Security for General Object Services

Trying to restrict authorizations for GOS at the document type level.
We are currently in 4.6c. We are using the authorization object S_WFAR_OBJ to restrict document type, object type, and the activity level. This authorization object works as expected when a user goes into tcode OAWD(SAP ArchiveLink: Store documents) but if a user goes into another tcode such as XK03(Display vendor (centrally) the user can then attach for any document type using the Global Object Services icon.
Does anyone have any suggestions on how to control what document types when using the GOS icon?
Thanks
Eric

Eric,
Try this as it will work for you.
Using T-code SE16 view table TACTZ
This will tell you the valid activites ACTVT for you auth object
Now it should be possible to change the one you don't want in T-code XK03
Let me know if you want me to eleborate.

Similar Messages

Navigating from ME49 to ME47 tcode 'General object service' icon missing

Hi All ,
We have scenario wherein we are navigating from transaction ME49 to ME47 .
In ME47 'General Object Services' icon is missing .
When we direcly go to ME47 , it is working fine .
If any of you come across this issue , Pl.provide inputs .
Thanks in Advance,

1.5-3 minute boot up as opposed to 15-20 seconds
And
why it takes a long time to load a lot of things.
I have restored this
from a time machine partition.
TimeMachine is only a backup and restore, it won't fix issues in software and according to your information, doesn't even optimize the restore for best performance on boot hard drives.
What you need to do to regain your speed is to understand how your machine works
Why is my computer slow?
Fix any and all issues in software following this list of fixes
..Step by Step to fix your Mac
Then follow this defrag method I've outlined
How to safely defrag a Mac's hard drive
Most commonly used backup methods
There shouldn't be need to reinstall OS X fresh unless your having file structure issues which if they are should appear when in the Steps, which then a zero erase and install will cure as well as any bad sector issues, the defrag step wouldn't be necessarry on a freshly installed system obviously as the files are written all together, not in portions all over the drive.
Hope this assists.

Configuring KPRO for generic object services

Hello,
I have a requirement where I have to configure KPRO as the storage for generic object services. We are using the generic object services for materials and hence using the Business object BUS1001. Please let me know of how to do the same or if we have any documents for configuring the Generic object services and KPRO please provide me the same.
Regards
Nilanjan

Hi,
i reply to the question you posted in my thread:
I solved the request without using Kpro. Kpro ist just a more comfortable way in managing documents. But using ArchiveLink and GOS is all you need if you just want to upload documents and view them in a linked transaction. I would be able to give you a better help if you would give a short introdcution in what you plan to do in detail.
kind regards Matthew

How to add security for Azure Cloud Service?

Hi,
We have build some API's in azure cloud service.
We want to add security for Azure Cloud Service.
How to add security for Azure Cloud Service?

Hi Santhosh,
You may add security for your API's by using:
Mutual certificate authentication
Using OAuth 2.0
Manage developer accounts
Regards,
Manu Rekhar

Indicator for Generic Object Services

We are planning to use the Generic Object Services functionality to
attach Word, Excel or PDF files to existing documents in SAP. Our plan
is to use this in Accounts Receivable. The issue we have is when we
are looking at the open items for a customer using transaction FBL5N
there is no way to know which open item has attachments. Once you've selected an open item, you can view any attachments but this does not help. I posted an OSS notes and they replied "We regret to inform you that the function you require is not included inthe SAP standard system." Does anyone know how I pursue this to have SAP develop this functionality?
Thank You,
Sue Rademacher

While this is probably answered best in the ABAP forum, by doing a search on Generic Object Services in all forum categories, I found a number of answers about enhancements with this functionality. Re: How to link proces modeling to execution of services are found in this forum thread.
Marilyn

