PFCG, derived roles, create inheritance relation for existing roles

Dear reader,
We have many roles that differ only in the organisational levels, but were not created using the Transaction Inheritance functionality.
Because of the sheer number of these similar roles, making a change in a non-organisational field in these roles is quite laborious.
Such a change is much easier when there is an inheritance relation between a template and all dependent roles.
Is there a way to set up the inheritance relation between a template and it's dependent roles after their creation ?
Kind Regards,
John Hermans

My own thinking what will happen if we combine so and so roles....
I have a other basic question regarding the field values of a A.object.As we know the one particular A.object is related to so many T.codes.Eg:assigning just 1 tcode to a role which contains 5 A.objects(those 5.A.objects are related to so many different T.codes).If we generate the profile for the role it will bring up all the mandatory field values for that specific T.code which is added.Suppose if we assign some values in the fields which are blank(maintain) or even changing the standard values(01,02 standard but deleting those values and assigning 03,04).Will the user gets accesss for the maintained/changed field values ? The reason for asking is ,as we are deleting the mandatory field values of the tcode and assigning some other values which are standard values for some other Tcodes (which are not added in the menu)
Pls excuse me if it confuses ....

Similar Messages

Problem creating Network ACL for a ROLE in Oracle 11gR2

According to Oracle Documentation when you create a new Network ACL you can add privileges to a user or role. I need to create a new ACL for the UTL_SMTP package for a specific role, but when I granted it the users who have that role are still getting the "ORA-24247: network access denied by access control list (ACL)" error when they try to send an email. If I grant the ACL privilege to the same users directly it works fine. Is there any step I'm missing? This is the test I have made on my Solaris 10 - Oracle 11gR2 (11.2.0.3) Standard Edition server:
SQL*Plus: Release 11.2.0.1.0 Production on Wed Aug 21 09:31:52 2013
Copyright (c) 1982, 2010, Oracle. All rights reserved.
SQL> CONNECT system/******@testdb
Connected.
SQL> SET LINES 1000
SQL> SELECT * FROM v$version;
BANNER
Oracle Database 11g Release 11.2.0.3.0 - 64bit Production
PL/SQL Release 11.2.0.3.0 - Production
CORE    11.2.0.3.0      Production
TNS for Solaris: Version 11.2.0.3.0 - Production
NLSRTL Version 11.2.0.3.0 - Production
SQL> COLUMN host FORMAT A20
SQL> COLUMN lower_port FORMAT 99999
SQL> COLUMN upper_port FORMAT 99999
SQL> COLUMN acl FORMAT A40
SQL> COLUMN acl FORMAT A40
SQL> COLUMN principal FORMAT A15
SQL> COLUMN privilege FORMAT A10
SQL> COLUMN is_grant FORMAT A8
SQL> COLUMN status FORMAT A10
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
no rows selected
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
no rows selected
SQL> CREATE USER testacl IDENTIFIED BY testacl;
User created.
SQL> GRANT CONNECT TO testacl;
Grant succeeded.
SQL>
SQL> BEGIN
2     dbms_network_acl_admin.create_acl('test_smtp.xml','TEST SMTP ACL','TESTACL',true,'connect');
3     dbms_network_acl_admin.assign_acl('test_smtp.xml','localhost',25);
4     commit;
5 END;
6 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
HOST                 LOWER_PORT UPPER_PORT ACL
localhost                    25         25 /sys/acls/test_smtp.xml
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
ACL                                      PRINCIPAL       PRIVILEGE IS_GRANT
/sys/acls/test_smtp.xml                  TESTACL         connect    true
After creating this ACL I test it like this:
SQL> CONNECT testacl/testacl@testdb
Connected.
SQL> SELECT host, lower_port, upper_port, privilege, status FROM user_network_acl_privileges;
