Reporting authorization issue
Hi all,
After transporting roles, users, authorizations, queries and workbooks from Dev into Prod we have an authorization problem. There is a message during the opening of workbook or a web-query that says: "Your user master record is not sufficiently maintained for object XXX". After that the connection with the server is broken.
TX SU53 shows the message: "The user has no authorization on this authorization object".
Checking everyting in RSSM and PFCG didn't solve the problem. Comparing all relevant items in Dev with Prod showed no differencies. What may cause a problem and where to look to figure it out? In Dev everything works fine.
Thanks in advance.
Eugene
Did you check the authorization objects for the InfoProvider? In TC RSSM you can check, if an authorization object is switched on for an InfoProvider.
There could be a difference between D and P, depending on the order of your transports. An authorization objects gets activated automatically for an InfoCube, if it already exists, when the cube is created. If you create an authorization object but the cube already exists, you have to manualy switch it on, if it should be active.
That means: if you first transported the authorization objects and then transported the InfoCubes, all authorization objects would be active in the cubes.
Did you do an authorizatio trace (TC ST01)? That could give you additional information as well.
hth
Stefanie Schaaf
Similar Messages
-
Reporting authorization issue after BI 701 05 EHP1 upgrade
Hello,
We have recently upgraded our BI 7.0 to BI 701 EHP1 with 05 patch level. After this we had a problem with reporting authorizations for a report (query), which has created under Virtual Infoprovider.
Earlier the report use to be execute perfectly with authorizations S_RS_ICUBE object with Act 03, Subobject DATA, but after upgrade to EHP1, while executing report its throwing a error pasted below.
=============================================================================================
"Diagnosis
Errors occured while reading a VirtualProvider outside the BI system. Check whether the previous error messages contains any information about the possible cause of this error.
It is possible that the error message can not be displayed because the error message class does not exist in the BI system. If this is the case, only the name of the error class and the message number are displayed. View the error class in the source system of the VirtualProvider.
System Response
Procedure
Since the error is not necessarily in the BI system, there is no specific procedure for resolving it. With VirtualProviders, problems often occure with the connection to the system; these can lead to system termination. If the code for the VirtualProvider is not from the SAP, contact the relevant person to help resolve the issue.
If an SQL error is listed in the previous message, see the procedure for SQL errors."
===============================================================================================
After running st01 trace we identified the missing authorization is S_RS_ICUBE with Act 03, subobject DEFINATION.
Here please tell why is the subobject check is performed to execute a report (query), as this is happening after EHP1 upgrade, so let me know if anyone had any clue on this ...
ThanksHi Martin,
Thanks for reply.
The assumption what you made are correct, but these are the possible reasons only. Is there any specific note or any info from sap that these changes came due to the new release change, so that i can tell my manager clearly.
And I am not sure whether this is impacting the reports which using the VirtualProviders (Virtual CUBE) in place. If you could get bit more information that will be helpful...Thanks in advance.
Sridhar -
Interactive reports authorization issue ?
Hi All
I am working on CRM 7.0 , interactive reporting
As per SAP CRM interactive reports standards, employees can only see their opportunities and managers can see only the opportunities created by his team.
I need that all employees can see all the opportunities created by them or others and the managers also
What are the settings t be changed to enable this functionality
Regards
FahimHi!
This is not possible with CRM interactive reporting unless you assign every employee to a manager role in the CRM Org Model (which would contradict it's purpose). Unfortunately, your request would contradict the central authorization principle behind interactive reporting.
Due to this fact and because the expected data volume would also probably be too large to be handled by interactive reporting, I recommend to use BW reporting instead. BW is much better designed for large data volumes, and you do not have the Org Model restrictions as in interactive reporting. -
Report Authorization issues after Authorization Migration in BI 7.0
Hi SAPians,
we are facing report access for the customers after migration of authorizations (3.x to 7.0). All these are Customer reports and need to restrict their customer codes only. In two ways, i have tried to resolved this.
1. Roles - Maintained Customer Number in the authorized object CUSTOMER - Not working.
2. Created new authorization object through RSECADMIN and maintained the Customer Number with proper activity, validity etc.. - Not Working
(For Ex. Customer Number is "11500" and length of Char is 10)
While executing the report, i am getting below error:
Value "0000011500" for variable "Customer Authorization(Multiple Optional)" is invalid
Message no. BRAIN643
Diagnosis
Characteristic value "0000011500" is not valid for variable Customer Authorization(Multiple Optional).
