Regarding Role Authorisation and Obejcts

Hello Experts,
I have requirement from the basis team they want to know the object names for the particular transaction like MMBE and also they have request that they want to restrict to view the stock for plant 1000 for particular user, so they need the Object for Transaction and Object for the Plant to restrict how can I find it? Please it is urgent
Can you give me list of T.Code to Check User Authorisatiosn and Obects for the Particular Transaction code.
Regards,
Sundu

Hi Sunder,
You can use PFCG tcode to check the object of particular transaction code.
Execute PFCG and create temp role. Enter tcode in Menu and go to Authorization and click Change authorization profile and here you will get all the object related to that tcode.
Hope this will help.
-Pinkle

Similar Messages

Can we use a combination of structural and role authorisations in BW?

Can we use a combination of structural and role authorisations in BW for the same object (eg cost centre CC) in the same report?
If so how does it work? Read the structurals from the DSO and if missing then look for role auth?

When you say two different reports do you mean two different data grids in the same report or two different reports each saved with a different name?
Two data grids in same report connected to same data source will reflect changes in point of view as you are indicating.
If you have two physically different reports then they will not be connected the way you want.
If they are two separate reports what you can do is set up drill links from one report to the other that will let you open the second report from the first report and pass your filter selections to the second report being opened.

Down payment role authorisation

Hi all,
The user wants to change the description of down payments. so I want to assign a role authorisation for T code FB02 only for down payment section for this user, because in FB02 can change all FI documents. please suggest what are the document types (both vendor & customer) I need to inculde in authorisation objects or any other ways.
Regards,

Hi,
We don't allow authorisation for OB32 to users, in that case I need to create new role for FB02 and assign only allow to change vendor down payment description field BKPF - BKTXT and BSEG - SGTXT.
Please suggest, how can I assign in authorisation object.
Thanks

How to transport roles, pages and iViews in the PCD from DEV to QA

Hi
Please would someone telll me how I can transport/move roles, pages and iViews we have created in our own area of the Portal Content Directory from our Development to our QA portal environment.
Kind Regards
Claire

Hi,
Please check help.sap.com.
http://help.sap.com/saphelp_nw70/helpdata/en/c5/56599164d0c04cb566ba0e2d7ed55c/frameset.htm
Your Basis/NetWeaver consultants can help you.
Regards,
Masa

In which table we can find the relationship between Role id and Task id

Hi Experts,
In which table we can find the relationship between Role id and Task id in Cprojects.
Thanks
Subhaskar

Hi Subhaskar,
Apart from DPR_ENTITY_LINK , you can also get it from table DPR_PART.
Please go through the below link
http://wiki.sdn.sap.com/wiki/display/PLM/cProjectstablesin+SAP
I hope this will help you.
Regards,
Rahul

Relationship between Role id and Task id table name?

Hi
In which table we can find the relationship between Role id and Task id in saphcm
Thanks a
vibin

