Side - effect of new org level

Hi,
we have parent - derived role concept.
few roles were added to the system ( 4.6 - > 700) "upload"
now in 4.6 system one field was maintained as 'org level', which is not in our system (WAS 700)
uploaded have value $FIELD , however this field is maintained in our system as FIELD with value *
now if i create FIELD as org level in my system, what are the side effects...
please advice.
regards,
Surpreet

Martin,
thanks.
please advice what is purpose of checkbox 'Test Mode'..
regards,
Surpreet
Going through SAP note 323817 & 754836........... also
Edited by: Surpreet Singh Bal on Oct 28, 2010 12:00 PM

Similar Messages

How to create new org.level and further actions?

Hi experts!
I need help on the follwing situation.
For better separation of industries for the marketing staff we do use the branch (e.g. food, energy, ...).
For that we want to adjust the authorizations to branch specific.
The questions are:
1) Is it possible to create a new organisational level "branch"?
2) If I have a new org.level I think I have to adjust existing authorization objects. Do I only have to extend the belonging auth.objects with the new org.level?
3) What else do I have to do if a new org.level branch is created to check authorizations on that?
Thanks for your help in advance.
Regards,
Alex

If I read your question correctly I think you want to create a new authorization field. To get that to work you'd need to adapt a lot of software. Definately not a path to follow.
All authorization cheecks need to hard-coded into the software. Changing SAP standard software is something one wants to stay away from as long as possible. It'll keep haunting you when patching, upgrading etcetera.
If you want to 'upgrade' an existing field to become organizational a forum serach on PFCG_ORGFIELD_CREATE should give you pointers.

New Org Level impact in existing roles

Hi,
I would like to set/create 2 fields as organizational levels. For example KLART and DOKAR. Checking these I realized there is a big amount of roles "affected" by this change.
Because I plan to use the organizational level only for new roles , I would like to know which impact could have this change for existing roles, should one modify the existing roles after creating the Org Levels ? or in contrast they still work as always an no changes / adjustments is needed?
Thanks and regards
FedeX

Thanks Bernhard,
I have a question
As I mentioned before my goal is that the existing roles keep working after running that program... and do not want to perform any adaptation....only if there is a real error that avoid work correctly.
In these 2 cases the role will keep working properly ( I mean restricting in the way that it uses to do).
1) In case field is copied to the Orglevel area after running the program and the value(s) will stay in both places (OrgLevel and Original place)
2) In case field is NOT copied to the Orglevel area after running the program but the value still in the original place .
right?
Thanks
FedeX

GRC BRM: Update Org Levels of derived roles

Dear GRC experts,
we are using the GRC BRM Master Derived concept and have around 100 Master roles in place.
I understand that the Org Levels of derived roles are only once set per Org Value Map during the initial (Mass) Derivation.
If we add a transation like VA01 to a Master role this also adds some new Org Levels to the Master role. Via "Propagate to Derived roles" the new transaction and object values are added into the Derived roles.
For the new Org Levels these are added also but the values are not the one from the Org Value Map of the Derived role but exactly the same values of the Master Role.
Using "Derived Role Org. values Update" does not help us here to update the corresponding Derived roles as no change to the Org Value Map has been done.
In case a Master role has 40 different Derived roles associated this would require to update manually any of the Derived roles for adjusting the new Org Levels.
Does anybody know how to automate this task?
Many thanks for your help!
Regards,
Markus

Hi Markus Richter
Once you maintain the imparting role and propagate to the derived role, the derived roles will inherit the new org values from the imparting. So that at least has the org values in the derived roles but not the correct values
Next up is to try to use the Mass Maintain Roles to update the derived roles with correct values from the org map (ensure org maps were updated first) mentioned in post
Mass Child role Org value update in GRC 10
Does this work for you as an approach?
Regards
Colleen

How to distribute new object from org level

Hi Expert,
I'm trying to create a new object: MATKL to org level through program: PFCG_ORGFIELD_CREATE. But I find there are only distribute to all roles. Could you advice if it can be distribute by selected role instead of all roles? Any advice on hierarchy problem?
Rdgs,
Emily

