Security: use of authorizations

We have several fields that we secure on and they are used in multiple cubes but the security is not checked in each cube. For example, company code is in HR cubes and financial cubes. The main HR security is on country grouping/personnel area and the financial cubes are secured by company code. The old solution allowed us to configure the system so the HR cubes are not secured by company code and the financial cubes are. How do we do that with the new solution?

hi Eric,
check if nw security guide doc helps, seems old authorization still can be used, recommend switch to new concept
http://help.sap.com/saphelp_nw04s/helpdata/en/41/845cdb9c548b419ee4e089841f1b6c/frameset.htm
new concept 'anaylis authorization'
http://help.sap.com/saphelp_nw04s/helpdata/en/66/019441b8972e7be10000000a1550b0/content.htm
If you have done an upgrade to SAP NetWeaver 2004s, you can decide whether you want to continue to use the current reporting authorization concept or switch to the new, more user-friendly concept for analysis authorizations.
SAP recommends that you switch to the new concept so that you can benefit from the new options and easier administration.
By default, the new concept is active and support will no longer be provided for the old concept.
Complete compatibility between the two concepts is not possible. For this reason, existing authorization concepts have to be converted. Migration has to be completed manually or using a tool. In any case, it requires manually reworking afterwards.
Prerequisites
You indicate characteristics that you wish to protect as authorization relevant in InfoObject maintenance.
In principle, all authorization-relevant characteristics are checked for existing authorizations when they occur in a query. For this reason, you should avoid designating too many characteristics as authorization relevant so that you can keep the administrative efforts to a minimum and keep performance good.
Features
Analysis authorizations are not based on authorization objects. Instead you create authorizations that include a group of characteristics. You restrict values for these characteristics.
The authorizations can include any authorization-relevant characteristics and treat single values, intervals and hierarchy authorizations the same. Navigation attributes as well can be indicated as authorization relevant in the attribute maintenance for characteristics and can be transferred into authorizations as characteristics.
You can then assign this authorization to one or more users.
All characteristics indicated as authorization relevant are checked when a query is executed:
A query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise you will receive an error message indicating that the authorization is not sufficient. In principle, the authorizations do not work as filters. Very restricted exceptions to this rule include hierarchies in the drilldown and variables that are filled by authorizations. Hierarchies are mostly restricted to the authorized nodes, and variables that are filled by authorizations act like filters for the authorized values for the affected characteristic.

Similar Messages

HT2204 I don't remember the answers to the security question to authorize my new laptop to use iTunes. How to sort this problem?

iTunes requires me to answer to a couple of security questions to authorize me to use it on my new mac book pro, but I don't rimember the answer to them. I can I sort out this problem?
Thank you for helping...
Danila63

 Account Security Team (AST) 
Check the AppleCare number for your country here:
http://support.apple.com/kb/HE57
Call them up, and let them know you would like to be transferred to the Account Security Team.

I got a new Kobe and i am unable to register it on Adobe, when I log in to my account I receive the following error message "you can only authorize this computer with an Adobe ID that hasn't been previously used to authorize any other computer or mobile d

I got a new Kobo and tried to register it so that I can download books from the public library. When I tried to register my device I received the following message " You can only authorize this computer with an Adobe ID that hasn't been previously used to authorize any other computer or mobile devices. Please try again.

Please refer to Can't authorize with a previously used Adobe ID

Implement row-level security using Oracleu2019s Virtual Private Databases (VPD)

