PO authorizations: SAP R3, Oracle 9i, Sun Solaris

Question

Hi experts,
I need to give authorizations as follows.
1. Auth for creating PO (ME21N) for 10 users of Document type (M_BEST_BSA =All)
2. Auth for creating PO (ME21N) for 20 users of Document type (M_BEST_BSA =UB)
3. Display of POs (ME23N) to all 30 users for all document types.
Assume I have 30 users total. when i create roles and assign to users. All 30 users are able to create POs of all doc types.
Can someome give some clue. . . .
Adv thanks. . .

Answer 1

From what you have said, you are in a difficult position.
Auths are additive, so if you need M_BEST_BSA with actvt=01 and doc type = * in the same role (or any other role that is assigned to the users) there is no way that you can provide the restriction for ME21N.
Your options are:
- Restrict ME21N and ML81N in the same way
- Do not restrict ME21N but provide an alternative control, e.g. user training + review of each PO to ensure they are correct doc type
- Split the assignment of ME21N and ML81N to different users
- Find a user exit in ME21N that will allow an additional check on a custom object that includes doc type.
Hope that makes sense
Cheers
Alex