HOST                 LOWER_PORT UPPER_PORT PRIVILEGE STATUS
localhost                    25         25 connect    GRANTED
SQL> DECLARE
2     c utl_smtp.connection;
3 BEGIN
4     c := utl_smtp.open_connection('localhost', 25); -- SMTP on port 25
5     utl_smtp.helo(c, 'localhost');
6     utl_smtp.mail(c, 'Oracle11.2');
7     utl_smtp.rcpt(c, '[email protected]');
8     utl_smtp.data(c,'From: Oracle'||utl_tcp.crlf||'To: [email protected]'||utl_tcp.crlf||'Subject: UTL_SMTP TEST'||utl_tcp.crlf||'');
9     utl_smtp.quit(c);
10 END;
11 /
PL/SQL procedure successfully completed.
SQL>
This works fine and I receive the email correctly. Now if I try to do the same thing for a role:
SQL> CONNECT system/******@testdb
Connected.
SQL> BEGIN
2     dbms_network_acl_admin.drop_acl('test_smtp.xml');
3     commit;
4 END;
5 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
no rows selected
SQL> CREATE ROLE testacl_role;
Role created.
SQL> GRANT testacl_role TO testacl;
Grant succeeded.
SQL> ALTER USER testacl DEFAULT ROLE ALL;
User altered.
SQL>
SQL> BEGIN
2     dbms_network_acl_admin.create_acl('test_smtp.xml','TEST SMTP ACL','TESTACL_ROLE',true,'connect');
3     dbms_network_acl_admin.assign_acl('test_smtp.xml','localhost',25);
4     commit;
5 END;
6 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
HOST                 LOWER_PORT UPPER_PORT ACL
localhost                    25         25 /sys/acls/test_smtp.xml
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
ACL                                      PRINCIPAL       PRIVILEGE IS_GRANT
/sys/acls/test_smtp.xml                  TESTACL_ROLE    connect    true
SQL>
And now I test it again with the same user:
SQL> CONNECT testacl/testacl@testdb
Connected.
SQL>
SQL> SELECT host, lower_port, upper_port, privilege, status FROM user_network_acl_privileges;
no rows selected
SQL> DECLARE
2     c utl_smtp.connection;
3 BEGIN
4     c := utl_smtp.open_connection('localhost', 25); -- SMTP on port 25
5     utl_smtp.helo(c, 'localhost');
6     utl_smtp.mail(c, 'Oracle11.2');
7     utl_smtp.rcpt(c, '[email protected]');
8     utl_smtp.data(c,'From: Oracle'||utl_tcp.crlf||'To: [email protected]'||utl_tcp.crlf||'Subject: UTL_SMTP TEST'||utl_tcp.crlf||'');
9     utl_smtp.quit(c);
10 END;
11 /
DECLARE
ERROR at line 1:
ORA-24247: network access denied by access control list (ACL)
ORA-06512: at "SYS.UTL_TCP", line 17
ORA-06512: at "SYS.UTL_TCP", line 267
ORA-06512: at "SYS.UTL_SMTP", line 161
ORA-06512: at "SYS.UTL_SMTP", line 197
ORA-06512: at line 4
SQL>
I'm aware that role privileges doesn't apply inside procedures, functions or packages by default, but this is an anonymous block so it should use the active roles for the user. I also tried adding a "dbms_session.set_role('TESTACL_ROLE');" at the beggining of the anonymous PL/SQL block but I got the same access error.
Thanks in advance for any help you can give to me on this question, it would be very hard to grant the ACL to all the individual users as they are more than 1000, and we create more regularly.

Thanks for your quick reply... I don't have a problem creating the basic ACL with the privileges granted for a user. The problem appears when I try to create an ACL with privileges for a ROLE. You can see here http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_networkacl_adm.htm#BABIGEGG than the official Oracle documentation states that you can assign the ACL principal to be a user or role:
Parameter
Description
acl
Name of the ACL. Relative path will be relative to "/sys/acls".
description
Description attribute in the ACL
principal
Principal (database user or role) to whom the privilege is granted or denied. Case sensitive.
My issue is that when I try to create the ACL for a role it doesn't work.
Have you ever created an ACL for a role? if so please send me an example or let me know which step I might be missing. Cheers.