Thanks and Regards,
VenkatHi,
It depends of the way your authorizations has been setup. If you did it role based or profiles direct to the customer. You should also look into the fact that the migration tool can create direct a profile (not a role with a profile). My way of working in a role based application was that I looked for the roles with objects s_rs_mpro, s_rs_icub, s_rs_odso, s_rs_iset(these are the objects that needs to be replaced with RSECADMIN) and the own build objects with rssm. I added the authorization object s_rs_auth to the role and the new objects made with RSECADMIN. If you transport then the roles and objects made in RSECADMIN it works good. Bottom line beaware of profiles that are not created by the profile generator.
Have fun
Jan van Roest -
BI 7.0 Analysis Authorization issue: some reports displaying a blank page.
Hi All,
This is regarding BI 7.0 Analysis Authorization issue.
Overview:
we have restricted some queries at infoobject level.
Issue:
a. For some of the queries, we can see the selection screen but when we try to execute the query by clicking on the execute button (Queries WAD) we get a blank page, meaning nothing is displayed on the output (white/Blank screen).
b. When we execute the same query through RSRT, we get a message which says "Disconnecting from BW server..".
c. Let me explain further on this. Basically we are doing this in order to have limited access to Auditors at the client side. At the same time normal users should not get impacted due to this, hence we created two roles. One for normal users and other for Auditors.
d. Now the thing is that we execute the same report with normal user ID's the report executes properly and displays the output. it does not show the blank page.
e. But when we execute the same report with Auditors ID then we get a blank page.
Any idea why this is so?Hi Neha,
I tried the below also,
GL Acnt
I EQ 0000134010
I EQ :
but still it didn't work.
No Infoobject is missing in Authorization Object.
For your point, "rsecadmin - > analysis -> execute as -> check for the desired user & analyze the log" it didnu2019t allow me to analyze, since as soon as click on execute button a pop-up comes up saying "Disconnecting from the BW server..."
As mentioned earlier also it is giving me the below message,
""I>> Row: 103 Inc: AUTHORITY_02 Prog: CL_RSR_RRK0_AUTHORIZATION RS_EXCEPTION 301CL_RSR_RRK0_AUTHORIZATION AUTHORITY_02"
Kindly suggest, since this is a show-stopper for us!
Thanks,
Ishdeep Kohli. -
Hi:
I created an analysis authorization ZCO_CODE to trstrict it by a company code.
I added following objects in authorization with values.
0COMP_CODE = 1000
0TCAACTVT = 03
0TCAIFAREA = *
0TCAIPROV = *
0TCAVALID = *
Then I created a role Z:00:BW_REPORT, where I added following authorization objects S_RS_AUTH and restricted it by value ZCO_CODE. Then I assigned this role to a user test01.
When I execute a program RSEC_MIGRATION for this specific user, I do not see authorization object ZCO_CODE on 2nd step of this program. Any Idea Why? I think this object should show up as I want to migrate this specific object.
Help will be appreciated.Hi Sachin:
Okay here is my issue.
I have a Reporting authorization Object created earlier which is ZCOCODE. I though I'll have to create a new Analysis authorization object e.g. ZCO_CODE and then restrict it with other chars. as mentioned in Marc Bernards presentation and then you have to migrate it.
In selection list I can see old Reporting authorization object. If I select it and use option "Enhance existing profile" then It will update profile and not role? right....
How can I see whether it has updated existing profile?????
Do I need to create new Analysis Auth. for Company code or I can use old Reporting authorization for company code?
For testing purpose, I created a test user and assigned all reporting roles but It will not show up in RSEC_MIGRATION step??? -
Variable screen/variant screen authorization issue
HI All,
We have implemented standard Cost Center Overview Report(0SR_C02_Q0002) in BI 7.
We have three selection fields:
1.Company Code which is mandatory
2.My controlling Area which is also mandatory
3.Costcenter which is not mandatory
The requirement we are facing over here is that in the Variable screen/variant screen when I enter a company code, then I need to display dynamically only those "My Controlling Area" values which are assigned to that particular company code and not all. In the same way after selecting the appropriate "My controlling area" value, I need to display only those cost centers in the cost center selection field which are assigned to the selected company code and My controlling area combination and not all.
can anyone guide me on how to go about on this authorization issue at the variable screen itself.
Please treat this issue/requirement on high priority.
Appreciated in advance.
