Roles and Functions

We currently use roles to set our database permissions. What is the best way to grant SELECT priv's for functions without having to set them for each table within the function?

< We tried this but still gave us the error. >
Strange. The owner should have priveleges, and EXECUTE on the program should grant access to the owner's privileges while the program is running.
Besides AUTHID CURRENT_USER I have seen privilege weirdness by use of the alter schema command.
More information is needed. What error is being generated? Is the program using AUTHID CURRENT_USER, which will cause it to use the user's privileges and not the owners?
Message was edited by:
riedelme

Similar Messages

What is the roles of technical and functional consultants in ESS/MSS area?

Gurus,
What is the roles of technical consultants in ESS/MSS area?
What is the roles of functional consultants in ESS/MSS area?
Please help me see the differences.
Thanks,

Hi Thaman,
Responsibility of functional consultant in ESS/MSS:- Functional configuration under SPRO > Employee self service and manager self service, then preparation of Functional specification design (FSD) if any deviation from standard SAP, Unit test plan preparation and all functionailty testing
Responsibility of Technical consultant:- Preparation of Technical specification design document (TSD), activation of work flow and creation of workflow if additional is required. Creatio of form like vacancy requisition form, new position creation form etc.
Also some kind of technical configuration is there in SPRO for workflow and form
Regards,
Purnima

Error in reconcilation Function - Job "Reconcile roles and privileges"

SAP NW 7.0 SP2 Patch 3
Roles contain Privileges
Help file says: "If you are using roles and privileges, you will need to perform a reconciliation of the roles/privileges assigned to the users in the identity store after the roles are modified. "
Job imported as described.
When I let the job run on the ID-Store, for each entry, the following error message occurs:
runFunctionsInString($FUNCTION.reconcile( MSKEY )$$) got exception
org.mozilla.javascript.NotAFunctionException: reconcile( MSKEY )
...where MSKEY is, of course, the MSKEY of the entry.
If I let run the job with the Windows-Dispatcher and as a VB-script, it produces no error; however, in the output file, there are a lot of Messages like
"!ERROR: Invalid use of Null"
Only some entries (of Type MX_PERSON) show the "Priviliege added: (...)" output. But the job does not add the Privileges assigend to the role, as it should.
So, I would suggest that one redefines the SQL-Query of the Job so that it runs only on MX_PERSONS. But then, still, in my case, it does nothing.
Has anyone better experiences with the Job?
Edited by: Thomas P. Felder on Sep 25, 2008 10:32 AM

The job when imported by default uses java runtime engine but the script is written in vbscript syntax so you have to change the engine or the script syntax.
When you did your select statement did you use SELECT DISTINCT. That will also cause errors. I do not narrow the entry type to MX_PERSON.
I'm installing the patch now; I will see if I get any errors.

How to create a report of users in ucm about their roles and permission

Hi All ,
I need to create a report and it should contain all the users in ucm as well as their roles and permissions. Basically the report would be for the admin who can see all the users in a single report and can know about the roles and access of each and every users.
How to create such report ?? I have tried from web layuot editor but the default report template i.e stdUserReport in user datasource does not contain more than three fields..Is there any method to get such kind of report???
Please suggest!!

There was an example component to demonstrate this kind of function. Under Stellent in version 7.5
I do not know if they hand it out anymore but it is not on the standard samples page for Oracle. You may want to open a Support SR to ask for it. It should still be around in their servers if they can get permission to hand it out as a sample again.
Sample CustomReports component to demonstrate how to create customized reports
CustomReportsBundle.zip
Date:     October 30, 2006
Sample Version:     version=2006_10_20 (build 1)
Product and Version:     Content Server
Sample Status:     This is a Stellent Sample. Stellent Samples are free and include non-supported add-ons, utilities, tutorials or programming examples. It may require additional configuration or security auditing for maximum effect. It is not supported by Stellent without a consulting engagement.