Environment: Business Objects XI R2; Oracle 10g
Functional Requirement:
Implement row-level security using Oracleu2019s Virtual Private Databases (VPD) technology. The restriction is that the Business Objects Universe connection should use a generic/u201Capplicationu201D database user account. This will allow the organization to avoid the situation where the Business Objects password and the Oracle password need to be kept in synch.
What do we need from the Business Objects support team?
1.     Review the 2 attempted solutions that we have tried to implement
2.     Propose solutions/answers to open questions for each of the attempted solutions
3.     Propose any alternate solution that will help us implement the Function Requirement stated above
Attempted Solution 1: Connection String uses Oracle Proxy User
The connection string that is specified in the Universe is the following:
app_user[end_user]/app_user_pwdarrobaDatabase.WORLD
app_user = generic application user
end_user = the oracle account of the end user which is set using arrobaVariable('BOUSER') app_user_pwd = password of the generic application user
We have tried and implemented this in our test environment. However, we have some questions and concerns around how the connections are reused in a connection pool environment.
Open Question for Solution 1:
i. What happens when multiple proxy users try to connect on at the same time? Business Objects shares the generic app_user connect string. However, every user that logs on will have their own unique proxy user credentials. Will there be any contention involved? If so, what kind of errors can we expect?
ii. If a user logs on using his credentials (proxy user), and business objects opens up a connection to the database using that user's credentials (as the proxy user but logging in through the generic app user). Then the user exits out --> based on our test today, it seems like the database connection remains open. In that case, if another user logs on similarly with their credentials, will business objects simply assign the first users connection to that second user? If so, then our security will not work. Is there a way that Business Objects can somehow ensure that everytime we close a report, the connection is also terminated both at the BO and DB levels?
iii. Our 3rd question is general high level -> How connection pooling works in general and how it is implemented in BO, i.e. how are new connections assigned, how are they recycled, how are they closed, etc.
Attempted Solution 2: Using the ConnectInit parameter
Reading through a couple of the Business Objects documents, it states that u201CUsing the ConnectInit parameter it is possible to send commands to the database when opening the session which can be used to set database specific parameters used for optimization.u201D
Therefore, we tried to set the parameter in the Universe using several different options:
ConnectInit = BEGIN SYSTEM.prc_logon('arrobaVARIABLE('BOUSER')'); COMMIT; END; ConnectInit = BEGIN DBMS_SESSION.SET_IDENTIFIER('arrobaVariable('BOUSER')'); COMMIT; END;
Neither of the above iterations or any variation of that seemed to work. It seems that the variable is not being set or being u201Cexecutedu201D on the database.
One of the Business Objects documents had stated that Patch ID 38, 977, 350 must be installed in our BO environments. We have verified that this patch has been applied on our system.
Open Questions for Solution 2:
How do we get the parameter ConnectInit to work? i.e. what is the proper syntax to enter and what other things do we need to check to get this to work.
Note: Arroba word is being used instead of the symbol in order to avoid following error message:
We are sorry but your message can not be posted since you have included an email address. Please remove the email address and re-post.

the connectinit setting should look something like this:
declare a date; begin vpd_setup('@VARIABLE('BOUSER')'); Commit; end;
The vpd_setup procedure (in Oracle) should look like this:
CREATE OR REPLACE procedure vpd_setup (p_user varchar)IS
BEGIN
DBMS_SESSION.set_vpd( 'SESSION_VALUES', 'USERID', p_user );
END vpd_setup;
Then you can retrieve the value of the context variable in your vpd functions
and set the vpd.

How to implement row level security using external tables

Hi All Gurus/ Masters,
I want to implement row level security using external tables, as I'm not sure how to implement that. and I'm aware of using it by RPD level authentication.
I can use a filter condition in my user level so that he can access his data only.
But when i have 4 tables in external tables
users
groups
usergroups
webgrups
Then in which table I need to give the filter conditions..
Pl let me know this ...

You pull the Group into a repository variable using a session variable init block, then reference that variable in the data filters either in the LTS directly or in the security management as Filters. You reference it with the syntax VALUEOF("NQ_SESSION.Variable Name")
Hope this helps

USE Standard Authorization object in Z Program

Hi Experts,
I have already checked other threads regarding this but could not resolve my problem.
I have created a Z program to update Material Master. I need to use the Authorization object M_MATE_STA in my program for performing authorization check. Please help me how can I do that?
Thanks

hI,
   below is a similar code...
CONSTANTS: lc_authobj TYPE char15 VALUE 'F_BKPF_BUK',
AUTHORITY-CHECK OBJECT lc_authobj
           ID lc_id_bukrs FIELD v_bukrs
           ID lc_id_actvt FIELD lc_activity.
IF sy-subrc NE 0.
ENDIF.
Amol

How to crate new user in adf security using jspx page

how to crate new user in adf security using code in java file.plz help me this work will submited to day plz help me...

sigh
Search really would help and point you in the right direction. You'd find [url http://forums.oracle.com/forums/thread.jspa?messageID=4584464]this, for example.

Use of Authorizations Tab in User Account for Version 10

Whats the use of Authorizations Tab in User Account for Version 10. Please find the snapshot attached.

