Security in SPRO

hi friends,
i create one role and assign to one user for the Authorization tcode only one SPRO only,
if i give this one tcode that user can have all types of actions in that SPRO tell me clearly.

Hi lokesh,
If you are giving only SPRO transaction to user he is not able to use all types of actions.
You will get only Reference IMG list but you are not able to hit that sub lists.
Regards
sushma

Similar Messages

Security - SM30 required for visualizing IMG TABLE / SPRO

Hi!
Is there a possibility to visualize IMG tables (for example T16FS), through SPRO without having SM30 transaction?
It's a security policy where I work that most of the users can't have assigned SM30, but this interferes with visualizing of tables in SPRO.
Would you help me, please?
Thanks a lot!

Julieta,
I think if you know the table name , you can find the table entries through SE16 also. SM30 is not always needed. SM30 is needed only if you want to make some entry in sometables and for SPRO tables entry through SM30 is not possible.
I could see the entries of T16FS through SE16
If you want to see IMG tables through SPRO, you shoudl really knwo the SPRO path.If you ask any consultant belonging to that module, he should be able to guide you very well.
Hope thsi helps you

Calculate interest on Security Deposit at the time of invoice?

Dear All,
I have a requirement of calculating interest at the time of invoicing.
I did the following configuration in spro:
SAP Utilities ->Invoicing->Invoice Processing->Define Control for additional invoicing functions
I clicked at the Int:Cash Security Deposit button.
But when I execute transaction EA10 (Creating invoice) , interest is not calculated on the security deposit.
All the configuration w.r.t interest calculation is correct.
Please let me know if anybody has any solution to this.
Warm regards,
Rahul

Hi Rahul,
To calculate interest on any line item, we have to assign a interest key to it.
Take the FICA document created for Security Deposit and open it into FPE2 and goto change document:Item and then click on Tab Dunn. Data. Provide the interest key over here and then RUN your invoicing.
Regards,
Gaurav.

How To stop the Security Deposited Calculation at the time of move out.

Hi Guys,
I am working on this issue from last week still unable to stop the calculation of SD in Final bill at the time of Move out, i have blocked the main and sub transaction, any help will be appreciated as early as possible, this issue has to be solved on weekend.
Regards
K. Shilpa

Hi Shilpa,
First thing I will say that if you reverse an actual payment from customer's account, there are many impacts on the customer side and on SAP side. I think you have already taken care all these things.
Now for the first point if you want the open SD will not appear in the print document, you can do it by reversing the security deposit or by invoicing printing configuration. For the first option you can go to change security deposit (FPSEC2) and reverse it. To do this all the SD documents should be in open status.
For the second option you can go to the following menu path:
SPRO-SAP Utilities-Invoicing-Invoice Processing-Item Selection in Invoicing-Item Selection in Account Maintenance/ Define Sub-Items
In the above menu path for clearing type R4 (Invoicing) and periodic billing (R41), you can control the items which will be printed in the invoice. Select the clearing type and click on the 'Item selection on bill print out' on the left hand side. For the clearing category (maintained at contract account level) you can maintain the main and sub transaction of security deposit (might be 0020 / 0020) and you can see a field 'IP' (Item Will Be Printed on the Bill) where you should maintain it blank. If you do that, security deposit will not be picked up in the invoice document. However it will remain open in the account if you just stop the printing of SD and keep it in the account.
However it totally depnds on the business requirement and related implications whether you want to reverse the SD or you want to keep this in account and do not want to show them on the bill.
Now for the second point you have mentioned, you need to first decide what you will do with the SD payments made by customer.
Either you can release the SD amount and refund it to customer or the amount can be adjusted with the next invoice. Again it depends on business requirement whether you will refund any payment made against SD or you will simply reverse all open security deposits.
Also if you want to stop the SD creation process now onwards, you need to revert all SD configuration like main / sub transaction configuration for SD, default SD releted settings etc. There is no standard process for it. If you want to reverse the SD, you can write a custom program. The configuration related things need to be done manually.
Since all the things will impact the business process or customer, I hope you will take care those things before coming to a conclusion.
Thanks.
Nirmalya

How to download and upload SPRO configuration to and from local disk?