Regards,
raps.Hi,
I think that an alternative to solve your concern could be using Web Application Designer (WAD). In this respect, there are several design options, with different levels of complexity.
As the simplest alternative, you could create a WAD including your query and three Dropdown Boxes: one for Company, a second for Controlling area and another for Cost center. The four mentioned elements should be linked to the same dataprovider so, when you select a company, the options in the other two Dropdown boxes and the information in the query are updated.
In order to enforce mandatory filter selection at Company and Controlling area level, you should set NO_REMOVE_FILTER='X' in both two Dropdown boxes, so that "All values" option -which would mean no filtering- is not offered.
I hope this helps you.
Regards,
Maximiliano -
Authorization issue - help request
Hi guys,
One of the consultants is having an authorization issue ( He is not abele to run a t-code)
I ask him to run a su53 report and i am not sure how to proceed with this.
Please help.
Here are the details from the SU53 report.
DISPLAY AUTHORIZATION DATA FOR USER VYXXXX
User : VYXXX profile parameter authorization buffering 4
Authorization Object: F_KNA1_GRP
Description
Authorization check failed:
+ Authorization object F_KNA1_GRP Customer Account Group Authorization
Activity 08
Customer Account Group ZM01
Users Authorization Data :
+ Authorization object F_KNA1_GRP Customer Account Group Authorization
Authorization T-PD19002300
Authorization T-UG39000900
Authorization T-UG39001000
Please help me guys what need to be performed.
Regards,
Vamsi.Hi Vamsi,
SU53 shows us the last failed authorization for a user. However, it might not only be the failed authorization object failed.
Hence, "just to learn" , you can use transaction ST01 to enable and run a trace for particular users. Be sure to use in a test environment first, and with proper filters. (for a particular user only).
Then check-> which auth object is failing.
RC=4 means a object value is failing.
RC=12 means an object is missing!
Check, which tcode is calling that object and this tcode is present in which role. Then.........proceed.
You can check the SAP documentation on running traces on the help portal of SAP. I think you will find the answer yourself by troubleshooting more and may be massaging some test roles here and there!
Likewise, if you are new to security, I would encourage you to start by reading some books on SAP security. Authorizations made easy is a good book to start with.
Let me know if you have any questions
EOD for me :P . take care
Abhishek -
Authorization issue during Jump
Hi all,
I am faced with an authorization issue when I am jumping from a BW report into an ABAP report in R/3. The particular BW report is built on a Multiprovider and when I jump to the R/3 report it displays a message saying that I have no authorization to display the R/3 report. Now the issue is that when I run the same report on the base infocube and perform the jump there is no problem. It works just fine.
Both the multiprovider and the base infocube have the same authorization objects checked.
Can someone please help?
Regards,
Ashmith RoyPls have a look on the below thread:
Authorization by InfoArea
Regards
Ganesh
*Assign points if this helpful -
Dear all,
I have an authorization issue with two ODS.
One I activated for BEx reporting --> Is working fine in Dev, but I get error with
missing authorization in QUA, althought some authorizations.
Same issue with a newly created ODS, which works in Dev, but gives an error
with missing authorization in QUA.
What can be the reason for this? Any input is highly appreciated!
Cheers,
ClaudiaHi,
check that the role(s) are transported from your DEV and your QA, and that the user has the correct role(s)
Check as well in your QA transaction RSSM for your ODSs objects; it might be that by transporting the ODS, some authorizations have been applied by default.
hope this helps...
Olivier. -
Hi guys,
I've the authorization issue in a BPS application, where a user can upload a flatfile into a BPS-cube, but only when I select in the authorization object S_RS_AUTH 0BI_ALL.
Without selecting 0BI_ALL (another analysis authorization) yields to the message, that the user has not enough authorization...
Now the user gets access to data in the BW reporting to all the organizational marks like the organization unit (0ORGUNIT).
How is it possible to design the authorizations / analysis authorization, that the same user can upload data via flatfile, but gets only access to transaction data for organizational data which he should see???
How should the analysis authorization should be designed? Has it something to do with the techn. char. like 0TCAACTVT?
THX in advance!
ClemensHi,
Have you tried creating Authorization Variable for organizational Unit ?
This will give restricted access to data based on the authorization assigned .
Thanks
Pratyush -
Regarding BI Authorization Issue
Dear Friends,
can anyone help me to solve this issue..