Hi Pawan,
SAP Sourcing 10 allow custom script and query-based web services which support OAuth authentication so
client consumer application will consume this web service and if the OAuth handshake is done successfully, then we can verify by going to the Authroizations tab of the User Account of the user that signed on to Sourcing/CLM and allowed the external program to access the particular webservice.
For more insights please refer the Web services cookbook of SAP Sourcing 10.
Hope it helps to some extent.
Best,
Kushagra A

HT1206 I buy apps in my iPhone using different Apple IDs. Which Apple ID should I use to authorize the computer when synchronizing iPhone with iTunes?

I buy apps in my iPhone using different Apple ID. Which Apple ID should I use to authorize the computer when sync iPhone with iTunes?

Hi again,
After a little further research, it appears that you would need to create separate iTunes libraries in order to be able to continue to purchase and download previously purchased items on the same computer, for two different Apple IDs. Sorry - but my husband and I have had the library we sync with authorized for so long, that we have not run into this issue, but it appears that you will get an warning when you try to authorize the second ID on the same computer, indicating that another ID is already associated with it.
So, you will probably have to set up separate iTunes libraries for each ID:
http://www.imore.com/how-use-multiple-apple-ids-one-computer-and-itunes
Sorry for any confusion - hope this helps!
Cheers,
GB

Safari Version 6.0.2 (7536.26.17) Yahoo security - Using Yahoo search engine: while logged into Yahoo my entire screen gets taken over by a full page popup add/i've cleared histories

Safari Version 6.0.2 (7536.26.17)
I believe my problems stem from the public side of Yahoo where I go to open my Yahoo Email account, and/or from the file I get in
email.
Yahoo security - Using Yahoo search engine: while logged into Yahoo my entire screen gets taken over by a full page popup add/i've cleared histories & cookies & flash cookies but the problem returns, sometimes right away, sometime on the next log on … what to do … . I’ve heard of this problem being called a form of ‘yahoo mail hijacking’.
Yahoo is better than Google right now. While using Google as a search engine and logged into Yahoo-mail the page elevator (up& down) bar actually freezes, a dead giveaway that something is up. So far nothing I do will stop the page elevator from freezing when I'm using the Google search engine. I either have to use the Yahoo or Bing search engines.
MacPro w/OS X ver 10.7.5 & Norton Internet Security 5 for Mac ver 12.4 (73) / I update Norton security at least 3-times a day. I thing I get the bug when I log onto my Yahoo Email and go through my emails. When problems get constant I Reset Safari then run flush to burn flash cookies. What else can I do?
Yahoo wanted $58-bucks for a consult, that’s ********. You would think Yahoo would want to be advised of ongoing Yahoo Searchengine / Yahoo Email problems, and want to help there users with ongoing problems. Sure they will help me with their problem for $58, and probably even suggest even less than what I am already doing on my own.

It's hard to tell from your description what is going on, but try this first.
Quit Safari. If it won't quit in the usual way, select
 ▹ Force Quit...
from the menu bar, then select Safari from the list and press return.
Relaunch Safari by holding down the shift key and clicking its icon in the Dock. That will stop the bad page from reloading automatically. From the menu bar, select
Safari ▹ Preferences... ▹ Privacy ▹ Remove all website data
to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.
Also get rid of the useless Norton crapware, after backing up all data.
Uninstalling your Norton product for Mac

Control Workflow Report output using Structural Authorization

Is it possible to control output of Workflow Reports using Structural Authorizatins. E.g. Workflow Admins having access to tcode SWi2_FREQ will be able to see project wide data, but i want to restrict the workflow admins at department level from seeing workflow data for other departments. is that possible using Structural authorizations or any other mechanism?
My understanding is that Structural authorizations pretty much control PA/PD, and not other modules. I did a quick test,
1) Created a org structure
2) Created employees, users, and set up structural authorizations
Now when users are granted authorization to PA20, they are restricted to what they should be seeing, but when they are granted authorization for workflow admin reports, structural authorization don't seem to work, they are able to see data for workflow triggered for other departments as well. Is that the standard behavior or i am missing something. I don't have enough experience with Structural auth.
I will appreciate any guidance on this matter.
Thanks,
Saurabh

Arghadip, please explain how this will prevent someone from Norway from looking at the workflow log of a workflow for an employee belonging to the Danish part of the organisation.
<i>Message was edited by Kjetil Kilhavn:</i>
To explain a bit more in detail: how does this prevent me (Norwegian) from going into SWI1, SWIA or any other transaction, and looking at data from other parts of the organisation. I don't think it will work.
I think the only way to achieve this is to either modify SAP's standard code and include some structural authorisation checks - or take the standard transactions out from every user role and create your own wrappers or program copies which basically does the same as the modification would have to do.

