Restrict HR Authorization Object PLOG By HR Structural Auth Profile

Question

Via OSS Note 453786, SAP requested customers not to use HR Authorization Object PLOG_CON. 
We have a requirement to restrict HR Authorization Object PLOG by HR Structural Authorization Profiles. How are other customers able to accomplish this objective without authorization object PLOG_CON being used?
(Custom solution:  ZPLOG_CON/custom FM, or use HRBAS00_STRUAUTH BADI)?
Thank you,
Ken

Answer 1

Ken,
1. the note you mentioned is specific to sap version 46b. is that the version your client is on? just wanted to check.
2. then you have not mentioned anything about the requirement, i mean explicit details.. without which it is very difficult to come to a solution.
3. you look like you are on the right track of thinking though with the z-auth-object/function module/badi thingy...
4. ultimately solution is dependant on the explicit requirements.
the 'con' bit usually refers to context sensitiveness of security when a mixture of regular and structural auths would not meet the security requirements.... so at a high level:
1. design the structural profile with the right combo of eval path and function module(z-fm?)
2. do the right thing by plog by explicitly mentioning levels of suths for all objects and subtypes and infotypes as well.
3. use p_origincon to assign the structural profile
4. a combination of all of the above should do the trick...
good luck
cheers