Roles n Queries

Hi,
Till now we are restricting the queries based on the Infocube. We are planning to start using the queries based on the Role, so that queries from different cubes can be accessed by the users. I am not good at security. I would like to know
1. How to create a Role (I know PFCG, but what kind of role I need to create and how would be seen in BEx open Queries screen, as there are not such roles seen)
2. How to assign/save the queries to that role.
3. What kind of security access should we give to the users (does assigning the role accomplishes this)
4. How are things different in terms of workbook, If any?
Thanks
Gokul

Hi Gokul,
Answers to your queries
1. & 2. go to PFCG transaction, here enter the name of the role which is to be assigned to users .
a. In this role go to change authorisation screen.
b. here check for the object class :Business Information Warehouse (Tech name 'RS').
c. In this go to the Authorization object :Business Explorer - Components (tech name 'S_RS_COMP').fill up the authorization as * in all the fields except the field 'Name (ID) of a reporting compo'(tech name:RSZCOMPID). here enter the names of the queries you want to give authorization.
3. If you want the user only to view the report then you can do this in the authorization files 'Type of a reporting component' (tech name RSZCOMPTP)where you can give user only 'query' (REP) authorization.
4. For workbooks if you don't want user the refresh the query then just provide the name of the work book in the Menu tab in user role change mode. But if you want user to refresh workbook you have to enter all the queries used in the work book as the same way explained above.
Hope this will help you out
Enjoy
Regards
Rahul

Similar Messages

Need procedure for creation of BW Roles, Assigning Queries,Publishing Roles

Hi Experts,
Could you please let me know the procedure for creation of BW Roles, Assigning Queries,Publishing Roles in Business Explorer (BEx - BW 3.5)
Thanks in advance,
Andy

Hi,
Creating BW Roles
http://help.sap.com/saphelp_nw04/helpdata/en/52/6714b6439b11d1896f0000e8322d00/frameset.htm
Assigning Queries
After creating the query, save the query to a role from the query designer.
Publishing Roles in Business Explorer
https://websmp101.sap-ag.de/~sapdownload/011000358700002894802003E/HowToBIPortal1.pdf
Hope this helps you..!
-Pradnya

Standard Display Roles For Queries in BW

Dear All,
Could you Please share the Standard Display Roles For Queries in BW.
Thanks
Regards,
Sai

Hi Sai,
You can find query specific roles in metadata repository.
Also try this table in
SE16. AGR_OBJ
Other useful tables might be:
AGR_DEFINE -      Role definition
AGR_USERS -      Assignment of roles to users
AGR_HIERT           Role menu texts
AGR_AGRS           Roles in Composite Roles
If you need to find user specific roles, check Tcode SUIM.
Hope this helps.
Thanks

Assigning roles to Queries

I have created a query which is a look alike of a similar query. I need to assign it the same roles as the original one.
My questions:
1. How do I see that to what roles the original queries are assigned?
2.How do I assign the same roles to my query now?
3. I have created the query and right now it is in Favorites folder. I want to know whether I need to remove it from there ?
4. Also, I have not placed the query in a workbook. Is it mandatory to place it in a workbook before assigning it the concerned roles ? If yes, then how do I place it in a workbook ?
Please guide me stepwise. I will be very thankful to you all.
Sufficient points will be assigned.
Regards,
Srinivas

Dear Srinivas D Rao ,
1)Go to Metadata Repository and select "Query". Find your query with CTRL+F and click on it. Assigned roles are displayed at the bottom of the page.
if you cannot find with that way or you need to know more than one query in 'one go', you can try
table RSRREPDIR type in queries technical name to field COMPID (use arrow icon 'multiple selection) to get COMPUID, then go to table AGR_HIER SAP_GUID = COMPUID, AGR_NAME is the role name
2)To assign the roles to queries you will have to query designer open query-> select the query which you want to assign and in the top there is option for the roles....it's third or 2nd from left.
once you click it will take you to the roles already existing in your system.
just chose the role to which you want to assign and click OK.
Before that... if you have no roles in your system...then you will have to create through t-code PFCG.
3)Favourite folder is your own place and it will be shown only to your groups.. so i think its not necessary to remove from favourities folder..
4)If you place the query in Workbook,then it will be easy to assign roles and authorization to it...
Note:
Suppose you have to test and validate the queries that are created then , for example you can have a role named test and validation and you can assign the queries to that role and you can add the users who can access these queries in that role.
Broadcast roles
we can broadcast to the roles.When u do like that all the users who are in that role will receive that.In the information broadcasting screen, under receipents u have to select the value for USER IN ROLE.
[Data Protection guide|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/4b1f472a-0a01-0010-76a3-8f7b81d95c59]

Roles from queries

Hi all,
I am able to get the name of queries included in a role.
But how to get the name of roles in which my query is published.
Is there any table which can give this information?
Can any body help me on this.
//Pradeep.