OWSM security for a OSB service- authenticate from weblogic security realms

Hello,
I have a requirement to add security to a OSB service.
The user details are configured in weblogic security realms. lets say there are ten different users.
I need to protect my osb service using OWSM policy & the policy should be configured to authenticate the user from realms.
I am new to OWSM & wondering if this is possible?
Can the experts please direct me to any docs or steps?
Thanks
Ganesh

Hi,
Thanks for the links.
I followed the blog and configured it using oracle/wss_username_token_service_policy.
Now my requirement is to send the username,password from proxy to business and to the BPEL. (the bpel needs this username /password & and in header)
The issue I am facing is the proxy service is not sending the soap header details to business service.
I dont want to make the proxy as passthrough. (ie set Process WS-Security Header to NO)
I have to authorize on proxy level and then send the same credential details to business service?
So the question is, how can I retrieve the header after osb process it?
Can anyone please help me here?
Thanks
Ganesh

Authorization Object for using Object Services

Can you tell me how to limit a users authorization to create or delete attachements using the object services functionality? We'd like to control the addition and deletion of the attachments. Is there a specific authorization object for this functionality?
Thank you, Julie

Hi julie;
I hope that following are the solution for you problem. Check wheather this is helpful to you or not.
Authorization Object C_DRAW_BGR (Authorization Group)
The following table shows authorization object C_DRAW_BGR. This authorization object allows you to limit access to individual documents.
Fields      Possible Values      Description
BEGRU (Authorization group)      0000 - ZZZZ      Used to restrict the authorizations for document maintenance further.
Authorization object C_DRAW_BGR can be used to restrict access to individual documents. It works like a simple on/off switch. If the check of object C_DRAW_BGR is fine, the user's authorization can be further restricted by checking C_DRAW_TCD (check only based on the document type) or C_DRAW_TCS (check of the
combination of document type and status). At the fifth level there is a BADI called DOCUMENT_AUTH01, which you can use to design your own authority check.
Authorization Object C_DRAW_DOK (Document Access)
The following table shows authorization object C_DRAW_DOK. This authorization object controls which original data of a specific document type there are access authorizations for.
Fields      Possible Values      Description
ACTVT (Activity)      52 53 54 55 56 57      Change application start Display application start Display archive application Change archive application Display archive Store archive
DOKAR (Document type)            Here you enter the document type that access to original data is allowed for.
Authorization Object C_DRAD_OBJ (Object Link)
The following table shows authorization object C_DRAD_OBJ. This object controls which users can process which document info records, based on a combination of activity, object, and status.
Fields      Possible Values      Description
ACTVT (Activity)      01 02 03 06      Create Change Display Delete
DOKOB (Object)            You must enter the data base table for the objects here (for example, MARA for material record).
STATUS (Document status)
if useful rewards points.
Regards,
nitin
Edited by: nitin bhagat on Feb 18, 2008 6:23 AM

Error while "Enabling Security for Oracle Management Service"

Hi,
I have installed OEM 10GR1 on Solaris 9. I am using 9.2.0 database for repository.
My first installation of OEM and agent went smoothly, and everything was working fine.
Then, I tried to follow configurating security for Grid Control Framework. I got following error:
/oracle/app/oracle/product/10gEM>cd bin
/oracle/app/oracle/product/10gEM/bin>./emctl secure oms
Oracle Enterprise Manager 10g Release 10.1.0.3.0.
Copyright (c) 1996, 2004 Oracle Corporation. All rights reserved.
Enter Enterprise Manager Root Password :
Enter Agent Registration password :
Enter a Hostname for this OMS :
Checking Repository... Done.
Checking Repository for an existing Enterprise Manager Root Key... Done.
Generating Enterprise Manager Root Key (this takes a minute)... Done.
Fetching Root Certificate from the Repository... Done.
Generating Registration Password Verifier in the Repository... Done.
Generating Oracle Wallet Password for Enterprise Manager OMS... Done.
Generating Oracle Wallet for Enterprise Manager OMS...Missing /oracle/app/oracle/product/10gEM/sysman/wallets/oms.uxtora1/ewallet.p12
:/oracle/app/oracle/product/10gEM/bin>
Please help.

