Thumb rule for assigning auth values after t-code addition to a role

Hello everyone,
Could you please share your expertise on this. When a transaction is added to (the menu of )a role in PFCG, it automatically pulls in its corresponding authorization objects. So my question is what values should be given to these newly pulled in auth objects. Is there any guideline to be followed? Any disucssion would be greatly appreciated. Thanks a lot!

There really is no general rule.
There are two things you need to prepare to work on authorizations:
1. A list of critical authorization objects, such as S_DEVELOP, S_RFC and the like. In every role that you touch, these need to be managed properly. If you find that the default values in PFCG are not according to your policy, change them in SU24
2. A list of authorization values that you have determined are necessary for control purposes, i.e. cost centers and other org values. These need to be set according to the desird usage of the role.
Oh, there is ONE general rule: DO maintain SU24, i.e. manage what gets into PFCG in the first place. Make sure it's what your security design requires.
Hope that helps,
Frank.

Similar Messages

  • Is it posssible for assigning p.o to copmpany code

    hi,
    is it posssible for assigning p.o to copmpany code.if yes which synario it works??
    thaks
    subhasis

    Hi,
    You can assign a purchasing organization to one company code. This is company-specific purchasing.
    You can assign a purchasing organization to no company code. This purchasing organization can then procure for all plants assigned to it, irrespective of the company code to which the plant belongs.
    Since each plant must be assigned to a company code, the company code can be determined via the plant in each procurement transaction, even if the procuring purchasing organization is not assigned to a company code.
    A purchasing organization must be assigned to one or more plants. This is plant-specific purchasing
    From the Materials Management and Purchasing view, the purchasing organization is responsible for all purchasing activities (including the processing of requests for quotations and purchase orders, for example).
    The purchasing organization is integrated within the organizational structure as follows:
    A purchasing organization can be assigned to several company codes.
    (= Corporate-group-wide purchasing).
    A purchasing organization can be assigned to one company code.
    (= Company-specific purchasing).
    A purchasing organization can also exist without being assigned to a company code.
    Since each plant must be assigned to a company code, the latter can be determined via the plant at the time of each procurement transaction even if the procuring purchasing organization has not been assigned to a company code.
    A purchasing organization must be assigned to one or more plants.
    (= Plant-specific purchasing).
    A purchasing organization can be linked to one or more other purchasing organizations.
    (= reference purchasing organization)
    For more on this topic, refer to Assign Purchasing Organization to Reference Purchasing Organization.
    A purchasing organization can be divided into several purchasing groups that are responsible for different operational areas.
    Each purchasing organization has its own info records and conditions for pricing.
    Each purchasing organization has its own vendor master data.
    Each purchasing organization evaluates its own vendors using MM Vendor Evaluation.
    Authorizations for processing purchasing transactions can be assigned to each purchasing organization.
    All items of an external purchasing document, that is, request for quotation, purchase order, contract, or scheduling agreement, belong to a purchasing organization.
    The purchasing organization is the highest level of aggregation (after the organizational unit "client") for purchasing statistics.
    The purchasing organization serves as the selection criterion for lists of all purchasing documents.
    Possible organizational forms
    You can organize your purchasing function in the following ways:
    Corporate-group-wide purchasing
    Company-specific purchasing
    Plant-specific purchasing
    All of these forms can co-exist within a single client.
    Corporate-group-wide purchasing:
    A purchasing organization is responsible for the purchasing activities of different company codes.
    In this case, you do not assign a company code to the purchasing organization, but specify the company code concerned for each individual purchasing transaction. You assign plants from different company codes to the purchasing organization.
    Company-specific purchasing:
    A purchasing organization is responsible for the purchasing activities of just one company code.
    In this case, you assign a company code to the purchasing organization. The purchasing organization may procure only for this company code. You assign only plants of the company code concerned to the purchasing organization.
    Plant-specific purchasing:
    A purchasing organization is responsible for the purchasing activities of one plant.
    In this case, you assign the plant and the company code of the plant to the purchasing organization. The purchasing organization may procure for this plant only.
    Note
    If you wish to work with a mixture of the above organizational forms, the reference purchasing organization is of significance to you.
    It is possible to allow one purchasing organization to access the contracts and conditions of another - a so-called reference purchasing organization. This makes it possible for advantageous terms negotiated by one purchasing organization to also be used by other purchasing organizations
    Regards

  • Transfer Rule Routine: Assign Date Value into Blank Field

    Can anyone help me with regards to writing some ABAP code in a transfer rule so that I can assign "99991231" value into a date characteristics if it is blank?
    Many thanks for advance.

    I would like to check if the value of EXPIRYDATE is blank in data source. If its value is blank, assign '99991231' to it. Otherwise, it will get the value of EXPIRYDATE in transfer rule. I have rewritten the routine as follows. But there is no effects on the result.
    if TRAN_STRUCTURE-EXPIRYDATE IS INITIAL.
      RESULT = '99991231'.
    else.
      RESULT = TRAN_STRUCTURE-EXPIRYDATE.
    endif.
    Many thanks in advance.