Hi,
1)Go to tansaction SE16 and give the table name RSRREPDIR.Give the query name in the field COMPID.
2)copy the GENUNIID from this table and give as input to table AGR_HIER in the field SAP_GUID.
3)we will get the role name in the column "AGR_NAME" of the above table AGR_HIER.
Hope this helps.
Cheers,
Srinath.

Roles and queries Technical content cube

Dear Experts,
Is anyone aware of any technical content cube that has information about roles and which queries those roles have access to?
ie. I need Roles - Query mapping
I have already looked in to AGR_1251 table but here the direct value is not present. I will have to evaluate the S_RS_COMP and
S_RS_COMp1 authorization objects. Iam looking for another method. So please dont suggest AGR_1251 table.
Thanks,
Kris

Hi Kris,
The way that is there to find out the query - mapping details is already known to you which is the best possible way. But apart from that if you would like to know the roles present in your system then you can simply use the Metadata Repository that is already there and is easily accessible.
1) Just go to the RSA1-> Left hand side bottom -> Metadata Repository -> Click on it or use tcode RSORMDR.
2) You will get list for all the Activated objects in your production system.
3) Locate the Role object from Right hand side.
4) On clicking the Role you will get all the roles that have been created in your system.
If you want the role related to a query then you can simply select the Query object from the metadata repository, you will get list of all queries & further clicking on the query will give you entire details about the query like roles etc.
Also you can use your own method.
You will need to write your own abap to get the details by writing logic which compares the data from both the tables and displays the data accordingly else the best option that is always there is using Metadata Repository.
Thanks

Resource Staffing to a Project Role - Few queries :)

Hi,
There is a Newly created project role. Now the role needs to be assigned with the project task and also a resource needs to be staffed to the Project role.
The role creation, task assignment are going good as per the defined processes. But I am finding difficulty to staff the resources to the role. On searching the resources (please note I have not mentioned any criteria in qualification) I am getting a list of resources but on staffing them neither of them is having the availability.
My questions are..
1) Are there any validity dates (for staffing) for the resources which are defined as the Busienss Partner in the BP T Code.
2) On creataing a new Buseinss Partner in the BP and searching the same while staffing it does not show it. (Guess it can have some batch-job for updates as per requireement). Please suggest my guess is right or not.
3) Do we have any functionality in cProjects wherein based on role requirement (with its availability dates) we can explore the number of resources which can be staffed with their availability dates. (I guess it is similar to the qualification criteria match functionality, but please note I have not used the qualification in my test case here).
Please suggest. Full points for the correct and useful answer.
Regards,
Nishit

Hi Nishit,
1. I dont think there is any validity period explicity defined for BPs. The Business Partners can be staffed if they are not 'blocked'.
2. Ensure that you create BPs with Employee role.There is no batch job update required if you have created BPs in the same system.
3. Yes. This is possible. Check out the Resource Search Functionality in cProjects. Availability can be set as a desired search criteria there. You can maintain the BP availability in the t-code RPM_EMPDATA.
Regards,
Vivek

Transport request for BW queries and roles.

Hi All,
we need to craete 20 bw queries on 4 multiproviders. We need to save 18 queries as workbooks in one role and the other 2 queries in other role. Both the roles and queries does not exist and will be created in Developement environment.
We just want to know how we can transport them in the quality environment. What is the right method to transport them.
Can we transport all the object queries, workbooks and roles in number of transport requests so that if few queries or workbooks needs any changes then we do not have to transport all objects just the request which includes the changed objects.
Thanks & Kind Regards,
Hardeep

Thanks a lot for all of you for your quick response. But i still have questions.
If we create one transport for roles and one transport for each query then we will be having 21 transport requests. But the transport request on same multiprovider can lock the clacuated key figures and restricted key figures, if they are present in more than one query, it means they will be present in more than one transport requests, so they can be locked and trasport request will be failed.
If i just create one transport request for all the objects roles, quaries & workbooks it will not loack any object, and transport request will not fail. But i have to transport all the objects again if i need to change one of the queries.
Please let me know if there is a method that i can divide my queries as per multiprovider and can create transport requests as per multiprovider so that we can not lock calculated keyfigures and restricted key figures. Is workbooks can be published in the role in the same transport request. If it is and if in more than one transport request we are publishing the different workbooks to the same role, will it lock the role.