Hello,
I'm very new to SAP. Recently we had a problem while refreshing our QNA system from PRD. I knew there are some configurations, which do not have a transport and thus configured directly in QNA. These changes were not noted by mistake and after the refresh from PRD, we have lost these configurations.
Is there any way we can save the SPRO configurations to local disk and upload them again? Are there any custom programs available? Please advice?
Regards,
Nathani

The trouble with these kind of situations is that an applet runs on the client. If you want an applet to connect to a specific server (which means the client makes a connection to that server), you basically have to give the entire world access rights to that server. I don't think your friendly local administrator will be too happy with such a prospect.
What you could do is put a man in the middle. Don't upload to the file server directly, but to for example the web server where the applet was downloaded from, for example by making a servlet available that takes a HTTP file upload. When that upload is complete, send the file from your man in the middle server to the file server using whatever method you like/have available/know how to code. In this situation only your web server needs access to the file server, which is far easier to secure.

Restrict security deposit release during final bill

Hello,
As per our business requirement security deposit need not to be adjusted
with final bill. We have done the configuration as per following
screen shot.But security deposit still get adjusted during final bill
generation , please specify this configuration is correct or any
other configuration is required to achieve this requirement.
Configuration path:
SPRO->SAP utilities->Invoicing->Invoice Processing->Item selection in account maintenance/Define sub-item
And done the changes in both clearing type R42 & R43 as per below image

Hi,
You should check the configuration in Open Item Management for "Specifications for Invoicing".
Make sure the Clearing Variant that is used doesn't have any explicit Clearing sequence for Main/Sub 0020/0010.
If theres no such explicit configuration, make an ABAP change in the FI-CA Event ISU_EVENT_R401 to explicitly exclude the held Security Deposit . Heres the documentation for this event:
ISU_EVENT_R401
Short Text
Event R401:Select CA Items for Account Maintenance/Credit Transfer Posting
Functionality
Event R401 in IS-U invoicing selects the open items for account maintenance and transfer posting of credit. It is started in invoicing before the account maintenance modules are called.
Tasks
1. Selection (or preselection) of open items for account maintenance.
The open items made available in this function module are already made available in field XAKTP_401 (table TY_R401_FKKCL) with a propsal in accordance with the entries in table TE514 table TY_R401_FKKCL. You can overwrite this proposal.
2. Activation of open items for transfer posting in credit/receivable consumption billing.
This enables, for example, items with a clearing restriction in invoicing to be repaid. The items made available in this function module already have a proposal in field XGUMB_401. This proposal is based on the specifications in table TE529 and can be overwritten.
3. Deactivation of a statistical receivable without subsequent posting.
If you set the indicator XCLON_401, a statistical receivable can be cleared without subsequent posting, so that it is not longer requested. The items made available in this function module already have a proposal in the field XCLON_401 based on the specifications in table TE529. You can overwrite this proposal.
Example
1. In periodic invoicing the cash security deposit payments are to be released for settlement after a given period. If this period has not expired, you must set the indicator XAKTP_401 = ' ' in the relevant item.
2. In periodic invoicing the cash security deposit payments are to be repaid after a given period (if applicable, the credit remaining after settlement). In this case you must set the indicator XGUMB_401 = 'X' in the relevant item. If the credit is not to be reposted, you leave this indicator blank.
3. In final invoicing the open request for a cash security deposit is to be deactivated (cleared without subsequent posting). In this case you must set the indicator XCLON_401 = 'X' in the relevant item.
Further information
Programming Restrictions
To avoid jeopardizing the consistency of the system, note that you may not use the following language elements in events:
COMMIT WORK
ROLLBACK WORK
CALL FUNCTION 'DEQUEUE ALL'
Delete all locks that you have not set yourself.
Parameters
X_VERART
X_BLDAT
X_BUDAT
X_BUPA
X_FKKVKP
X_SIMU
X_INVOICE_UNIT
YWA_CHG_SERVICE_OBJ
TY_R401_FKKCL
T_CONTRCL

Security deposit payment

Hi,
My requirement is to account the payments to a security deposit separately till the time it is not released.
Details as below.
1. When the security deposit is cleared by a payment, the payment item should reflect in G/L account X001.
2. When the security deposit is released, the payment amount should go to G/L X002 debitting the account X001 by the equivalent amount.
Step 1 can be achieved through the config of EK01, however can anyone please suggest if there is something which helps to achieve step 2? That means when a security deposit is released it should be transferred to another G/L account?
Thanks a lot in advance.