Business Partner Role and Business Partner Grouping

Hello Everybody!
Business Partner Role and Business Partner Grouping.
Which correlation ist between this attributes existing.
In which table are this infos stored, In order create I can use
e.g. BUPA_CREATE_FROM_DATA
but how is the way inversely. Suppose I want to abtain the information
about a existing business partner which group he has etc.
Regards
sas

Dear Sas,
Business Partner Grouping is used to determine the number ranges to be used by the business partner at the time of creation.
Business Partner Role determines the subset of all the data available to be shown and edited.
I will give you a very simple (but imaginary) example for understanding the role concept: the business partner in a role of employee might allow you to enter a department id. So this field should be available to you for input when you edit the business partner in the role of employee. But suppose the same business partner is also a person who is your customer. And your customer will require a default payment term. So this field should be available for input when you edit the business partner in the role of a customer. Also, some applications use these roles to determine if the business partner is suitable for particular transaction. In the above example, Payroll application will only allow those Business Partner to be used if they are maintained as an employee. Similarly the sales application can mandate that you can only sell a product to a business partner if he is maintain in a 'customer' role.
Please understand the example above is not real but given for the understanding of the concept of role.
You can use the function module 'BUPA_CENTRAL_GET_DETAIL' to find the business partner group. And you can use the function 'BUPA_ROLES_GET' to find the role assigned to a Business Partner.
Regards, Rakesh

Transport roles and analysis authorization with user assigned

Hi expert,
I face with this problem transport roles and analysis authorization with user assigned. When I have created a transport request to move the roles and analysis authorization from development system to test system. I couldnu2019t maintain the user assigned, after transport I have to assigned manually all of user or create a program to fill AGR_USER table or there are other way.
Thanks for your time,
Luis

Hi,
In role administration, you have the following options for transporting roles:
You can download the roles from one system and upload them into another
You can import the role from a remote system using RFC
You can transport the roles with the transport function.
Role upload loads all role data, including authorization data from a file into the SAP system. The user assignments for the role and the generated profiles for the role are exceptions in this case.
Transporting Roles with the Role Transport Function
       1.      Start the role administration function by choosing Tools ® Administration ® User Maintenance ® Role Administration ® Roles (transaction PFCG).
       2.      Enter the role to be transported and choose Transport Role.
The Mass Transport of Roles screen appears. You can control the default settings for the options Also transport single roles for composite roles and Also transport generated profiles for roles using Customizing switches (see Role Administration Functions in the section Functions of the Utilities Menu).
You should not change the authorizations profiles of the role after you have included the role in a transport request. If you need to change the profiles or generate them for the first time, transport the entire role again afterwards.
For more information go thrpugh the below link
http://help.sap.com/saphelp_nw70/helpdata/EN/6d/7c8cfd410ea040aadf92e1f78107a4/content.htm
Regards,
Marasa.

Export and Import of Roles and Privileges

Hi,
We're nearing the end of our development phase and are now preparing for initial load in our QA / Test environment.
Is there a way to export the Roles and Privilege metadata from one environment to import them into the other. The Staging guide states you need to create them before importing your Identity Stores. I was hoping we didn't need to do this as it's a time consuming task to create them manually.
Thanks
Paul

What I've seen is Business Role Export / Import functionality. It is pretty straight-forward to do, just export the Business Roles in a job (limit what to export in the source SQL) to a CSV-file, then read it back in to different environment in similar job.
When we were exporting the Business Roles we expored the privilege-references as MSKEYVALUEs not MSKEYs. Note how you have named your repositories in different environments (as you know the name of the MX_PRIVILEGE differs if your ERP repository in development is eg ERP100 and in Q/A ERP200), you may need to convert the privilege names accordingly in export or import.
One more thing you need to keep in mind is to pay attention whether your data has CR+LFs, which will break the CSV, we tackled this by encrypting/decrypting the data that had line feeds (DESCRIPTION-attribute).

Is it possible to export and import the roles and users tables?

Hi,
is there any possibility to export and import the role and user definitions?
We have a SAP MDM repository with a lot of roles and users and also with a lot of changes.
And now I'm searching for a fast and efficient way of managing the roles and users.
Thanks and Regards, Melanie

Hi Melanie,
There is no export/import functionality for roles and users. The only way to manage these in an automated way would be to write a program that uses the Java or ABAP APIs. Both APIs expose functionality to create, update and delete roles and users.
Hope this helps,
Richard

ROLE OF FUNCTIONAL AREA

Hi,
Can anyone please tell me whats the role of functional area in projects.
This is defined in the project profile and flows down to the project objects.
Thanks
N.Somesh

Hi,
In my opinion, functional are has nothing to do with which costs are to be picked but once there is some cost, functional area is recorded in FICO documents. On the basis of the functional division, cost of sales accounting displays where costs occur in the organization.
In your case, functional area in project will be considered for postings. Refer this:
[Link 1|http://help.sap.com/saphelp_47x200/helpdata/en/5f/b77616a0f811d39755006094b969cf/frameset.htm]
[Link 2|http://help.sap.com/saphelp_47x200/helpdata/en/b4/afd3b2353e11d496c50000e835339d/content.htm]
Regards