Link between queries and roles

Hello,
Could someone tell me if there is a way to have an overview on the link between roles and queries?
For example a table which give us a role and the liste of queries which are linked to this role.
Thanks in advance.
Hicham

Hi,
I also had same query :
mapping between the query/report and the role with technical names - BI Sec
Its a bit tricky.
Actually there are no direct linkage between queries and roles. However, you can look up S_RS_COMP in the roles that will help you identify which all queries the role gives access to.
Regards,
Zaheer
Edited by: Zaheer on Aug 28, 2008 4:19 PM

BI roles-queries

Hello,
I have some BI roles and queries have been assigned in to those roles.
I need the list of Roles versus Queries , is there any table in BI where i can down load this in Excel ? ( like we have agr_tcodes table in R/3.. )
Thanks,
SR

Hi,
if you are referring to the queries which a user has access to can be known to a level through
AGR_1251 for Auth Objects S_RS_COMP, S_RS_COMP1.
reports with the instances having field RSZCOMPTP with value "REP"
in them verify values for field RSZCOMPID "Name (ID) of a reporting component".
The value there the list of queries to which a user has access to.
But the problem is u might not get the exact names in some cases where a string has been given like CA* etc..
same way look for the COMP1 object too and the intersection of these two is the access u have..
hope this helps
Manohar

BI- role-queri ..

Hello,
I have some BI roles and queries have been assigned in to those roles.
I need the list of Roles versus Queries , is there any table in BI where i can down load this in Excel ? ( like we have agr_tcodes table in R/3.. )
Thanks,
SR

Hi SR,
You can check in PFCG.
Go to PFCG give the technical name & give the role name.
And if you want you can adjust the queries as well by going through change mode...
Regards,
Lakshman Kumar Ghattamaneni

Concept of groups vs concept of roles

Hi!
I'm designing an LDAP structure mainly for authentication and authorization of users. I want to use the LDAP server for applications, intranet (different platforms like linux, NT, ...) and portals.
I read the Admin guide about groups and roles and found, that there aren't that many reasons for using roles instead of groups. The only real difference is (as I understood) that when using roles, I don't have to search for the the groups a user is member of, because every user contains the nsrole attribute with all the roles he is member of.
One big reason for not using roles is, that they are quite specific for iPlanet Directory Server. If one ever changes to another product (for example OpenLDAP) the roles concept may or may not be the same. When using groups I don't have that problem.
(If my information about that is incorrect please conradict!)
A mixture of groups and roles is a quite bad idea because if I put a group in a role, the "nsrole" attribute is added only to the group but not the the members of the group, so if I use roles, I should stick to them and should not use any groups.
As I told at the beginning, I am planning an LDAP structure. I don't have any "real life LDAP-experience" so if your experience is different, please tell me.
Thanks in advance for your opinion!
Florian

1. Why there could be a problem without scopes in
groups. If I have two companies and each of them has
a group "employees". Two companies would probably be
separated in two different subtrees, so I just use a
dynamic group, where I can specify a subtree where
groupmembers can be located or I use static groups,
where I define each entry.You see, you had to make a choice on which group type you could use - not because one was more convenient for defining members for the problem at hand, but because only one would work at all.
One thing I did not mention about roles advantages: they all work the same way - if a new role type were invented, applications written to work with roles prior to the new role, would still work with that role type. Groups types are so different that forward compatibility is not possible - mostly because to even use groups, applications have to do all the work to do common things like, enumerate the group, enumerate the groups an entry belongs to, test for group membership etc.
>
2. The coding logic for group evaluation with dynamic
and static groups and even mixtures of it is quite
complicated, it is much easier to ask an entry for a
roledn and thats it, but do most clients support
roles? Probably not. But then roles have not been around as long. I don't have any hard data on how many apps use roles - you would be surprised how hard it is to get that data for a developer.
As far as I know roles are not used in any
other LDAP Server. Well, the Sun DS, and the Netscape DS (which admittedly were once the same thing) both support the same roles.
So you can optimize an
applications implementing a role based queries, but
if you have a OpenLDAP environment you also need a
possibility to use groups. Talk to the OpenLDAP people about that. I believe they (at one time at least) decided to support the Netscape slapi interface - roles have interface components in that api.
I do understand what you are saying - there isn't an RFC, so other servers don't support roles. Well, I'm sorry, I never got around to it. To be perfectly frank, a lot of LDAP RFCs/Drafts merely describe some proprietary mechanism which other servers never adopt. Some even describe mechanisms that nobody has ever implemented.
When it comes down to it, it is only you who can decide whether being able to move to OpenLDAP or some other server without any reimplimentation is an important consideration. Every server will have features not supported by others, and if your choice is to use only those that are commonly supported, then that is your choice.
Roles will allow much less complex coding in order to use them and they are much faster than equivalent client side operations, but the price is non-comformance with other servers. But when that non-conformance simply boils down to entries which merely "describe" the groups without adding application level functionality - how much have you really lost? Well, until you need to change server vendor you have only gained, and then you'll need to put in the effort you saved ealier.
On the other side, what
application do support roles right now? (I really
don't know)Apart from applications by vendors that also supply DS I don't know either - but support for features such as this need to come from customers of those products. It is surprisingly simple to add support for roles in a product (for most it will almost be free) - much simpler than for groups.

