

Hello, I ran into this also and found these notes to explain why this is suddenly an org value and how to fix it:
http://search.sap.com/notes?id=0001580048
http://search.sap.com/notes?id=0001739055
Basically, GRC 10 add-on makes the user group an org value and the note instructs how to undo this manually, but there is a required pre-requisite because you cannot modify this for SAP delivered fields normally.
You know what else would be nice.... maybe there's a note that explains why Account Type is an org value. It REALLY should not be, IMO.

Side - effect of new org level

Hi,
we have parent - derived role concept.
few roles were added to the system ( 4.6 - > 700) "upload"
now in 4.6 system one field was maintained as 'org level', which is not in our system (WAS 700)
uploaded have value $FIELD , however this field is maintained in our system as FIELD with value *
now if i create FIELD as org level in my system, what are the side effects...
please advice.
regards,
Surpreet

Martin,
thanks.
please advice what is purpose of checkbox 'Test Mode'..
regards,
Surpreet
Going through SAP note 323817 & 754836........... also
Edited by: Surpreet Singh Bal on Oct 28, 2010 12:00 PM

Org level tab values

Similar Messages

Maybe you are looking for