Thanks for response. I had temp space full issue with repository database. After bouncing database, the temp tablespace became empty, and the secure operation went smooth.

Security for a web service

Hi everyone,
Scenario :
I want to securise a web service with SSL.
I want to call this web service with Java standalone class (not servlet, JSP,...).
Here is what I've done :
1) I created a web service with "Secure SOAP" option.
2) I created a <u>Standalone Proxy</u>.
3) I created a Java Standalone client and tried to call the web service.
Here is the code :
     public static void main(String[] args) {
          try {
          Hello1WebServiceImpl service = new Hello1WebServiceImpl();
          Hello1WebServiceViDocument port = (Hello1WebServiceViDocument)service.getLogicalPort();
          System.out.println(port.sayHello1());
          } catch (Exception e) {
               e.printStackTrace();
Here is the exception :
java.rmi.RemoteException: Service call exception; nested exception is:
     java.net.ConnectException: Connection timed out: connect
     at com.proxy.Config1BindingStub.sayHello1(Config1BindingStub.java:80)
     at com.proxy.Config1BindingStub.sayHello1(Config1BindingStub.java:88)
     at SampleComponent.main(SampleComponent.java:23)
Caused by: java.net.ConnectException: Connection timed out: connect
     at java.net.PlainSocketImpl.socketConnect(Native Method)
     at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:305)
     at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:171)
     at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:158)
     at java.net.Socket.connect(Socket.java:452)
     at java.net.Socket.connect(Socket.java:402)
     at java.net.Socket.<init>(Socket.java:309)
     at java.net.Socket.<init>(Socket.java:124)
     at iaik.security.ssl.SSLSocket.<init>(Unknown Source)
     at com.sap.engine.services.webservices.jaxm.soap.SSLUtilImpl.createSSLSocket(SSLUtilImpl.java:43)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initStreamsFromSocket(HTTPSocket.java:500)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initializeStreams(HTTPSocket.java:422)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.getOutputStream(HTTPSocket.java:384)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.HTTPTransport.getRequestStream(HTTPTransport.java:337)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.outputMessage(MimeHttpBinding.java:433)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.call(MimeHttpBinding.java:1117)
     at com.proxy.Config1BindingStub.sayHello1(Config1BindingStub.java:73)
     ... 2 more
Can someone please tell me the steps I must follow ?
Thanks in advance.
Message was edited by: David Fryda

Ive ran into similar proples using normal ssl over http and the issues were with my environmet configuration ... yours may be with somthing totally different... but i fixed my probs by adding the folling code before creating the connection.
java.security.Provider provider[] =
java.security.Security.getProviders();
for (int i = 0; i < provider.length; i++) {
java.security.Security.removeProvider(
    provider<i>.getName());
java.security.Security.insertProviderAt(
new com.sun.net.ssl.internal.ssl.Provider(), 2);
java.security.Security.insertProviderAt(
new sun.security.provider.Sun(), 1);
System.setProperty(
"java.protocol.handler.pkgs",
"com.sun.net.ssl.internal.www.protocol");
you can also accomplish this by modifying the java.security file found in \jre\lib\security directory.
Also because this is a stand alone app be sure to have all the necessary jar files in you classpath ... you can accomplish this by using the -classpath option when calling your program or by moving the files into you \bin\lib\ext directory;

Authorization for generic object services - GOS - payroll data

Is there anyway to restrict what people see via GOS? I can't see any authorisations behind it except S_OC_ROLE. Seem users can view payroll details of a workflow agent in the workflow logs(view with technical details). Its a wild shot that an end user will find this information in the container tab but it look like a massive security flaw.
I will be interested to know if others have the same problem and how they resolved it.
Thanks

This issue relates to authorisations. Depending on infotypes available to the user, they will be able to view data relating to the info type.
I will now have to review all authorisations to ensure there is no unauthorised access.

