Structural authorization - creation of employee number

Hello Experts,
We are facing an issue with strutural authorization in creation of employee number,
I have tested without assigning stuctural authorization and it process the hiring action and generates the employee number
(Hiring action is carried through the adobe form which inturn calls the ABAP Function module),
for the same user if i assign Strctural profile with Function module RH_GET_MANAGER_ASSIGNMENT ( User is assigned to an employee who is Chief ) the hiring action which has to happen through adobe form is not happening and when we check in the program it is throwing an error as Failed strutural authorizations.
I checked whether the employee which has to generate lies within the organization unit of the manager ( who is chief) and it does lies with in the same org unit.
can you please help me in analysing why the employee is not getting gereating though the user is having proper HR authorizations and Strutural authorization assigned.

Hi.
After 2½ days of frustration I finally nailed this.
Function group RHAC, that handles the authority checks, initially buffers a table called VIEW containing all objects available for the user. As stated earlier in this conversation, SAP handles creation of relations in HRP1001 (links PA and OM). At this point the new employee number is appended to buffered table VIEW in function group RHAC.
When execution the PA40 activity through CALL TRANSACTION, the creation of the relations are not handled - and the same goes for updating the buffered table VIEW. The table can be updated using the function module RH_VIEW_ENTRY_INSERT from the same fundtion group:
This example might be useful
data: ls_view_entry type hrview,
        ls_related_object type hrobject.
ls_view_entry-plvar = '01'.
ls_view_entry-otype = 'P'.
ls_view_entry-objid = lv_pernr.
ls_view_entry-begda = '18000101'.
ls_view_entry-endda = '99991231'.
ls_view_entry-maint = 'X'.
ls_related_object-plvar = '01'.
ls_related_object-otype = 'S'.
ls_related_object-objid = lv_ny_objid.
call function 'RH_VIEW_ENTRY_INSERT'
    exporting
      view_entry     = ls_view_entry
      related_object = ls_related_object.
Best regards
Poul Steen Hansen
Senior Technical Consultant
EDB Consulting Group A/S, Denmark

Similar Messages

Structural authorization - creation of employee number in webdynpro or abap

Hello Experts,
We are facing some problems with the combination of structural authorizations and the creation of a new employee.
When we use PA40 to create a new employee this does not give any problem.
In the webdynpro we first execute a call transaction PA40 to apply infotype 0000 and 0001. This works well.
Except that the call transaction does not set the connection between PA and OM. (so we did program this ourselves)
In PO13 and the table HRP1001 the same relations are made as when we use PA40 in the sap gui.
After this we do call transactions PA30 for the next infotypes.
When we check the SU53 it gives a message: problems with structural authorizations object P (with the employeenumber) starting at 01.01.1800, enddate is empty.
The employee is manager and connected with his userid in infotype 0105.
We use in the structural profile the function module RH_GET_MANAGER_ASSIGNMENT
We checked with transaction HRHAUTH.
User has been adjusted to the tables T77UA etc.
We do not use workflow in this webdynpro
We used the trace function when this was executed, but it did not give more information about missing structural authorizations.
This issue was before on SDN (Structural authorization - creation of employee number) but unfortunally there was no solution there for the issue!
Hope one of you can help me to find the solution!
With kind regards,
Rita Mensink

Hi.
After 2½ days of frustration I finally nailed this.
Function group RHAC, that handles the authority checks, initially buffers a table called VIEW containing all objects available for the user. As stated earlier in this conversation, SAP handles creation of relations in HRP1001 (links PA and OM). At this point the new employee number is appended to buffered table VIEW in function group RHAC.
When execution the PA40 activity through CALL TRANSACTION, the creation of the relations are not handled - and the same goes for updating the buffered table VIEW. The table can be updated using the function module RH_VIEW_ENTRY_INSERT from the same fundtion group:
This example might be useful
data: ls_view_entry type hrview,
        ls_related_object type hrobject.
ls_view_entry-plvar = '01'.
ls_view_entry-otype = 'P'.
ls_view_entry-objid = lv_pernr.
ls_view_entry-begda = '18000101'.
ls_view_entry-endda = '99991231'.
ls_view_entry-maint = 'X'.
ls_related_object-plvar = '01'.
ls_related_object-otype = 'S'.
ls_related_object-objid = lv_ny_objid.
call function 'RH_VIEW_ENTRY_INSERT'
    exporting
      view_entry     = ls_view_entry
      related_object = ls_related_object.
Best regards
Poul Steen Hansen
Senior Technical Consultant
EDB Consulting Group A/S, Denmark