I have a Authorization Issue, u201CNO Authorization u201C
Error : EYE 007 ( Insufficient Authorizations )
I have follow this stepsu2026
Steps 1 :-
Define Authorization-Relevant Characteristics ( ZCUSTOMER )
Note : I have 0Division values C100 and C200, I want to restrict the user on ZCUSTOMER = 100.
Steps 2 :-InfoObjects as u201Cauthorization-relevantu201D
Eg: 0TCAACTVT
0TCAIPROV
0TCAVALID
0TCAKYFNM
ZCUSTOMER
Steps 3 :-Using T-code : (RSECADMIN) created the Analysis Object
For example : ZAUTH In That I have taken
ZCUSTOMERrestricted with value C100.
0TCAACTVT with 3 ( Display )
0TCAIPROV with * ( Astric )
0TCAVALID with *
0TCAKYFNM with *
Steps 4 :-
Assign Authorizations to Roles
Use authorization object S_RS_AUTH for the assignment of
authorizations to roles.
Maintain the authorizations as values for field BIAUTH
Ex: ZTESTA1
S_RS_AUTH
Here I have given my Authorization Analysis Object ( ZTESTA1) which I have created in RSECADMIN.
S_RS_COMP
Activity Create or generate, Change, Display, Delete, Execute <...>
InfoArea : ZDEMO_ MIHI
InfoCube : ZCUBET
Name (ID) of a reporting compo : ZTEST_Q0001
Type of a reporting component Calculated key figure, Query View, Query, Restricted key figure <...>
S_RS_COMP
Activity Create or generate
InfoArea :ZDEMO_ MIHI
InfoCube : ZCUBET
Name (ID) of a reporting compo :ZTEST_Q0001
Type of a reporting component :Query
S_RS_COMP1
Activity Display, Execute
Name (ID) of a reporting compo : ZTEST_Q0001
Type of a reporting component :All values
Owner (Person Responsible) for *
S_RS_COMP1
Activity Change, Display, Delete, Execute, Enter, Include, Assign
Name (ID) of a reporting compo ZTEST_Q0001
Type of a reporting component All values
Owner (Person Responsible) for :*
S_RS_ICUBE
Activity Create or generate
Infocube Sub Objects: DATA, Update rules, Data Definition, Aggregats
InfoArea :ZDEMO_ MIHI
InfoCube : ZCUBET
S_RS_IOBC
Activity Create or generate
InfoArea :ZDEMO_ MIHI
Infoarea Catalog : zioc_test, Zkf_test
S_RS_IOBJ
Activity Create or generate
InfoArea :ZDEMO_ MIHI
InfoObjets: ZCUSTOMER, ZDOCNO,ZMATERIAL
Steps 5 :-
AND Assign this Role to User.
Steps 6 :- ERROR
When I execute the Report it is showing u201CNO Authorization u201C
u201C Insufficient Authorization u201C
EYE 007.
Regards
SivaHi,
In RSECADMIN try to put on the trace with your user id & execute the query . System will give you list of authorization object with red color which needs to be reconsidered in order to execute report without error.
Hope that helps.
Regards
Mr Kapadia -
BI Reporting Authorization Based on Characteristic Value Level Error
Dear ALL,
i had create one authorization on sap bi and given to one user on plant level , it will work on fine RSRT,
But when i am used it on webi report through this user then i am getting below error
Database Error : Error in MDDataSetBW.GetCellData. You do not have Sufficient Authorization (IES 10901).
But in repor if other than user is login and report will work fine.
If in this report i removed key figure and only show plant then it will work with authorization.
Please help me out from here....
Thank You,
HareshHi,
"If in this report i removed key figure and only show plant then it will work with authorization."
even afterremoving keyfigures you should not get the records, if it is the issue with Authorization object that you have created. Check for some other authorization issues also.
I dont know SU53 marks Authorization error, if you run from WEBI, but try that also once.
Hope you have seen this thread,
https://scn.sap.com/thread/1136359
so, there is no single reason for this error
try posting this thread in BOBJ Integration kit forum also, there some experts can help you quickly
-Sriram
Message was edited by: Sriramvijay R -
Authorization issues MM/PP STATUS Changes
Hello,
I'm getting the following error even with SAP_ALL SAP_NEW
BDC Transaction Report for ZM02. Report: ZUCC0026
Run by: KHALIFAO page: 1
On: 11/11/2009 at : 09:06:12
In System: Q47
Authorization issues MM/PP STATUS Changes
M365SC1110020 ZFIN M680 MM/PP STATUS 00 Not authorized to change MM/PP status
One of my user is having the following error when she excuted the following steps :
Steps:
SE38/ ZUCC0026 - Material Mass update program for Costing View
Enter the following fields before executions
Material : M365SC1110020
Plant: M680
Check off update material
Field to update: select MM/PP status
New Value: 00
Execute transaction
Thanks
Osama
Expected results: output document should states that update of MM/PP status was changed from XX to 00.