GOS(Object Services) for ME31K and ME41

Hi,
Is it possible to have a General object services for the transactions ME31K and ME41.If yes,Can you please give me the procedure for the same.
Thanks

the notes for ME31K: start with [329437|https://websmp130.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=329437&nlang=EN&smpsrv=https%3a%2f%2fwebsmp110%2esap-ag%2ede] and work your way through the dependencies and follow-ups.
ME41: there's no way to know beforehand. either you can see it while you are using the transaction or you can't. if you can't you go searching service.sap.com ... at least that's how i do it ...

Attach PDF to PO object services list works for ME23N but not ME22N

Manualy attach a PDF file from users PC to a PO. The attachment works for ME23N as described in SAP documentation for creating an attachment to the object services attachments list.
When ME22N is used the "attachment created" message displays but exiting the PO and reenter ME22N and the attachment is not saved in the services attachment list.
Where is the configuration for this object service attachmentS?
What is needed for ME22N that is different than ME23N?

Hi,
I don't think any difference b/w these 2 Transaction related to attachment of document through Services for Object.
If you have the authorization for ME22N transaction definitely you can attachment any document both in ME22N & ME23N transaction throught this Services for Object.
Check once again.If still you face the problem discuss with your Basis Consultant
rgds
Chidanand

Authorization object for Object services

Hello together,
I want to know if there is an authorization object for Generic object services functionilty especially the WF options like WF overview, start WF, Archieve WF..............................
My understanding is any user who has access to a particular Business object, can user GOS to view WF stuff..................Is my understanding correct or should we have extra functions.....................
Regards

Check authorization objects S_OC_ROLE and, for recent releases, S_GOS_ATT.
Regards,
Raymond

Activating Object Services

Hi,
I am trying to activate General Object Services for viewing/creating attachments for FI Invoice ( FBV0 transaction ).
I tried assigning the following roles for the user:
SAP_BC_BMT_WFM_ADMIN
SAP_BC_SRV_ARL_ADMIN
SAP_BC_SRV_ARL_USER
SAP_BC_SRV_USER
Still the object services icon is not showing up in FBV0 transaction
Also for few of the users who initially had SAP_ALL role the object services appears even if we remove the role SAP_ALL
Any help on this issue would be appreciated
Regards
Bhooma

Hi Uwe,
The following conditions are found:
1. User with workflow administration (less than sap_all) authorizations has the Object Services available to the user in FBV0
2. User with SAP_ALL does not have Object Services available in FBV0
The users have been tested with several variations of authorizations on the user that has the Object Services and the user that does not, including granting SAP_ALL and the roles listed above. This does not appear to be an authorization error.
Is there some configuration or inherent controls within SAP that might control this?
Thanks & Regards
Bhooma

Object Services - Create Attachment ?????????

Hi Experts,
               I have some Quries regarding Object Services -
               1) I want to attach 1 file ( Excel or word) to the Maintenance Order when I create attachement through Object Service and attach a document to the Order will it attach the document (i.e. Stored on SAP Server) or only create a hyperlink of the Document attached.
               2) If it is creating only the link is there any other way to attach a PC file to Maintenance Order.
I hv not implemented DMS over here.
               3) Is there any customization required for the Object Services.
With best regards,
Narendra Dere

1 - its stored on the server, not as a hyperlink. For this reason you don't want to store immense amounts of data this way.
2 - DMS is the only other way I know of to attach documents. Many clients have set up a simple DMS config with PM being the only module using it.
3 - No config needed for object services.
see
http://help.sap.com/printdocu/core/Print46c/EN/data/pdf/BCSRVOBS/BCSRVOBS.pdf
Edited by: Arthur Balajthy on Dec 15, 2008 6:41 PM

Security for General Object Services

Similar Messages

Maybe you are looking for