Problem in creating new versions for existing DIR using CV01N

I am working in SAP ERP 6.0 EHP 4.0 system.
I have problem in creating new versions for existing DIR using CV01N
I create a DIR version 00 with functional location and mpd cycles. Then when i try to create a new version by copying the contents created from already created document.I change the MPD cycles in the new version and save it.
once when i display the first document created the mpdcycle specified in version 01 is copied to the 00 version.
The document is inconsistent where versioning of document doesnot work properly wrt MPDCYCLE and MP HEADER.
The problem which i found was the document identification guid remains the same for all the document versions getting created.
The same is working fine in SAP ERP6.0 EHP3.0 sytem.
Please someone help me in resolving the above issue.
Regards,
Prasad.B

There is a change in the standard code.The reason for the above problem was because of a missing Enhancemnet point in a standard function module 'CV110_DOC_CREATE_WITH_TEMPLATE'.
IS-ADEC-MPD - Enhancement to copy MPD data
ENHANCEMENT-POINT CV110_DOC_CREATE_WTEMPL_01 SPOTS ES_SAPLCV110.
+*$*$-Start: CV110_DOC_CREATE_WTEMPL_01----------------------------------------------------------$*$*+
+**ENHANCEMENT 1 ZSF_AD_MPD_SAPLCV110.    "active version**+
+*** copy MPD relevant data from templ. doc to current doc**+
+**CALL FUNCTION 'MPD02_COPY_MPD_DATA'**+
    +**EXPORTING**+
      +**is_draw = ls_draw**+
    +**TABLES**+
      +**ct_drad = lt_drad.**+
+*ENDENHANCEMENT.**$*$-End:   CV110_DOC_CREATE_WTEMPL_01----------------------------------------------------------$*$*+
Created a custom enhancement point similar to SAP ECC6.0 EHP 3.0 system.
The reason was the buffer was not getting cleared previously.After inserting the above code the DIR's are getting created withot any issues.
Regards,
Prasad.B

Create new mailbox for existing users?

Hi All,
I am new to JNDI concepts. I need to create new mailbox for existing users in domino directory. is it possible?
Scenario is : I have some users in domino directory. They dont have mail account now. I want to create it.
Kindly guide me...
Thanks,
Ram

Hi,
You can try LSMW (Direct method) for uploading class values.
Upload file can hae following structure:
OBJEK     |     ATINN     |     KLART     |     ATWRT
Release Grou+Release strategy |     Characteristic name     |     Class type     |     Class Value
e.g. rel grp is PO, rel strategy is 01, characteristic name is EBAN_EKORG, and class value is 1000 then
OBJEK     |     ATINN     |     KLART     |     ATWRT
PO01     |     EBAN_EKORG |     032     |     1000
multiple characterstics can be
OBJEK     |     ATINN     |     KLART     |     ATWRT
PO01     |     EBAN_EKORG |     032     |     1000
PO01     |     EBAN_EKGRP |     032     |     100
Regards,
Yogesh

Health Report for existing role in support and upgrade documentation

Hi Experts,
I am looking for create a report or using existing report/FM (if any) which will show new objects been thrown for a role with there SAP suggested values when we use PFCG expert mode merge option. I think this will be very helpful for support person to health check for roles and during upgrade in step 2C documentation people can save a hell lot of time. I do not have ABAP knowledge. Can anyone help me on this?
Regards,
Arpan Paik

Hi Julius,
I have been to that wiki before and one by you as well (regarding upgrade steps). For current upgrade I have also noticed that SU25 step2B is not only left with customer related changes only. Where USOBT_C/USOBX_C has same values as of USOBT/USOBX there update to customer table automatically happened in step2A. So 2B left with very less changes where customer prefer the standard way!!!
What I am looking for is actual authorization change delta. Step2C gives us only list of roles get affected. I am lookimg for what change actually can happen to a single piece of role due to upgrade.
I have followed below method.
1. Join table USOBT_CD and USOBT_C to see actual proposal for changed transaction and corresponding auth object. Here I had to perform few excel work to remove data repetation
2. Then take old data for roles from AGR_1251
3. Put together above 2 data and after proper sorting by object manually remove the data which SAP does by expert mode merge function.
Can this step be automated by some ABAP code? or function module?
Otto wrote :
If I start/ when I start and still remember this thread, I will update it
Please do so and thanks for sharing thoughts.
Regards,
Arpan Paik