Assigning a Report to Role

Dear All,
I know many times this question has been asked and answered, but even after following those threads I am not getting solution (of course problem is at my side for sure but that needs to be identified).
I have designed a BEx query , saved it and published it to a role from menu --> Go to Publish --> To Role (say role X). And transferred it to PROD. But still that report is not available in that role. Users who are having this role are not able to view that report.
I followed the steps to check a role for that report.
SUIM --> Authorization --> By Value --> Authorization Object 1 = S_RS_COMP --> RSZCOMPID - Name(ID) of a reporting component = my report name
I can not find my role x over here.
I followed the steps to assign a role to that report.
PFCG --> Entered my role name (say role X) and change --> Authorization --> Change Authorization Data --> Business Information Warehouse --> Business Explorer Components --> Added my reports to Name(ID) of a report component --> Generate and Save it.
But still that report is not available in that role and users can not see that report.
Please guide.
PS: followed threads
Thread Name
Description
assigning bi report to particular role
It explains about how to assign a role to a report. Open query designer, open your query in it, for to menu bar, click on query, go to publish and say publish to role...
BI Folder Roles
This thread is basically for folder role.
Issue while adding BW reports to role menu | SCN
It explains about PFCG.
adding reports(queries) in BI to a role in bex ... | SCN
About roles for queries and workbooks.
Steps to add Query to a role (SAP BW)
A very good step by step explanation for adding a query to role.
Adding report (query & workbook, templates) in roles
Best explanation of two ways to add a report in a role.
Add BW Query into role
Explained easiest way i.e. Open query designer, open your query in it, for to menu bar, click on query, go to publish and say publish to role...
AUTHORIZATION FOR BI REPORTING - Business Intelligence (BusinessObjects) - SCN Wiki
Perfect step by step guidance for authorization for BI reporting
SAP BW BI - PFCG - Añadir Libros en los Roles.avi - YouTube
The simplest video which explains how to use PFCG.

When I follow your steps.
I got an error.
"You do not have the authorization for components report_name".
"Incorrect call of OLAP layer CL_RSR_OLAP;error in BW-BEX-ET()"
Futher it is showign me
Diagnosis
You do not have the authorization for the selected component.
System Response
The selected component cannot be edited.
Procedure
lease speak to the person responsible for authorization, if you require authorization for the editing of this component. The function is protected by the object "Business Explorer - components" with the following fields:
InfoCube ZSD_IS02
Type of a component REP
Component ZSD_IS02_DV_Q001
Activity 16
Message Number BRAIN 800
Please help.
Message was edited by: BI DEVELOPER

Save Workbook in a role in SAP BI

Hi All,
I'm facing an issue in SAP BI 7.0 Security . I have created a Workbook role for a user which she is not able to view when she goes to RRMX>Save Workbook> . The user has all the required authorizations and she can see all the other workbook roles but there is just one role which she can't get in the list when she tries to save workbooks in it.
She can see the role otheriwse in the tab roles.
Any help is much appreciated.
Thanks and Regards
Manisha Nadir

Hi,
If you have no authorizations for update a role, you will not see it when trying to save a workbook(s_user_agr with activity 01,02,06 and the name of the role or * is needed). I made a special role for saving workbooks and also had the name of it in s_user_agr, you will find this when save the workbook in save workbook as and if there is already an other workbook in the role you will also see this in the option add a workbook to a role.
It is also possible that the workbook is called from history or favorites and if you then will save it you need a role as described before.
It is advisable to try this out with the trace on in st01. I noticed that depending of queries and workbooks saving, it uses s_rfc, s_cts_admi(tabl), s_rs_tools (themes for workbooks and webpublish is also an option) and the object in previous answers from this thread.
I noticed that if you start a query from roles, that only the roles with queries are shown, the same for workbooks.
Have fun
Bye
Jan van Roest

ABAP User Roles and Query for accessing particular T- codes and Reports

dear Gurus
I have one problem, i want to know about ABAP User Query ,i have one requirement my user wants to Lock all the HR Std versus Customized reports in T- code SQ01,other department peoples also see the Payslips and Hr personal reports which is harmfull to the dept so i want to Lock all the reports in Std T- code in SQ01 and i have created one Customized User Roles or Query in which the T-codes and Reports are assigned only those particular user can access the T-codes and Std reports .how can it be possible i dont have any idea about user roles and Queries .
kindly help me out or send me some documents related to user roles and queries
regards ritesh sharma

Hi Ritesh,
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/103cafc2-7a64-2b10-14b3-eddb7d324561
Regards,
Flavya

Roles n Queries

Similar Messages

Maybe you are looking for