CAT2 Org Unit Structural Authorizations - Employees moving to different Org

Hello, everyone -
We currently use structural authorizations to restrict time keepers to only maintain time entries for employees in their org units. If an employee moves to an org unit maintained by a different timekeeper, we want to continue to allow the previous time keeper to maintain entries for the time the employee was in their org.
Example: pernr 1 starts out in org unit X. Org Unit X time entries are maintained by time keeper A. Effective 5/1/2014, pernr 1 moves to org unit Y, whose time entries are maintained by timekeeper B. The standard maintenance data entry profile allows the user to go back 6 weeks. On 5/2/2014, time keeper A tries to enter overtime worked by pernr 1 for his org unit on 4/30/2014. He receives the error "Not authorized to maintain data for personnel number &2 using profile &1".
How do we allow a timekeeper to make entries for any employee who was in any of their org units, even if they're no longer there?
Thanks in advance, and I'll definitely reward points for any helpful answers.
- Steve

Hi, Rohit -
The actual scenario is that we are set up to move all withdrawn personnel numbers to a pooled "separated" position in a separate org unit. This frees their previous position to be filled by a new hire. It also means that a LOT of personnel numbers are in this org unit, which the time keeper should not have access to.
D. -
We're using a custom function module entered in T77PR to retrieve the organization units that the time keepers should access. Here are the entries in T77PR:
(The "Maint."/Processing Type column is checked for all 3 rows.)
Z_HRLY_TMKPR 1 01 O          O_S_P 12 3   ZBC_GET_TKEEPER_ORGS_BY_USER
Z_HRLY_TMKPR 2 01 S          O_S_P 12 3   ZBC_GET_TKEEPER_ORGS_BY_USER
Z_HRLY_TMKPR 3 01 P          O_S_P 12 3   ZBC_GET_TKEEPER_ORGS_BY_USER
The function module uses a custom evaluation path ZHT that looks like this:
15 * B 008 Holder * S
20 S B ZHT Hourly Timekeeper * O
30 US A 208 Is identical to * P
I'm not sure what you'd like to see related to the profile... Is there a way to configure the CAT2 logic to allow a user to maintain a personnel number who is in the org for at least part of the time that the employee was in an organization that the user is authorized to maintain?
Thanks again,
- Steve

Create Partner function: VE Sales Employee / structural authorizations

Hi,
We are running SAP on ERP2005.
We are using structural authorizations to limit managers access to HR data - only own employees.
Now I want a department in our copany who maintain sales orders in VA02 to be able assign a Partner function: VE Sales Employee.
The System read the employee name from HR infotypes.
That is ok for the group members in the department if they are given access via authorisation object P_ORGIN.
The problen is the Manager for the group who have structurel authorizations. She will only be able to assign persons form her own department
Can anybody help me to sove this problem?
Thanks,
c¨,) Finn

Hello Finn,
Did you find a solution or a workaroud on this problem ???
I have got the same problem and I found nothing on SDN and Markeplace.
Regards.
Lionel