Hi Colleen,
Actually I want to grant authorization on MM section by separate material group. It's to fulfil some special users are able to access particular material group. So I'm thinking to create new material group org value and distribute from the top level (org level). Could you advice if there is any method can achieve my purpose more safety or easily?
If I want to control some users access some particular material number which limited by control different material group. Can I just assign object: M_MATE_WGR and control the value for access? If yes, where to assign?
Rdgs,
Emily

Affect of new Org responsibilities to personalizations of standard OAF Page

Hi,
Let say personalizations are done to Standard OA Pages at the levels (Function, User, Responsibility, Org etc) using a responsibility of the Old GL Setup ( Old Orgs). Now if the New GL setup is added to the system, that is new orgs are added and new responsibilities are added. And let say, the new responsibilities are using the same Standard OA pages that were personalized from old responsibilities.
Will all same set of personalizations of these standard OA Pages will be seen from the new responsibilites by default or do we need to take any extra step to make those personalizations affect take place in New responsibilities too?
Please assist as to what it takes from both the Technical and Administration side?
Thanks,

Hi Bharat,
My requirement is like, there is a source LOV on one of the iProcurment page. And customer wants to populates value say 'Source A' for a random group of persons. Hope you understand my requirement.
Thanks
Akanksha
Edited by: 903162 on Dec 20, 2011 2:13 AM

MOPZ-generated SIDE EFFECT report never shows up in SOLMAN

HI - we are using SOLMAN ST 400, SPS#24
I am doing a MOPZ transaction for an ERP604/NW701 system landscape - specifically for updating from a lower SPS level to a more recent one...
In MOPZ....i requested the SIDE EFFECT report.....at that time got to a screen where it displayed the following message "Your request has not yet been processed. Please check back again in a few hours. "
I've waited more than 3 days - and still - when I go back into SOLMAN....into this same MOPZ transaction#....to look for the SIDE EFFECT report......it doesn't show up anywhere - instead....i just continue to see the same message (Your request has not yet been processed. Please check back again in a few hours. )
Please advise
(it seems that the process for MOPZ-generated side effect reports is not as "user friendly" as the "old" way - outside SOLMAN/MOPZ - of doing this - in the "old" way, using SMP....you always got a request id#....and you always got an EMAIL in a few hrs ....that you clicked on to get the report.....i see neither of these when using MOPZ)

Hi there,
sometimes the side-effect report may take longer to arrive due to a long processing time for the request. This may happen due to many concurrent requests at the same time, or because there are technical issues in the service backend systems here at SAP.
I hear that you already got the side-effect reports after a delay, so I guess that your request was finally processed.
Best regards,
Miguel Ariñ

What exactly are side-effects in #pragma no_side_effect?

Which of the following qualify as side-effects for the purposes of #pragma [no_side_effect|http://docs.sun.com/app/docs/doc/819-5265/bjaby?a=view#bjacp]:
1. dynamically allocating/deallocating memory using malloc/free or operator new/delete
2. exiting the function by throwing a C++ exception
3. temporarily changing the disposition for a signal (e.g., ignoring or suspending a signal)
4. creating a thread and joining with it

Thanks for your answers! Just to make sure I understand correctly: accessing the local state of the caller through a parameter is not a side-effect. I.e., in the following snippet the function has_no_side_effects() has no side-effects:
int get (int *p) { return *p; }
void set (int *p, int x) { *p = x; }
void has_no_side_effects () {
    int x;
    int y;
    set (&x, 0);    // not a side-effect (x is local)
    y = get (&x);   // same
}But in the following, has_side_effects() does:
void has_side_effects () {
    static int x;
    static int y;
    set (&x, 0);    // side-effect: writing a "global"
    y = get (&x);   // side-effect: reading a "global"
}Also, reading global const data (i.e., what might be in ROM) is not a side-effect. Correct? E.g.,
static const int global[] = { 1, 2 };
void has_no_side_effects () {
    int x;
    int y;
    x = global [0];   // not a side-effect, global is in ROM
    y = global [1];   // same
}