Create business partner for existing employee for SAP version 4.7

Hi all !
Do you know of a similar program of function like the HR_SYNC_PERSON in ECC 6.0 but work for version 4.7 ?
I have look in OSS and SAP forum but I have not found.
Our company need to create business partner for all existing employee but for our SAP 4.7 version.
Thanks
Hugo Nguyen

USER EXIT
http://www.sap-img.com/abap/a-short-tutorial-on-user-exits.htm
http://www.sapgenie.com/abap/code/abap26.htm
http://www.sap-img.com/abap/what-is-user-exits.htm
http://wiki.ittoolbox.com/index.php/HOWTO:Implement_a_screen_exit_to_a_standard_SAP_transaction
http://www.easymarketplace.de/userexit.php
http://www.sap-img.com/abap/a-short-tutorial-on-user-exits.htm
http://www.sappoint.com/abap/userexit.pdfUser-Exit
http://www.sap-img.com/ab038.htm
http://help.sap.com/saphelp_46c/helpdata/en/64/72369adc56d11195100060b03c6b76/frameset.htm
http://www.sap-img.com/abap/a-short-tutorial-on-user-exits.htm
http://www.sap-img.com/abap/what-is-user-exits.htm
http://expertanswercenter.techtarget.com/eac/knowledgebaseAnswer/0,295199,sid63_gci982756,00.html
Transaction Code - MM41                     Create Material &
Exit Name           Description
MGW00001            Material Master (Retail): Additional Data
MGW00002            Material Master (Retail): Number Assignment
No of Exits:          2
Transaction Code - MM42                     Change Material &
Exit Name           Description
MGW00001            Material Master (Retail): Additional Data
MGW00002            Material Master (Retail): Number Assignment
No of Exits:          2
Rewards if useful.........
Minal

How to create a partiotion for existing table

Hi,
There ia one table in database with data. I want to create a partion for this table. data loss of data is not an issue.
Please provide the query for this.
Regards,
Venki

An existing non-partitioned table cannot be partitioned. You will have to create a new, partitioned table and move the data (if you care to keep it) from the old table to the new table, potentially followed by dropping the old table and renaming the new table to use the old table name.
If you do not have a downtime window to accomplish this, you can use DBMS_REDEFINITION to assist. That, however, is just adding a bit of extra complexity on top of the basic procedure in order to support users accessing the table while you're building the new table. Unless your downtime window is insufficient to accomplish the move manually, I wouldn't bother with DBMS_REDEFINITION.
Justin

"Create" Datasource Privilege for Deployer Role

Hi,
We want to enable the "create" datasource privilege for the Deployer Role, after reading some information for this role looks like they are only allow to modify or delete datasources, but not create them. Admin privilege is not a good option for this group.
Any ideas or suggestions...

BoopathyVasagam wrote:
Thank you for your answer. So should I issue the below statement? (Since I dont have dba privs i couldn't test this)
GRANT CREATE VIEW to P_ETL_TEST_VIEW;
I doubt that above will prevent the error from being thrown.
prior to running anonymous block again; just do as below
SET ROLE NONE;
doing so should result in same error being thrown when invoking
BEGIN
p_etl_test_view;
END;

SAPSCRIPT: Creating new Language for existing form

Hi Guys,
I need add an additional language for an existing form. Italian is not available for the this existing form. How can I add this language? do I need to copy the form with language EN? how can I include that form in the existing form? or there are other way to do this? Thanks in advance!
Regards,
Michael Nacionales