MSS genericiview and R/3 structural authorizations

Hi,
I have created some iViews based on par-file "eeprofilegenericiviewtable" to display R/3-queries. In R/3 we use also structural authorizations for the managers with functional module RH_GET_MANAGER_ASSIGNMENT.
The structural authorization is working in R/3 for a selected manager selecting a query directly from the R/3 via SQ01, but it doesn't in the iview. When the same user is viewing the "query"-iview, the message "No data selected" appears.
When I assign the user a structural authorization without the functional module RH_GET_MANAGER_ASSIGNMENT, e.g. only with some object types, the user can retrieve data without any problem using "query"-iview.
Probably the problem is in the functional module HR_INFO_GET_USING_QUERY used for retrieving R/3 query data from the portal and used by the iview eeprofilegenericiviewtable.
Has anybody met a similar problem? We are using EP6.0 SP14 and SAP R/3 4.6C.
Beata

Hi Dwayne (and others!),
Were facing similar problems with the error message "R3_CONNECT_FAILED". However, our difficulties are a bit strange because i only occurs on one of our two server nodes. We're running SAP EP 6.4, SP9.
Previously, we've had problems with the maximum number of connections towards our backend system, SAP R/3. But setting the environment variable CPIC_MAX_CONV helped us.
However, now we get the above error, but only on one of our server nodes. Do you (or anyone else) have any suggestions as to what might be wrong?
Thanks in advance,
Rasmus

R/3 reports related to structural authorization

Can anyone advise which standard reports/transcation codes in R/3 relate to structural authorization? are some better than others? I am interested in viewing allowable objects etc,.
Thank you,
Meghan

Hi Jim,
As you have mentioned you have worked a lot on structural authorizations,
I would request you to kindly help us on the below mentioned scenerio..
Issue : (Scenario)
C directly reports to B, and B Reports to A.
In the above scenario we have logged as B and did the compensation planning for C. A is the approver for the Cs compensation planning.
As C is HOD for HR Org unit. He will submit compensation plans of his subordinates to B for approval. That means B has to have approval authorization for Cs subordinates and he should not have approval authorization for his direct reporting employees.
In our scenario, B is able to perform the compensation planning as well as able to approve the same for his direct reporting employees. This shouldnt happen in our process.
How can achieve this, Please advice
Regards
Raghav

Authorization to control employee data after inter company transfer.

Hi Experts,
When the employee is transferred from company A to another company B through the action PA40, The client requirement is the personnel administrator of company A should see all his records in the display mode and the administrator of company B should maintain the all the records , We are using the structural authorizations.
At present , Both the administrator A and B are able to maintain the data for the employee. Kindly know your suggetions regarding this.
Thanks
Aju

Hi,
Please check the AUTSW ADAYS switch in table T77S0. Here is the SAP help on it:
http://help.sap.com/erp2005_ehp_04/helpdata/en/4d/4aba3b3bf00152e10000000a114084/frameset.htm
Source: help.sap.com
Hope this helps.
Donnie

Partner functions (R/3- CRM) based on employee number (KNVP-PERNR) or CP

Hi all gurus,
I am trying to replicate an partner-function base on personnel number/employee number for customers from R/3 to CRM.
For those partner-functions only the employee number is filled in KNVP-PERNR (the KNVP-KUNN2, KNVP-LIFNR and KNVP-PARNR are empty).
If I follow the replication process I don't see the employee number getting mapped to the "bapimtcs structure" (in function module COM_BUPA_MWX_CREATE_REL) and therefore those partnerfunctions are not replicated to CRM.
(all employees are entered in HR-R/3 and downloaded to CRM as business partners)
Basically this is exatly the same situation described in the following forum:
[Replicate partner functions (R/3->CRM) base on employee number (KNVP-PERNR) |Replicate partner functions (R/3->CRM) base on employee number (KNVP-PERNR)]
What (function modules/configuration) is necessary to get those partner-functions being replicated to CRM?
Unfortunately I was pretty unable to collect valid solution track.
Thanks in advance,
AndreA