Hi Dhiraj,
Going through your Step2, it seems that you are looking for a journal entry to be done, once the SD payment is released so that the initial GL A/c, (say X001) is settled and the balance is transferred to a new GL A/c (Say X002).
I guess you are performing the SD release only at the time of Final Invoicing and not on an ad-hoc basis through FPSEC2.
If so, then you can go to the following SPRO config-
IMG--->SAP Utilities--->Invoicing--->Invoice Processing-->Item Selection in Invoicing--->Item selection in Account maintenance/Define Sub Items
Select the Clearing type, either R42/R43 (depending on your Business Process) and click on "Item Selection for Bill Printout (Sub Items)".
Select the SD payment main\sub combination (as per standard SAP-0020/0010) and check the box "Transfer to Credit memo/Receivable for Consumption Billing"
This checkbox controls whether a document which has already been posted should be transferred to a consumption billing credit memo/receivable in invoicing.
The newly generated document inherits the due date of the invoicing document.
Hope it helps..
Thanks,
Amlan

Open a Lotus Notes Document as a SPRO HomePage URL resource in Portal

Hello,
I have specified the link to a Lotus Notes document as a URL to Resource while defining a Service in the SPRO HomePage Framework. This service is called when the corresponding link is clicked from the area group page for ESS.
When I click on the corresponding link in the Area Page, the link is unable to open the certain content due to a security error being thrown. However, the left navigatiopn opens and when we click on the relevant link from the left navigation, the corresponding content is opened as required.
Is there any configuration which needs to be taken care of, to bypass the initial security error? I would really appreciate any available pointer on this scenario.
Cheers!

After more testing and some pointers from Brian Hayes, I have it working. If the Tidal client is running via Citrix it won't work. The Tidal client has to be installed locally on the same machine as Lotus Notes because the document will open in Lotus Notes, not as a web page.
Michelle

Security Deposit Migration

I am getting following error when migrating Security Deposit.
Document line item without main or sub-transaction transferred
Its workign through FPSEC1.
Please help.
Regards,

Hi,
I assume that the main\sub used for migrating the Security deposit is different from that of the main\sub for creating the security deposits in SAP via FPSEC1.
In this scenario, you need to change the allocation of internal main\sub transaction from the normal main\sub to the main\sub combination used for migration.This is a pre-migration activity.
Go to the following path in SPRO-
Financial Accounting(New)>Contract Account Receivable & Payable>basic functons-->Positng & Documents->Document->maintain Account assignments->maintain tranasction for ISU->maintain transaction for Cash Security Deposit \interest.
Click on "Allocate transactions to internal transactions".
Look for the combination of
IMTR    ISTR
0020    0010
0020    0020
There will be a main\sub assigned to it. Change that combination to that you are using in conversion.Save it and then try to migrate it once.
Hope you will not get the error again........
Thanks,
Amlan

Create Display Authorization Profile for SAP Transaction SPRO (IMG).

Dear All,
In my current implementation project there is an requirement to create display authorization profile for SPRO. I have tried a lot but was not able to do so.
Any one is having an experience in creating display profile for SPRO (IMG) ? If any one has worked on this issue then please guide me.
Thanks,
Avinash

Hi
This is security related question. I am not security expert.
But you can check this, Include the following authorization objects in the profile and assign this profile to the target user.
S_IMG_ACTV
S_PROJECT
S_PROJ_AUT
S_PRO_AUTH
and assign activity = 03 (Display).
Hoipe it helps.
regards
Srinivas

FICO and SPRO access in development system

hi security admins,
i am a security consultant. now i am in development system. i want to give FICO access and SPRO access( only fico nodes should be authorised to access, others nodes should not authorised ) in development system. please suggest and tell me the procedure for restricting specific access.
regards
ramesh

>
Dimitri van Heumen wrote:
> using search will give you useful topics such as [this one|Trace File|UTFS]
Dimitri,
That one links me to a thread about trace files..... or am I missing something here?

SPRO settings in production?

Hi,
May i know whether we can do SPRO settings in Production system???
I had done some setting in Dev system and transported those objects to production!!!
But still some functionalities are missing for those objects!
has anyone done SPRO settings in production???
Raj