There is a change in the standard code.The reason for the above problem was because of a missing Enhancemnet point in a standard function module 'CV110_DOC_CREATE_WITH_TEMPLATE'.
IS-ADEC-MPD - Enhancement to copy MPD data
ENHANCEMENT-POINT CV110_DOC_CREATE_WTEMPL_01 SPOTS ES_SAPLCV110.
+*$*$-Start: CV110_DOC_CREATE_WTEMPL_01----------------------------------------------------------$*$*+
+**ENHANCEMENT 1 ZSF_AD_MPD_SAPLCV110.    "active version**+
+*** copy MPD relevant data from templ. doc to current doc**+
+**CALL FUNCTION 'MPD02_COPY_MPD_DATA'**+
    +**EXPORTING**+
      +**is_draw = ls_draw**+
    +**TABLES**+
      +**ct_drad = lt_drad.**+
+*ENDENHANCEMENT.**$*$-End:   CV110_DOC_CREATE_WTEMPL_01----------------------------------------------------------$*$*+
Created a custom enhancement point similar to SAP ECC6.0 EHP 3.0 system.
The reason was the buffer was not getting cleared previously.After inserting the above code the DIR's are getting created withot any issues.
Regards,
Prasad.B

How to create Document Structure for existing project in Solution Manager

Hi gurus
We have all the project document saved using Solution manager . we have ended with Phase1.
We are starting Phase2 and they are asking me to creat different folder as Phase to in existing project and store all the Documents
Can any one please tell me how to create New folder and store the documents in Existing project
Point will given for helpfull Answer
Thanks
Bhaskar

Hi Bhaskar,
Assuming you have full authorisations, the procedure is simple.
Please go SOLAR_PROJECT_ADMIN transaction.
From the menu please select Project -> Copy
In the ensuing screen, key in your desired project name, scroll through the other checkboxes to see if you are happy with the default choices; if not, take corrective actions.
In the last set of radi buttons "Desired behaviour at later version comparison", the default choice (2nd entry there - Adjust target project to the original of the source project) is fine.
From your scenario, since you do not have a Template -> Implementation Project functionality and instead are copying from one Implementation to the other, this radio button is of little consequence.
Execute the process.
In the window that comes up, please choose Local Object, assuming that you do not want to capture the whole contents into a 'Transport'. This is more required if you are aiming to copy the project from one SolMan instance to another.
It would give an information message "Generating in batch job (Name ......)
In a few minutes, you'd receive an intimation of the Project being copied.
That's pretty much about it. Have a check on the newly created project in SOLAR01.
Please let me know if you have any doubts.
Best regards,
Srini

Create new characteristics for existing release strategies

Dear experts,
Whenever I have a roll-out, I have to create a new characteristic that is the purchase order value in local currency, that is to be assigned to the class used for the Release Strategies of purchase orders.
The problem is that whenever I do this, all the existing release strategies have an additional characteristic to be maintained. Since I have more than 1.500 release strategies, I have to go through each one of them and except for the new release strategies, put >= zero in this new characteristic.
Is there any way, that whenever I create this new characteristics, I can define a default value that will be assigned to every existing release strategies in the system?
I've tried to use the default value, but it only works when I'm introducing the characteristics values for the first time in the release strategies.
Any ideas?
Thanks.

Hi,
You can try LSMW (Direct method) for uploading class values.
Upload file can hae following structure:
OBJEK     |     ATINN     |     KLART     |     ATWRT
Release Grou+Release strategy |     Characteristic name     |     Class type     |     Class Value
e.g. rel grp is PO, rel strategy is 01, characteristic name is EBAN_EKORG, and class value is 1000 then
OBJEK     |     ATINN     |     KLART     |     ATWRT
PO01     |     EBAN_EKORG |     032     |     1000
multiple characterstics can be
OBJEK     |     ATINN     |     KLART     |     ATWRT
PO01     |     EBAN_EKORG |     032     |     1000
PO01     |     EBAN_EKGRP |     032     |     100
Regards,
Yogesh