In PP Interface related issues the role of functional consultant

In PP Interface related issues what is the role of functional consultant . what is the approach steps to analyse and resolve the issues in XI, interface, idoc, etc.,

For issues relating to interfaces, a functional person would need to diagnose what is causing the issue & thereby informing the technical person where to fix it, if the issue is due to system setup.
As regards to the steps, I just wish there was a manual which read something like
10 steps on how to analyze....
unfortunately there is none that I have come across or even if one is ever written on those lines will be very specific, so not much of use for your need. A good approach would be to have a clear understanding of what the interface is supposed to do, which would assist you in fixing the issues.

What is ESOA? What is the Scope/Role for Functional Consultants in eSOA.

Hi Experts,
1)     Does eSOA is a tool, application or module?
2)     What is the relation between eSOA and ECC6.0?
3)     What is the Scope/Role for Functional Consultants in eSOA?
4)     What I have to learn in eSOA?
5)     How it is useful for Functional Consultant?
6)     How it is useful for Customers?
7)     How much time it will take to learn eSOA?
8)     Where can get the Material?
9)     What all technologies I have to learn before I learn to eSOA?
I am working as a SAP HR Consultant. If I want to learn eSOA what are the pre-requisites.
I donu2019t know anything eSOA.
Please give me the answers.
Regards,
Ram

Hi Ram,
See the answers below
> 1)     Does eSOA is a tool, application or module?
ESOA is not any tool,application or module. Its a methodology/Architecture
> 2)     What is the relation between eSOA and ECC6.0?
ECC 6.0 provides some Enterprises Services through enhancement packages.
> 3)     What is the Scope/Role for Functional Consultants in eSOA?
FUnctional consultant should know which ENterprise Serrvices are available and which should be developed to carry out a business process.
> 4)     What I have to learn in eSOA?
.         Being a technical guy, there are things to be learnt like ESR, implementing designed serivces through ABAP or Java and consuming it. But being a functional guy, only awareness of what enterprise services are available and what they do and their input/output params and how they can fit into a business process is sufficient.
> 5)     How it is useful for Functional Consultant?
see above
> 6)     How it is useful for Customers?
Customers can move towards Service Oriented Architecture, get flexibility in changing a business process easily, maintaince cost is less
> 7)     How much time it will take to learn eSOA?
depends on your skills
> 8)     Where can get the Material?
lot of material in SDN
> 9)     What all technologies I have to learn before I learn to eSOA?
ABAP or JAVA,ESR ( being a technical consultant) , Web Services
> I am working as a SAP HR Consultant. If I want to learn eSOA what are the pre-requisites.
you should aware of basics of service oriented architecture
If you further want to clear doubts, do write up.
Regards,
Piyush

Re : Roles of Functional Consultant in upgradation from 4.6b to ECC 6.0

Hi
I need the Roles of Functional Consultant and Technical Consultant in upgradation from 4.6b to ECC 6.0.
Thanks
Anto

Dear Anto,
In Technical SAP,Upgrade from 4.6 to 6.0- the role of any fucntional consultant would involved integrated with the technical Consultant.
The phase starts with the technical Patches apply to the latest stack level which will done by the BASIS Consultants.
Once the System preparation is happened, the next phase is with SPDD phase, Thru this transaction the dictionary Objects-Database elements, database tables and structures of teh latest system can be
compared with the old system.
This results in the version modification results between the old and New versions. During this phase the involvement of the Functional Consultant needed for the tech guy, to identify the functional chnages between the two version (Old and New). Which helps for him either to Reset to Original(ie., adopting the new one) or Adopt Modification in previous system(ie., adopting to older functionality)
Once this is done, the System Upgradation will be done by the BASI, the system will be replaced with new system. At teh end of this phase SPAU phase starts, which inturn reults with version difference in the field namely, Programs, Reports, Screens, Messages, Notes an Function Modules. Here too the involvement of functional consultant neede to determine either reset to original or to go with Adopt modification from the older design, as explained earlier.
At teh end of the, moreover the functional consultant role involved in testing the Entire processes and transactoin in the system for system dump and bugs, in necessity to correct teh same and results with nil errors in production client.
Also the Zprograms invloved in the older versions, needs to be examined for the actual need, and to be justified with adoption in the newer version or by adopting to the updated functionality in the newer version.
Hope this may give better clarity in the involvement of the Functional Consultant in the Updgrade project.
Njoy SAP
Regards,
-Saravanaganesh

Roles of Functional Consultant in upgradation from 4.6b to ECC 6.0.