How can I change the email address used to authorize my computer?

I borrowed ebooks from a public library using a different email address which I should have used to authorized my computer hosting the adobe digital edition. Is there a way to modify the email address used to authorize my computer as I get an error message when I try to return the books. Thanks

This says it was assumed answered but where is the answer? I've gone thru the Help processes to do this but it doesn't change. The old address is still there. I have trouble returning books to the library and getting new books.

How to use additional authorization creator?

Hi All,
I want to know how I can use additional authorization creator to give or not giving authorization to user forms and reports to different user? the help doesn't explain much. the main confusion is what should be given as 'Authorization ID'. should it be the menu ID?
Thanks in advance for any help on this...
regards,
Binita

Additional Authorization Creator Window
Definition
Use this window to create and add a new permissions object for user-created forms.
Field
Description
Permission ID, Name
Enter the permission object ID and name.
Option
Sets permission options for the new object. Two options are available:
Full/Read/None
Full/None
Item
Defines the object as an item rather than a form.
Permissions set to form apply to all its subordinates. Permissions set to an item do not apply to the parent form.
Level
Sets hierarchy level for the object.
Authorization Location
Parent ID
Selects a parent item when you add a subordinate object.
Display Order
Selects the location of a subordinate or sibling object within the permission hierarchy.
Forms ID/Edit
Opens the User Authorizations – Forms ID window.
Assigns the permissions object to a user-form of your choice by entering the form ID.
Add Sibling
Adds a new sibling to the object.
Add Subordinate
Adds a new subordinate to the object.

PD Profile for ESS when using contextual authorizations

Hi all,
We are using contextual authorizations, we have MSS working nicely, and now we are implementing ESS. Does anyone know what the PD profile would look like for the basic generic ESS implementation? The pre-delivered roles have P_ORGIN objects (disabled) so if we change to P_ORGINCON we need a PD profile to populate all the fields. There does not seem to be any pre-delivered PD profile.
Thanks

Hi Teresa,
You are either using structural authorizations or not.
Depending on this decision you have to activate parameters in table T77S0.
When Yes
AUTSW     DFCON     0     HR: Default Position (Context)
AUTSW     INCON     1     HR: Master Data (Context)
AUTSW     NNCON     0     HR:Customer-Specific Authorization Check (Context)
AUTSW     NNNNN     0     HR: Customer-Specific Authorization Check
AUTSW     ORGIN     0     HR: Master Data
AUTSW     ORGPD     1     HR: Structural Authorization Check
AUTSW     ORGXX     0     HR: Master Data - Extended Check
AUTSW     PERNR     1     HR: Master Data - Personnel Number Check
When No
AUTSW     DFCON     0     HR: Default Position (Context)
AUTSW     INCON     0     HR: Master Data (Context)
AUTSW     NNCON     0     HR:Customer-Specific Authorization Check (Context)
AUTSW     NNNNN     0     HR: Customer-Specific Authorization Check
AUTSW     ORGIN     1     HR: Master Data
AUTSW     ORGPD     0     HR: Structural Authorization Check
AUTSW     ORGXX     0     HR: Master Data - Extended Check
AUTSW     PERNR     1     HR: Master Data - Personnel Number Check
If you want to use extended check (check against PA administrator, Time administrator) then you have to mark
AUTSW     ORGXX     1     HR: Master Data - Extended Check
Cheers

Single PC using Multiple Authorizations

Why can a single computer use multiple authorizations for the Apple ID if I forget to deauthorize iTunes before reinstalling Windows? Does the Windows version use the MAC address of the motherboard or a combination of the hard drive volume GUID, registry, and other hardware components?

deauthorize all earlier last year
Note: You may only use this feature once per year. The Deauthorize All button will not appear if you have fewer than two authorized computers. If you need assistance on using this feature, please contact iTunes Store support via email (http://www.apple.com/support/itunes/store/).
About iTunes Store authorization and deauthorization

Security: use of authorizations

Similar Messages

Maybe you are looking for