Problem in creating 1007 relation for postion

Hi,
I am trying to create relationship(1007-Vacancy) using batch input session..If I use PP02, in online first screen shows vacancy indicator and open fields, if I save it it is going to next screen showing personnel officer with screen field T750X-RESRF..
I cann't use the batch input method as the second screen is not appearing in recording..
I tried with couple of function modules also, but it is working without updating RESRF field in IT1007. But I need that also should updated..
Is there any other way of resolving this problem..
Regads,
Anji

Hi Anji,
It cannot be done with a standard function call. You can copy the function OM_CREATE_VACANCY & put code in it to read the table T750X & obtain the RESRF value for that Position and pass it to the itab1007.
Regards,
Suresh Datti
P.S. Welcome to SDN & please reward helpful answers.

Creating Style Sheets for Existing Text

Can I get some advice on what would be the easiest way to create and apply style sheets to a document that was layed out w/o any? My Art Director layed out a dozen pages of actual type w/o any style sheets. It's a pretty basic layout with Headers, Sub-heads and body copy. There are no "space afters" applied to any of the hard paragraph breaks after sub heads, and nothing has style sheets applied to it. All text has Basic Paragraph applied. I know how to create style sheets based on what he created, but then how would I apply to the rest of the pages w/o having to physically format it all? Thanks for any help with this.

SIcsempertyrannis schrieb:
Your flippant response to my question was to send my Art Director for basic computer training. How exactly is that polite or helpful? And if you know the difference between a hard and soft return then why did you ask if I meant shift+return when I clearly stated there were no space-afters applied to any hard paragraph breaks?
Your initial response was laden with typos and sarcasm, as is your second. If you dont want to be bashed then practice what you preach. Again, and for the last time, if you dont have an answer to a question you should refrain from posting.
No "space after" does not mean that it is shift-return! The space is depending on the settings of the Paragraph (Style) in Intends and Spacing. And sorry, a lot of people here mean with the same words different things.
And yes, send your Art Director to a training, because when smeone uses shift-return instead of properly paragraphs he has not enough knowledge to do word processing.
Thanks for the typos you have found. But you can keep them and all others you will find here. And no, I had no sarcasm.
I decide myself if I refrain from posting, it is not your job.

Create File Table for Existing UNC Paths ?

Hi,
I have a files with in the server ( //Server1/Folder1) and (//server1/Folder2).
Now If I am create FileTable Database in the server ( server2 ) and how can I give filename path ?
Example :
I am going to create FileTableDB database in the server2 , it contains directory 'D:\'
CREATE DATABASE FileTableDB
ON PRIMARY
(Name = FileTableDB,
FILENAME = 'D:\Microsoft SQL Server\MSSQL\DATA\FileTable\FTDB.mdf'),
FILEGROUP FTFG CONTAINS FILESTREAM
(NAME = FileTableFS,FILENAME='\\Server1\Main\cfs')
LOG ON
(Name = FileTableDBLog,FILENAME = 'D:\Microsoft SQL Server\MSSQL\DATA\FileTable\FTDBLog.ldf')
WITH FILESTREAM (NON_TRANSACTED_ACCESS = FULL,DIRECTORY_NAME = N'FileTableDB');
GO
If I run above query then I am getting an error is " cannot be used for FILESTREAM files."
Please help me to solve this..

Hi Narsa,
The FILESTREAM data container for a database must be placed on an NTFS volume on locally-connected storage. Just like database data and log files, the directory cannot be on a UNC share. Even if you use UNC it will not work. FILESTREAM can be setup only
for locally attached storage (locally for the server).
There are more information about enabling and using FILESTREAM, you can review the following article.
http://lennilobel.wordpress.com/2010/12/12/sql-server-2008-filestream-part-2-of-3-enabling-and-using-filestream-2/
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support

Warning while creating PR/PO for existing MRP

Hello everyone,
is possibile to customize a message that while creating a PR or a PO suggest him that the material has already been purchased via MRP?
Thanks in advance,
Marco.

No as per standard SAP.

PFCG, derived roles, create inheritance relation for existing roles

Similar Messages

Maybe you are looking for