Cursor_sharing Side-effects

I have a situation where several off-the-shelf applications (same vendor) are running on the same instance. One of the is performing poorly and I was able to get a good performance boost with cursor_sharing=force. After much testing in QA, we are ready to move it to production.
Now two of the other applications are having trouble. Apparently, the applications do some very basic selects from sqlplus and then parse the results. Setting cursor_sharing to force has had a side-effect (bug) that changes the column widths of these selects. The end result is that the other application fails because it can't parse it correctly.
This is a documented problem and Oracle recommends to always explicitly set your column widths in sqlplus. This is what we want to do, but the effort is not small.
A kludge work-around is to alter cursor_sharing before and after the batch processes. This can be done at either the system or session level.
My question is this: Is there a simple way to set it up so an that when this black-box application create a session, it will set the cursor_sharing to force?
Thanks,
Scott
http://www.erpfuture.com

I have a situation where several off-the-shelf
applications (same vendor) are running on the same
instance. One of the is performing poorly and I was
able to get a good performance boost with
cursor_sharing=force. After much testing in QA, we
are ready to move it to production.
Now two of the other applications are having trouble.
Apparently, the applications do some very basic
c selects from sqlplus and then parse the results.
Setting cursor_sharing to force has had a
a side-effect (bug) that changes the column widths of
these selects. Actually it is the off the shelf applications that have the bug, they are not using bind variables which means you are overparsing and fragmenting your shared pool. Poor performance is about the best you will get from such applications. You are also likely open to security issues that arise from [url=http://www.google.com/search?q=sql+injection
]sql injection.
Cursor sharing force is a workaround for a badly written application. It auto binds all literals. This means plans will change and all literal values are variables which could contain anything which leads to the problem you describe.
select 'test' from dual;becomes
select :b_sys_0 from dual;where :b_sys_0 could be 4000 characters long.
I would second kamathg's advice that if you need to use the cursor sharing workaround to only set it at the session level for the application that needs it using the logon trigger.
You should do this as an interim measure while you file a bug report with the software vendor to have them fix their application.
The security issues do not go away.

Using Field Blend plug-in, any side effects?

Cutting an HDV show with lots of action. Camera may have had 'sharpen' mode set too high, but end result is that the action scenes show way too much of the 'interlace lines' in playback on an LCD screen. Distractingly so.
I used the Field Blend plug-in from Joe's Filters on the whole show, and get a very smooth looking clean result. No interlace lines on LCD screen.
But! What I'm wondering is: will this have a negative effect when I output the HDV Quicktime master to MPEG2 and DVD?
Is there some side-effect one has to deal with when using the Field Blend plug-in?
All ears, thank you,
Ben

Are there any side effects of munging two fields
together? Yes. You are about halving your resolution.
The show works fine on an NTSC monitor. But the client will be showing it on a lovely new laptop, and also projecting it in a large cinema theatre.
The thing that puzzles me Patrick, is that I play both versions on a 23 inch Apple HD Cinema monitor and I cannot for the life of me see any difference, other than the 'blended' version is not full of interlace artefacting. I KNOW it's SUPPOSED to be less resolution. But I can't SEE any difference. Maybe on a 35 foot theatre screen?
Maybe Joe is doing something special with his plug-in?
B.

Side effects disabling rsh (SUN OS)

Hello.
For security reason OS administrators want to disable the rsh on all servers.
Can anyone list what are the side effects in SAP systems (tools or transactions which would not work anymore) and which could be a workaround?
Thanks a lot, kind regards,
Dino

AFAIK with newer Solaris 10 installations all remote services are disabled by default and the system works. For a single instance rsh is not needed.
If you configured other rem* commands in SM49 you may need to replace them to use ssh instead.
Markus

How to know side effects of implementing an SAP Note

Hi All,
Im new in implementing SAP Note.
Kindly suggest how to analyize whether implementing an SAP Note will cause some side effect.
How to do that ,I think just by looking at code can we assure that there will be no side effects.
Kindly suggest.

hello,
the easiest way is to implement note and check the functionality manually for example execute transaction and post document or you could open the correction object (ABAP code) and analyse the correction which ll be imported and how those changes will effect your systems work. if you implemented the note and you noticed that corrections destroyed your previous functionality then you could rollback the note in your development system.
best regards
dez_