Hi,
HRP1001 --Infotype 1001 DB Table (Relationships)
Regards,
mohammed

Role Mapper and Authorizer

At one point I posted a forum entry and posted a solution for my entry regarding keeping the app deployments around while recreating/overwriting the domain using WLST offline. Keep App Deployments while recreating the domain in WLST offline
Things seems to work, except that I noticed that the XACML Role Mapper and Authorizer that were created the first time around (when there is no domain folder) are getting replaced by default Role Mapper and Authorizer (on subsequent runs when the domain folder already exists and we overwrite the domain)
Basically the first readDomain is causing this. without reading the domain, I cannot get the app list.
System.setProperty("com.bea.cie.script.throwException","true")
appdeps={}
try:
readDomain('c:/temp/basicWLSDomain')
cd('/AppDeployments')
apps=ls(returnMap='true')
for app in apps:
appdeps[app]=ls(app,returnMap='true', returnType='a')
except:
pass
try:
closeDomain()
except:
pass
#=======================================================================================
# Open a domain template.
#=======================================================================================
readTemplate("c:/wls11/wlserver_10.3/common/templates/domains/wls.jar")
#=======================================================================================
# Configure the Administration Server and SSL port.
# To enable access by both local and remote processes, you should not set the
# listen address for the server instance (that is, it should be left blank or not set).
# In this case, the server instance will determine the address of the machine and
# listen on it.
#=======================================================================================
cd('Servers/AdminServer')
set('ListenAddress','')
set('ListenPort', 7001)
create('AdminServer','SSL')
cd('SSL/AdminServer')
set('Enabled', 'True')
set('ListenPort', 7002)
#=======================================================================================
# Define the user password for weblogic.
#=======================================================================================
cd('/')
cd('Security/base_domain/User/weblogic')
cmo.setPassword('weblogic11g')
#=======================================================================================
# Create a JMS Server.
#=======================================================================================
cd('/')
create('myJMSServer', 'JMSServer')
#=======================================================================================
# Create a JMS System resource.
#=======================================================================================
cd('/')
create('myJmsSystemResource', 'JMSSystemResource')
cd('JMSSystemResource/myJmsSystemResource/JmsResource/NO_NAME_0')
#=======================================================================================
# Create a JMS Queue and its subdeployment.
#=======================================================================================
myq=create('myQueue','Queue')
myq.setJNDIName('jms/myqueue')
myq.setSubDeploymentName('myQueueSubDeployment')
cd('/')
cd('JMSSystemResource/myJmsSystemResource')
create('myQueueSubDeployment', 'SubDeployment')
#=======================================================================================
# Create and configure a JDBC Data Source, and sets the JDBC user.
#=======================================================================================
cd('/')
create('myDataSource', 'JDBCSystemResource')
cd('JDBCSystemResource/myDataSource/JdbcResource/myDataSource')
create('myJdbcDriverParams','JDBCDriverParams')
cd('JDBCDriverParams/NO_NAME_0')
set('DriverName','com.pointbase.jdbc.jdbcUniversalDriver')
set('URL','jdbc:pointbase:server://localhost/demo')
set('PasswordEncrypted', 'PBPUBLIC')
set('UseXADataSourceInterface', 'false')
create('myProps','Properties')
cd('Properties/NO_NAME_0')
create('user', 'Property')
cd('Property/user')
cmo.setValue('PBPUBLIC')
cd('/JDBCSystemResource/myDataSource/JdbcResource/myDataSource')
create('myJdbcDataSourceParams','JDBCDataSourceParams')
cd('JDBCDataSourceParams/NO_NAME_0')
set('JNDIName', java.lang.String("myDataSource_jndi"))
cd('/JDBCSystemResource/myDataSource/JdbcResource/myDataSource')
create('myJdbcConnectionPoolParams','JDBCConnectionPoolParams')
cd('JDBCConnectionPoolParams/NO_NAME_0')
set('TestTableName','SYSTABLES')
#=======================================================================================
# Target resources to the servers.
#=======================================================================================
cd('/')
assign('JMSServer', 'myJMSServer', 'Target', 'AdminServer')
assign('JMSSystemResource.SubDeployment', 'myJmsSystemResource.myQueueSubDeployment', 'Target', 'myJMSServer')
assign('JDBCSystemResource', 'myDataSource', 'Target', 'AdminServer')
#=======================================================================================
# Write the domain and close the domain template.
#=======================================================================================
setOption('OverwriteDomain', 'true')
setOption('CreateStartMenu', 'false')
writeDomain('c:/temp/basicWLSDomain')
closeTemplate()
#=======================================================================================
# Exit WLST.
#=======================================================================================
exit()
So I thought I will create the XACML Authorizer and Role Mapper myself instead of letting the default domain creation process do it. but that is resulting in duplicates on the first run (when the domain folder does not exist) and in the subsequent runs (when the domain folder already exists), I see one XACML and one default.
cd('/')
create('base_domain', 'SecurityConfiguration')
cd('SecurityConfiguration/base_domain/Realm/myrealm')
ls('a')
create('XACMLAuthorizer', 'weblogic.security.providers.xacml.authorization.XACMLAuthorizer','Authorizer')
create('XACMLRoleMapper', 'weblogic.security.providers.xacml.authorization.XACMLRoleMapper','RoleMapper')
I am going no where with Oracle Support. I am wondering if anyone ran into this before.

com.oracle.cie.config-wls-schema_10.3.6.0.jar has various SecurityConfiguration XML fragments and the wrong fragment is being used when the domain is recreated.
I am thinking it is a logic issue in domain creation.

PFCG Role Descriptions and Longtext in a Second Language

Hello,
I am a bilingual key user who maintains PFCG user roles for my organization (usually in German). I want to maintain the longtext and description fields for these same roles for admins signed on in English so that a translated version in English appears matching my German text. How can I do this?
Sorry for the post but the SAP help and also OSS were surprisingly no help on this issue.
Thank-You,
Ray Fischer

Hi,
Please apply the note-854311 and follow the below mentioned procedure.
For changing role description, please run the report Z_ROLE_SET_MASTERLANG.
It will ask for Agr_name(Role name) and orgin_lang(required language)
Regards,
KKRao.

Mass role creation and addition of tcodes to role menu

Hi Folks,
We've a requirement of building 1000's of single roles for an implementation. Our security matrix is ready with the role names and the list of tcodes to be embedded in each of these roles. What I would like to know is if we can automate a part of the process of role building i.e the following 3 steps only.
1. Creation of the Role
2. Addition of the tcodes in the role menu
3. Save
I'm aware of Ecatt/LSMW through which we can create the roles but i'm not sure if we can add the tcodes to the menu of the roles since the number of tcodes to be populated in each role will vary.
Could anyone of you shed some light if it is possible to automate the addition of tcodes to the role menu taking into consideration that each role will have different number of tcodes to be added to the menu and what's the best possible way to achieve this if there exists one.
Thanks in advance for your time and suggestions!
Guest...