Hi Andrea,
We were able to solve the exact same issue.
Here are steps used by us to fix the issue :
IMG Settings in CRM :
SPRO>CRM>Basic Functions>Partner Processing> Date Transfer>Distribution of Partner Functions from SAP ECC into CRM>
Partner Function = VE
Funciton = Employee Responsible(00000014) ( can be any other partner function which is a employee)
Usage= CRM
Also make sure the following settings are also done
SPRO>CRM>Basic Functions>Partner Processing> Date Transfer-->Distribution of Partner Functions from CRM into SAP ECC
Funciton = Employee Responsible(00000014)
Partner Function Cat = Employee
Scenario = CRM
R/3 func = VE ( even though you are using the PE partner function in ECCwe use VE here as you know VE is the german version of PE)
Type = MR master record
Also make sure that SAP Notes 1020514 and 1099363 have been applied in ECC.
Let me know if you have any issues. This should fix it.
Thanks
Edited by: Venkat_30 on Dec 14, 2011 5:15 AM

Context sensitive solution for Structural authorization

Dear all,
I would like to know whether new relationship, evaluation path and authorization profile has to be created for each role with context sensitive structural authorization ?
In T77UA table, each user has assigned a profile which tells the system how to find the structure by evaluation path (in T77PR table). Then in tranx OOAW, the evaluation path indicate how to build the structure by series of relationship, and this way we have to create new relationship for each role with context.
Am i correct ?
If an organization has many roles, then many relationship, evaluation path, profile.. has to be created !
Thanks for your help !
patrick cheung

Hi Chandra,
Thanks for your prompt reply !
This is for Context Sensitive solution, not the normal structural authorization:
Yes, if you add the authorization object P_ORGINCON in PFCG, you will notice that the field "Authorization Profile" has to be entered which tells the system WHICH ORG STRUCTURE does this authorization are refering to...
In table T77PR, instead of hardcoding the organization unit in the object ID field, we use Evaluation path to tell the system how to find the org structure for employees. Function RH_GET_MANAGER_ASSIGNMENT will return the org unit ID for the evaluation path.
In transaction OOAW, the said evaluation path specified the relationships which the system should use to draw the org structure of the employee's supervision... and there should be relationship like "Is managed by", may be as follows:
O B 002 Is line supervisor of * O
O A 011 Cost center asignmnt * K
O B 003 Incorporates * S
O B 012 Is managed by... * S
Up to now.... if you want to assign authorization to someone as follows, you could not simply maintain the same relationship "Is managed by" to Org Structure A and B because this will confuse the system as to which org structure you want the employee to maintain infotype 7 or 14/15. You should then create different relationships and maintain them to Org Structure A and B. And tell the system how to find the structure from the Evaluation path, which is stick to the Auth. profile. The Auth. profile is then maintain in the Context sensitive master data object P_ORGINCON !
(1)
Org Structure A
Maintain only infotype 7
(2)
Org Structure B
Maintain only infotype 14, 15
So... that's why i said if an employee has many role to perform duties in many different Org Structures (e.g. A, B, C...etc), you would create many relationship...
Hope this message will give idea to someone who intend to implement Context Sensitive Solution.

Structural authorization check in HR-ABAP

Hello Friends,
I am not able to get how to do the structural authorization check, my exact problem was : There is a report where it diplays all the qualifications of the employees and now I should restrict to only the employees who belongs to the organization unit depending upon the user who is running the report belongs to. It should check some more authorization profiles also.
Regards,
Yoganand.

Hi Yoganand,
if you use logical database PCH in your report, it should work by default.
Manually search for RHSTRUAUTH in transaction SE37. There
is a function modul which gives a list with the person the user has authorization.
With this list you could compare the list with selected persons.
hope this helps.
Regards
Bernd

HR structural authorization

Hello Friends,
I am trying to get concept of HR structural authorization. I have read the document " Structural Authorizations Step by Step, with Gotchas Too by Norm and Carl". After reading this document, what i have understood is In Structural authorization, we create PD profile eg: Manager, employee, ALL etc via transaction OOSP. And after that you assigned these profile to position via report RHPROFL0 or manually via transaction OOSB.
But what i am not able to understand is
1.How do this profile Manger, Employee etc will work? How do Users get authorization. What types of activities Uses are able to perform? What type of data user will have acess to? Do users get authorization to transaction like PA20 or you still need additional role that is created via PFCG.
2. What my understanding is Users who are in the top Hierarchal nodes or structure (eg: manager) is able to access data of employee below him. Do we still need to create roles like MSS and ESS role via transaction PFCG?
If somebody can clarify, I will really appreciate.