Mass role Import in ERM "unable to determine matching org. level" Error

I am trying to upload the Derived Roles into the ERM. I have already uploaded all the Parents Roles. The volumes of the Derived Roles is huge in my SAP Backend system.
I am not able to understand what should be the content of Org File which we upload. Please correct if I am wrong
1>Example a role Z_TEST_D is derived from Z_TEST on the org levels EKGRP,KOART,GSBER,WERKS.
2>I have run Org Synchronization Job in the ERM
3>Downloaded Z_TEST (Parent Role) and uploaded it into ERM(It was easy because there was no org file)
4> Downloaded Z_TEST_D(Derived Role) through /VIRSA/RE_DNLDROLES Tcode in backend.
5>Downloaded the AGR_1252 information for this role which contained the Org levels and values
6>I put all those information into the Org File and then tried to upload it throws me the error Role Z_TEST_D : not imported; unable to determine matching org. level for WERKSin the system
So I again tried with the another method by changing the input sheet for the Org File
Z_TEST_D BUKRS 0* 9*
Z_TEST_D EKGRP *
Z_TEST_D KOART *
Z_TEST_D GSBER *
Z_TEST_D WERKS *
and tried to upload it again gave me the same error. I have checked the ERM all these Org Levels are fetched into the ERM. I am not sure if I am missing any basic things.
Current Support pack: SP10 Hot Fix 2.
Please share your experience and best practice to upload the roles,

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

Basic Information about Organizational Level & Org. level value.

Hello Experts,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
2. What is a derived role and what is its usage?
I appreciate your help regarding this. If you could point me to some documentation regarding this that will be very helpful.
Regards, Ben

Ben,
I am new to the field of SAP and security. I have the following questions:
1. What is an organizational level & org. level value? What do they represent? How do they matter in PFCG?
if you want to restrict on region vice (best use org level & values (plant,company code, sales org)
In role u will notice them in red color
2. What is a derived role and what is its usage?
Derived role inherits menu struture and the function from the parent role. Derived role do not differ in their functionalities(identical menu & trans) but have different characterticts with regard to Org levels.
Eg1; Master role
PFCG -> role name -> create->menu->enter tcodes-.Auth tab->export mode->read old status and merge with new data->Pop for org levels (give a full access)->see to that everything is green->generate it.
http://e-mory.blogspot.com/2007/12/sap-pfcg-create-role.html
Eg2: Derived role
pfcg->role name->create->in describtion tab towards right enter the master role name->Auth tab->export mode->read old status and merge with new data->you will get a pop for org levels (here you can restrict on plant lvel,purchasing group,company code....)
->let say for plant : 1000 ->generated / user comparssion
Once the role is added to the user. User will be albe to see only those plant related details (1000) (i.e he will have access to only plant 1000)
suppose if the user enters 2000,he will get a error message saying no access to 2000
NOTE: Any changes to the role should be done in master role (like adding tcodes)
.http://www.rssfeeddirectory.org/directory/items/346239.aspx
https://cw.sdn.sap.com/cw/docs/DOC-12021
http://help.sap.com/saphelp_wp/helpdata/en/1c/c38028816c11d396bc0000e82de14a/content.htm
Re: Authorization error after transport
Thanks,
Sri

Org Level Help

I tried searching the threads and Google for an answer first - no luck.
System: ECC 5.0
Release 640
The Org Level CO-OM Responsiblity Area is greyed out and I cannot edit it to enter a new Profit Center. When I select change mode I receive an error message which says "Authorization Object is invalid." Further information is "Table KBEROBJ does not contain authorization object.
How do I resolve this? Do I need to create a new blank Object field in the table and run PFCG_ORGFIELD_CREATE for RESPAREA?
I'm looking for a definitive answer and correction to this issue as I am flying in the dark.
Thanks!
Todd

Here is how I fixed it - well tested in SBX that it works:
Created a new entry in table KBEROBJ as follows:
OBJECT: (EMPTY)
CURRENT OBJECT: (KN)
OBJ1: (KS)
OBJ2: (HI)
OBJ3: (PC)
OBJ4 (PH)
Next, I ran PFCG_ORGFIELD_CREATE for RESPAREA. Then went into the role, change mode, Org Levels and I was able to change the value on the Profit Center Group tab as desired.
So far so good - we'll test a little more in SBX before I make the change in DEV and transport it.
Todd

Side - effect of new org level

Similar Messages

Maybe you are looking for