Hi
I need the Roles of Functional Consultant and Technical Consultant in upgradation from 4.6b to ECC 6.0.
Thanks
Anto

In Technical SAP,Upgrade from 4.6 to 6.0- the role of any fucntional consultant would involved integrated with the technical Consultant.
The phase starts with the technical Patches apply to the latest stack level which will done by the BASIS Consultants.
Once the System preparation is happened, the next phase is with SPDD phase, Thru this transaction the dictionary Objects-Database elements, database tables and structures of teh latest system can be
compared with the old system.
This results in the version modification results between the old and New versions. During this phase the involvement of the Functional Consultant needed for the tech guy, to identify the functional chnages between the two version (Old and New). Which helps for him either to Reset to Original(ie., adopting the new one) or Adopt Modification in previous system(ie., adopting to older functionality)
Once this is done, the System Upgradation will be done by the BASI, the system will be replaced with new system. At teh end of this phase SPAU phase starts, which inturn reults with version difference in the field namely, Programs, Reports, Screens, Messages, Notes an Function Modules. Here too the involvement of functional consultant neede to determine either reset to original or to go with Adopt modification from the older design, as explained earlier.
At teh end of the, moreover the functional consultant role involved in testing the Entire processes and transactoin in the system for system dump and bugs, in necessity to correct teh same and results with nil errors in production client.
Also the Zprograms invloved in the older versions, needs to be examined for the actual need, and to be justified with adoption in the newer version or by adopting to the updated functionality in the newer version.
Hope this may give better clarity in the involvement of the Functional Consultant in the Updgrade project.

Compliance Calibrator Design - Roles and Profiles

Hi guys,as you know SAP's authorization concept involves generation of Roles into Profile before it can be assigned to a User. In CC, i wonder why is there a need to segregate Roles and Profiles into 2 seperate functions. Isnt it already sufficient to analyse roles instead of profiles? Profile are names which is too technical which i feel should be omitted unless really necessary.
Well, unless it is to cater for indirect assignment where profiles are granted to position/org unit etc... I will also be trying out whether there is a difference when you only batch analyse a Role and intentionally excluding the 'profile' whenever a new role is created. Will the system work fine when i do a role analysis?
Cheers!

I agree that profiles are old fashioned and should be phased out. The system has to stop people from being able to maintain profiles directly and assign them directly before they do this though. SAP_ALL etc can be converted and assigned as a role. It would make the whole authorisation concept just that little bit easier. We are talking about a German company though!
Also, you don't need profiles for indirect assignment. You can relate roles to the position using PFCG! Click on the organisational management button on the user-tab, next to the user comparison button.
Using profiles (ie, maintaining directly and assignment) is highly recommended against.

Roles and authorisations in SEM BW

Hi All,
Our SAP SEM lies in BW, Business Planning and Simulation. I have configured everything, but now i want to create roles and authorisations which point to specific planning folders. How do I do that? I understand we do not use the standard transaction PFCG to create roles in BW SEM, what transaction do I need to use? May I get a little bit of detail from the transaction to the point at which i specify a certain role for a specific planning function or planning folder.
I will really appreciate your help.
Regards,
Tatenda.

Hi,
please use the search function and read the great number of threads regarding this topic.
The SEM-part of SAP has a lot of role-stuff for authorsation (via PFCG) but also BW-authorisation which is done via "rsecadmin". Actually, forget pfcg because you can click on pfcg in the rsecadmin, so you never have to go back to pfcg anyway.
The BW-authorisation is created via rsecadmin, as i said, and included to a role via pfcg in the object S_RS_AUTH.
For example someone needs the reporting-auth for one company. You create via rsecadmin a BW-auth-object, call it "comp_01". Include there the infoobject 0COMPANY (if you use that one) and include the special infoobjects (there is a button on the top). Then go in rsecadmin to the tab User and switch there to PFCG. Select/create a role, put the S_RS_AUTH in there (and maybe if needed the BEx-Query stuff) and then type in that BW-auth-object "comp_01". That's it.
btw: Roles are only for the application, the BW-Auth is for infocubes, infoareas, infoobjects and so on...
Best Regards

Roles and Functions

Similar Messages

Maybe you are looking for