Hello Mate,
Have a loook at this thread, this may help .
Re: How to Restrict HR Org Structure from other Org Structures
Regards,
Regi

HR-Structural Authorization-AUTSW ORGPD switch

Hi All,
We are facing an issue with our structural authorization.
Our HR user are unable to view details of the employee who is been terminated in PA20.
Background:
1)The user is terminated on 10/2009
2)when the user was terminated he was assigned to the org unit 10.
3)Later the org unit 10 also got inactive.like it is not in the org structure anymore this is from 02/2010.
4)From 02/2010 on HR users are unable to view the employee details (who is terminated and belongs to an inactive org structure) in PA20
Analysis:
1) When we see in the OOSB Information the HR user is not having authorization to view this org unit from the time it is moved out of org structure.I.e 02/2010.The endda is showing 02/2010 against the org unit in structural access of the Hr user.
2)Other observation is that after HR users give PA20 we have taken su53 and it shows taht P_ORGINCON missing authorization for D,infotype 0000,subtype termination.
3)we have done testing in Dev by changing AUTSW-ORGPD switch to 3 still no use.
4)We did AUTSW-DFCON to 3 as we ahve context authorization also it also did not work.With DFCON 4 it is working but HR users are able to view not only their counry employee but also other country employees org assignmnet in PA20 which not acceptable.
Requirement:
HR users should be able to view terminated employees with org assignment(IT 0001) but that org unit is not in validity date(i.e A 002 for org unit is delimited) .
Any suggestions or ideas to handle the terminated employees in the delimited orgunit will be of great help...
Regards,
Vani.

Hi,
We are using DFCON = 4 and it is working for us. Try this way. If the user terminate then fill the Org Key in IT0001 with some Value YYY and then use this value in P_ORGINCON Filed Value VDSK1 = YYY and also PA restriction.
Or Write a FM to get the terminate pernr to users structure and use the Context it may work.

Failed HR Structure Authorization: should not be possible

Hi there,
I've got a strange problem which is quite similar to [this one|https://forums.sdn.sap.com/click.jspa?searchID=10542618&messageID=4893986], but the difference is that my userid does not have an entry in OOSB (T77UA) so it should not have missing HR Structure Authorizations because the general principle in the HR Structure is: No profile - No restrictions.
However, this user is restricted, but not for all records. The restrictions seem very random.
It seems that the userid itsself causes the problem. The account has been copied from another account. If you copy this account to any other userid then the problem does not occur, but I have to use this particular one because it is the official userid (personnel number).
As I said earlier, OOSB is empty and also infotype 0105 (Communication) is set properly.
I even tried to delete and re-create the userid completely but this did not help.
It looks like there are some 'hidden entries' in table T77UA or another table setting for this userid that I am not aware of. Could anyone help me out her?
Thank you!
Kind regards,
Lodewijk

Hi Lodewijk,
You say your problem is similar to the one you're referring to in your initial post. Does that mean that you also get an error message saying:
The last authorization check was successful
Failed HR Structure Authorizations
Date xxxxxxxxxxxxxxxxxxx

SAP HR Structural Authorizations

Hi Experts,
I need a help regarding SAP HR Structural Authorizations.
Currently our HR System is set with structural authorizations were in
users will be accessing HR Org structure with different pd-profile and HR relationships (with Org units ex:
assistant relation, manager relation).
Now we want to design the roles based on company codes, where users should be able to see
all organization units within company code 'xyz'.
Do we need to create new pd-profile or new HR relationships or just restrict within existing HR roles for
accessing organizations units within different company codes.
Please guide me steps to proceed with this requirement?
Your early response is highly appreciated, thanks in advance......