Hello Raj,
As you are saying that some of the functionality are missing in SPRO in production client, the reason behind this is:
The settings in production system are different then in dev/quality/test.
There is a concept of enhancment IDs and Switches/BC-set in IMG structure( hope you are aware of that), now based on the status of enhancment IDs or switches the node is displayed or hidden, the enhancment IDs or Switches might be active in dev/quality/test system but there are posibility that the same is not active in production system.
The steps to activate a switch in production system is entirely different then in dev/quality/test system
Some background information concerning BC Sets. They are
basically containers for customizing data - table entries. When a BC
Set is activated in a particular client/system, the table contents are
written into the Database (created for first time, or overwrites the
existing data). For this activation - the SCPR20PR logs give you the
status.
When it comes to a Productive client, BC Sets cannot be activated - for
security reasons. Hence, if we need customizing data from a BC Set into
a Productive client, it is always transported from a Dev or Quality
system. But, the Activation logs (SCPR20PR) in the Productive client
does not recognize any Transports. So, the logs continue to show only
the information which is particular to the Productive local client -
1) No logs if BC Set was never activated (or)
2) Error message if the client role was Productive.
This will continue to be the case, even if the BC Sets were activated
successfully in the DEV system, and transported to the Productive
client. Why ? The reason is that the transport request simply contains
Table entries.
It does not contain any Log information that can be updated into the
Productive Client.
So in future, where ever a BC Set has to be activated in the Productive
client, one must activate them in DEV/TEST system and transport them.
The logs in the productive client will continue to be unchanged even
after this transport is imported. But the required Data will be
successfully present on the Productive client already.
As mentioned remember that activation of BC Set cannot be
done in prodcution system directly. The process to follow in order to
activate a BC set in production system is to transport the activation
data from the DEV or QA system.
Follow these steps:
1. Log on to your DEV system.
2. Set the client settings to Automatic Recording of changes (in SCC4
transaction).
3. Goto transaction SCPR20 - - BC Set activation.
4. Activate the BC Set.
A pop up to enter the request number will be displayed.
5. Record the activation data in the request.
6. Release this request and import this request into the production
system.
Now the activation data will be updated in the production system.
The IMG nodes, menu nodes will be visible in the system.
Hope the information is usefull.
please reward points.
Regards
Mayank

Security and roles while upgrading to bi7

hi
Guys i ha ve question about upgrade
what will happens to security and roles while upgrading from bi3.5 to 7 ?
is this can be migrated into bi7 from bw 3,5 , if so how ?
or do we need to create separate again in Bi7 ?
u r answer will be much apreaciated

Hi,
this can be upgraded but it is not a must. SAP recomend to use the new concept provided by NW 7.0...
You can switch on/off obsolete Authorization concept with RSCUSTV23. For security and clarity reasons make a u201Ecleanu201C new setup u201Efrom the scratchu201C (much easier, less complex than in 3.x)...
Check this upgrade guide it will give you all informations:
[SAP NetWeaver 7.0 BI Upgrade Specifics|https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/10564d5c-cf00-2a10-7b87-c94e38267742]
New BI Authorizations set in SPRO (maintenance in RSECADMIN)
- During technical upgrade, and if you used an authorization concept in BW3.x
switch back to u201Cobsolete Concept with RSR Authorization Objects)u201D
- Important: After technical upgrade switch back to the new Concept and see
note 820183 and 923176 New BI Authorizations set in SPRO (maintenance in RSECADMIN)
- During technical upgrade, and if you used an authorization concept in BW3.x
switch back to u201Cobsolete Concept with RSR Authorization Objects)u201D
- Important: After technical upgrade switch back to the new Concept and see
note 820183 and 923176
Other links/notes which could be helpful:
Note 923176 - Support situation authorization management BI70/NW7.0
New Analysis Authorizations for BI Reporting:
http://help.sap.com/saphelp_nw04s/helpdata/en/80/d71042f664e22ce10000000a1550b0/
content.htm
Regards
Andreas

HR customizing T-codes in SPRO

Dear all,
request you to help me in creating a ROLE for Functional consultants with an
access to SPRO of HR (Human resourse related Area) ONLY.
he should not be allowed to make changes to cross client objects.
he should be restricted to HR customization only.
thanking you in all
by
raghav

after go-live, some modifications has to be made in customizing level. okay ...
Management provided approval to KEY-Users to change in Development server, taking security in consideration... i want to restrict their activity in SPRO (in development server)
how to create an ROLE with SPRO display access, and they should be able to change/access one specific module and CROSS client modification should not be allowed.

User signature with security product configuration - Reg.

Dear Experts,
We got a requirement in Digital signature. Requirement is whenever result recording, UD for inspection lot, system should access external security product for user signature.
I would like to know the configurations steps required for the above said from QM point of view.
Expecting your valuable reply. Thanks in advance.
Regards,
Kumar

You should read the configuration notes in SPRO. It explains a lot about setting this up.
In SPRO:
Cross-Application Components>General Application Functions>Digital Signatures
      Define Basis Settings
      Specify Signature Method for Approval Using Simple Signature
      Signature Strategy
        Define Authorization Groups
        Define Individual Signatures
        Define Signature Strategies
Read the notes on each item. Setting up an exteranl verification system is talk about in the section "Specify Signature Method for Approval Using Simple Signature".
Good luck!
FF

Security in SPRO

Similar Messages

Maybe you are looking for