This messageHello Julius,
SY-UNAME
ZUCC0026 550 WRITE: / 'BDC Transaction Report for ZM02. Report:'(b01),
/ 'Run by: '(b02) ,sy-uname COLOR 5,
1167 * IF sy-uname <> 'BATCH'.
1183 READ TABLE itab_zusrgroup WITH KEY group_id = group_id
user_name = sy-uname.
1212 SELECT SINGLE update_ind scop_ind
FROM zusrgroup INTO (itab-update_field,l_scop_ind)
WHERE user_name = sy-uname
AND group_id = itab_fields-group_id.
1219 * WHERE user_name = sy-uname
1223 READ TABLE i_zplant WITH KEY
user_name = sy-uname
werks = itab-werks.
1422 SELECT werks FROM zusrplant
INTO zusrplant-werks
WHERE user_name = sy-uname.
1453 MOVE: sy-uname TO i_zplant-user_name,
Parameter :
188 *PARAMETERS: p_mode TYPE c DEFAULT 'N' NO-DISPLAY. JHSIR35508-
189 PARAMETERS: p_field LIKE itab_fields-descriptio.
190 PARAMETERS: p_name LIKE itab_fields NO-DISPLAY.
191 PARAMETERS: p_newval(14) TYPE c.
193 PARAMETERS: p_file(100) TYPE c LOWER CASE.
194 PARAMETERS: p_filval AS CHECKBOX. "0001+
195 PARAMETERS: p_unix AS CHECKBOX. "0004+
33 PARAMETERS: P_UPD AS CHECKBOX.
Thanks
Osama -
Authorization issues in Bex Analyzer
Hello,
Can somebody help me with an authorization challenge Im working on? For certain reports a user should me authorized to see key figures for a certain area and this area is divided into several units. This is the high level report authorization. But when they want to see more detail in the report (the can drill down the person responsible or the customer for example) the user is only allowed to see the key figures of his own unit. To make this possible we have created two authorization roles:
Role 1
Area *
Unit 11
Person Responsible *
Customer *
Role 2
Area *
Unit *
Person Responsible :
Customer :
When executing the query with the characteristics area and unit in the rows and person responsible and Customer in the free characteristics there are no authorization issues. But when in the query result the user wants to drill down person responsible the error message You do not have authorization to read object XXX. I expected that the details would only be shown for unit 11. To be able to show the details the user must now first remove the drill down, filter the unit they have authorization for and then drill down the person responsible again. This is considered a workaround but not desirable. Is there a different way to solve this issue?
Kind Regards,
Petra van NoortHi,
Have you tried to include a authorization variable on your report that filters 'Unit'?
I'm not sure of what will happen if you use it (maybe you'll always filter your report on '11' unit, or maybe you get different filter values depending on your drill down status, which is what you want).
It's just a thought...
Regards,
David.
Maybe you are looking for
-
Under Windows 7, passwoord are not saved/remebered
Using WIndows 7, passwords are not saved / remembered. The list stays empty and sometimes the button "remember password" isn't even functioning.
-
I bought and transfer mac application (fxpansion Tremor) to ipod touch. Double tap dmg file in FileApp brings up unknown filetype dialog. What app processes dmg files to install them? an ipod touch supports all files types which its apps support
-
Hi all, I've created a Flash page in FL CS3 with ActionScript 3 that loads external content based on button clicks. All the external referenced files are present and the movie plays perfectly when tested in Flash player. However, when I insert this
-
Invalid column name 'formula6'.
This error occurs when i attempt to process the dimension. "- Error occurs during UpdateRemainData. Invalid column name 'formula6'." When I uncheck the InApp FORMULAH1 and FORMULAH2 properties it process without error. When I have them as InApp, i
-
Hi When trying to edit one of the default SCCM reports my IE browser pops up and disappears. I have ReportBuilder3 installed on my desktop.Is there any other software i need on my machine and SCCM server to be able to view the report config? Thanks