You will need to talk to the HR folks about this and whether any employee grouping on the HR side matches a company code unit on the FI side to use in the authorizations.
This means that HR data and processes are also aligned to finance processes, which was often the case with local HR systems but less so with global ones.
The answer is on your side in the data and the processes. There is no single field which you can use for both, let alone an org. level field known to structural authorizations.
Cheers
Julius

Structure Authorization Issue

Hi guys,
I don't have structure authorization implemented or HR system implemented. I was playing with my sandbox system to learn structure authorization by using step by step tutorial. After I created a structure authorization for two users I deleted everything related to structure authorization but unfortunately, some t-codes related to org chart for example PPOME, PPOMW are not working properly, its not allowing to create new org char.
We have another team needs to create some org chart for prototyping but they can't create org chart its giving no authorization error when I ran SU53 it's not giving regular auth error its also give failed HR structure authorization error, this is the error in su53 coming (Date 10/01/2010 and time Plan version 01 Object ID 5000075 Action LISD) there are so many different object ID on the list.
They all already have SAP_ALL in the system. Can anybody give some kind of report so I remove structure authorization completely from the system.
Please help
Thanks

Structural Authorization Check
Structural authorizations are used to grant access to view information for personnel where HR OM has been implemented as we stated. The Access is granted to a user implicitly by the useru2019s position on the organizational plan.
On top of the general authorization check, which is based on authorization objects, you can define additional authorizations by hierarchical structures.
In each area, the combination of start object and [Evaluation Path|http://help.sap.com/saphelp_erp60_sp/helpdata/en/35/26c256afab52b9e10000009b38f974/content.htm] from an existing structure returns a specific number of objects. This exact combination, in other words the number of objects returned by this combination, represents a useru2019s [Structural profile|http://help.sap.com/saphelp_erp60_sp/helpdata/en/0c/49ba3b3bf00152e10000000a114084/content.htm]. So structural authorization check is therefore based on a Dynamic concept: The concrete objects that are returned by a structural profile change as the structure (under the start object) changes.
Steps to Perform to Set Up Structural Authorization Check in brief:
(Before start moving for str. auth profile it is assumed that the Switch AUTSW for HR General Authorization check is also activated in table T77S0. Structural Authorization won't give the access for accessing HR data as described in the last posts and works together with General Authorization - to remind you)
1. Integration: Control parameters for the integration of Personnel Planning and Development (PD) with other applications (such as Personnel Administration (PA) and Cost Accounting (CO), etc.) are specified in the "PLOGI" group.
2. Turn on PD PA switch: TCode used is OOPS. Ensure value registered for PLOGI u2013 ORGA is X. No other values need to be checked or changed.
(Note: PD and PA sub modules of HR are not configured to share data by default in the SAP delivered system. This switch must be on for data to flow between both modules.)
3. Turn on Structural Authorizations Main Switches : TCode is OOAC. Value for ORGPD is set to 1.
4. Create Org. Plan (check the first post).
(Note: Do not create your Organizational Plan without this switch on. If you do, structural authorizations will not work and some org and infotype setup will not work. You cannot turn the switch on and get structural authorizations on an organizational plan, that was created while it was off, to work..)
5. Create Personnel Master Record: Tcode is PA40. This is time consuming staff.
6. Create record for Infotype 0105 - TCode is PA30.
7. Create Structural Authorization Profiles u2013 TCode = OOSP
8. Create entry for IT 1017 - TCode is PO10 (Organizational Unit) or PO13 (Position).
9. Assignment of Structural Authorizations: The assignment of the Structural Authorization can be found with good details here in [SAP Help|http://help.sap.com/saphelp_erp60_sp/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htm].
Please check and let us know for any query.
Regards,
Dipanjan

Structural authorization - creation of employee number

Similar Messages

Maybe you are looking for