Whilst I agree that there are probably too many roles being built here, which is more of an issue with the role design / strategy, the issue of how to easily create a role for a given list of transactions is something that SAP supports via the import menu from text file option in PFCG.
Yes you may need to write a script to cycle through all the possible role names, but we have recently had to build some roles based on actual usage, so exported transaction usage history to excel and then formatted the transactions into text files that could be imported to build the role menu.
You will still then need to ensure any object authorisation object have the correct values set - i.e. not just starred in - but as one of the pains in build a role is getting the menu to look reasonable, I'd suggest having a look at this approach.
Copy Menus -> Import from File is the function in PFCG in the menu tab for the role you are building
OSS note 389675 has details of what the text file of transactions for the menu should look like.
That should answer the question posed, rather than criticising the role design being followed.

Authorisation and user entry

Hi All
Can anyone tell me the difference between using Authorisation and Manual Entry for processing type for variable in query designer.
Thanks

Hi,
Manual entry variable takes the input values which you have provided while running of the report and gives the query output based on those selections.
Authorization variables gives the query output based upon the aurthorizations maitained for you in the roles assigned to you in the BW system.
It will not take into account all the selection values while running the query and will execute the report only for the values which you are authorized to.
So if you give A, B and C as selection and if you are authorizaed for A only then report will show you the data related to A only in the report.
Thanks
Ajeet

Role , Menu and Display Priority

I have a Role A with a menu sequence, Sort Priority 100
and a Role B with another menu sequence Priority 50
User is having role A and B
But B is displayed in the navigation before A.
How can I influence the display sequence?

Hello Holger,
I had done this job successful.
In my opinion, workset was used for first level menu
usually, not role ,role is only a concept.
We need to sort the workset which will be display in first level menu in fact.
And "Sort Priority" of workset can take effect,
I had validated that.
And the similar situation occured in second level menu.
Regards,
Jianguo Chen

Role, tcode and activity

dear all,
does anyone know whats the relationship between role, tcode and activity?
we can see all relationship in pfcg, but my client want a program that consist all role and tcode and activity, like role A has tcode A1 and A2, A1 can display only, A2 can change, display. i know this data can be found in table agr_1251, but unfortunately not all tcode can be found.
any idea ?
thanks

Hi
Check the following tables for your details
AGR_USERS
AGR_TCODES
AGR_1252
AGR_1250
AGR_DEFINE
AGR_PROF
AGR_TEXTS
ALSO SEE THE TCODES
<b>SUIM, SU21 AND PFCG</b> ETC
<b>Reward points for useful Answers</b>
Regards
Anji

Transported Role Change and can't see workbook.

I'm only guessing but I suspect this happened. In production we published two workbooks to our "FI Controlling" Role.
Then we added a t-code to the role in development and transported the role to production. Now my workbooks are missing from the role in Bex. Did the transporting of the role do this?
If so, how else can this be accomplished.
Thanks

Richard,
What do you mean by you published the Workbook.. ?? could you pls explain if it is different than what I am thinking..
you created a new workbook in Dev and assigned(saved) to the role..and you transported this workbook across the landscape.. (but sure, you have to transport the Role too)..
but still when you said, you have added a Transaction to the role you could see the workbooks in that role too (if it is a Dev box)...
we are missing something here..could you pls explain what happend exactly..
Regards
Mavi

Controller role Park and Post

Hi Experts
Here's what I got.
I need roles for my customer to park and post documents. This is what he is asking for:
Controller Role: No park, only post
Cost Acct Role: Park and Post, but no posting their own parked docs
Acct Clerk Role: Can only Park
I asked that he send me the transaction codes they will be using for this. Also, I thought I would use tcode SU24 and identify which authorization objects need to be interrogated. Anyone have a better solution?
I was able to get the tcodes the customer wants to use:
FB50 would be post only.
FV50 would be park only.
Edited by: Jim McCollum on Sep 10, 2008 10:50 PM

Dear JIM,
There is a useful document with screenshots on this wonderful functionality of SAP and this has saved lot of writing.
Link: [Click here|http://www.whypad.com/posts/sap-how-to-post-a-parked-document-fbv0/56/|Tip]
Trust this helps much and solves your problem!
Regards,
Ashok SINGH

Roles, Groups and Class of Service

Hi,
I am new to LDAP, have a good RDBMs background. I have read the Sun documentation to understand the concepts. Can someone recommend a good source that provide examples on how to set up Roles, Groups and Class of Services.
Thanks,
Bala.

Directory Server documentation set contains the best examples to my knowledge.
You may want to start with the Deployment Guide for introduction to the concepts and Administration Guide for setting them up and examples.
Regards,
Ludovic.

Regarding Role Authorisation and Obejcts

Similar Messages

Maybe you are looking for