  • Typing rules for assigning non-wildcards to wildcards

    Hi all,
    I have the following code:
    public class A<T extends Number> {
         T t;
         public void foo() {
              Number number = null;
              Integer integer = null;
              A<? extends Integer> a1 = null;
              A<? super Integer> a2 = null;
              a1.t = null; // OK
              a1.t = integer; // Error
              a2.t = number; // Error
              a2.t = integer; // OK
    }The code contains four assignments of a non-wildcard type to a wildcard type. Two of them are correct, two are wrong. Now, intuitively, the following rules seem to hold for such assignments to upper/lower bounded wildcards:
    - Only the null-type can be assigned to an upper bounded (or unbounded) wildcard.
    - A non-wildcard type can be assigned to a lower bounded wildcard iff it can be assigned to the wildcard's lower bound.
    I think that the rules are quite intuitive but I would be interested in finding the formal typing rules for such assignments in the JLS. Can anyone provide a reference into the
    JLS which which cover the semantics of the above assignments?
    Any help would be really appreciated. Thanks a lot in advance!

    kablair & dannyyates,
    first of all, thanks a lot for taking you the time to explain the things to me that clearly! Sorry also for the somewhat confusing example by having chosen the final class Integer which is some kind of a special and limiting case.
    In any case, I have gone through the JLS yesterday as I was particularly interested in the role of capture conversion to formally explain the correctness of the above code and here are my conclusions I want to share with you: Actually, there seem to be no subtyping rules for wildcards because you always apply capture conversion (JLS3 5.1.10) to wildcards before looking for their subtype relationship to other types. Capture conversion converts each wildcard to a new fresh synthetic type variable which has appropriate upper bounds and also a lower bound. Now, in the very last sentence of section 4.10.2 of the JLS3, it is stated that a type variable is a direct supertype of its lower bound which I think is the key point. This means that you can assign something to a type variable iff you can assign it to its lower bound.
    Now, capture conversion converts every unbounded or lower bounded wildcard into a type variable which has the null type as its lower bound. This formally shows that you can really just assign null to them as in the code above. Contrary, every lower bounded wildcard is capture converted to a type variable whose lower bound is the lower bound of the wildcard. So, again, you can assign it every type you can assign to that lower bound. This is also reflected in the above code.
    So, that's maybe the formal explanation for something which is intuitively clear anyway...

  • Updating Phase for PM notification value after completion process

    Hi,
    I need to update Phase value for a PM notification, after its completion. This process will be triggered by a custom RFC called from PORTAL side. Could you suggest how to update phase value for PM notification confirmation/completion.
    Regards,
    Pulokesh

    Hi,
    Can you tell me where to pass the phase value in the BAPI that you have mentioned. Can anyone tell how to update Notification phase value while its closure/completion.
    Regards,
    Pulokesh
    Edited by: Pulokesh Karmakar on Aug 19, 2009 11:16 AM

  • HELP!!! NEED tutiorials for backup windows 7 after error code 0x8078015B

    Please help I need a tutorial to backup windows 7 64bit after error code 0x8078015B.

    Is this over the network? If yes, then try these steps :
    1. Click Start. Enter “gpedit.msc” in the Start Search box. 
    2. Locate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
    Options\
    3. In the right pane, double-click on “Network security: LAN Manager authentication level”.
    4. Change the level to “Send LM & NTLM - use NTLMv2 session security if negotiated”.
    Please check if the share folder can be accessed with UNC “\\computername\folder
    or \\IPAddress\folder”.
    Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
    the thread.

  • Rule for Assign Roles Portals

    Dear experts
    I have two roles created in the portal (Role A., Role B)
    Depending of the type of user , There are is way using rules that system use a role A or B ?
    Thanks
    Regards

    Hello Steffi.
    Rule collections are used to assign portal desktops to portal users at runtime. A rule collection comprises conditions made up of IF and THEN expressions. Conditions are prioritized according to their order of appearance in the rule collection.
    Thanks
    Regards

  • In SU56 cannot check the other users' auth. value after import packages

    Dear All,
    Our system is ECC5.00. I upgraded the SPs SAP_BASIS & SAP_ABA from 16 to 19. After that, I cannot check the other users' failed authorization value by the path "SU56->Authorization values->Different user/Authorization objects".
    In the following popup, which named "Select User and Authorization Object", when I input the user name and press enter, the failed checked authorization object cannot be displayed automatically. But before the upgrading, I can get the failed object automatically.
    Kindly help me about this issue please
    Thanks & regards

    Hello Jiajia,
    Please check oss note:968915.
    Regards
    Ruchit

  • Assign fixed values through CMOD

    Hello all,
    I have been asked to make an enhancemet to assing fixed values to a field, so there would be a drop down after wards. Is this posible through CMOD? I know i can do it through se11 and fix the domain, but not sure if it is the correct process.
    Thanks.

    Hi,
    Enhancement(SMOD,CMOD) or BADI (SE18,SE19) are just predefined user exit for customer to implement their specific logic in the specific application/component .
    So your question is depending on whether there is a prefined user exit for that field. In my opinion, enhancement for assigning fiexed values to field mostly don't have predefined user exit.
    But you can achieve it with it's search help exit instead, do as below:
    1. If  a search help already been attached to that field, just implement search help exit via se11(choose search help and change)
    Hope helps,
    Chen Jian

  • Assigning of values to the charecteristics while doing GR

    Dear Gurus
    I have created a charecteristic and assigned it to a class of classtype 23 (batch class).I assigned this class to a material.Now while doing GR of this material through TCODE MB1C and movement type 561 the system is giving the automatic batch number.But it is not giving any options for assigning  the values for the charecteristic that I have kept in the class.How to assign the value while doing GR ?.I am able to assign the value by going to TCODE MSC2N.
    Regards
    Sandip Sarkar

    Hi Sandip,
    One option will be mark all those characteristics as Entry Required in T.code CT04.
    So that you will get a warning msg. during GR if value is not maintain.
    Msg. No is LB045 and msg is,
    The characteristic values for the batch are incomplete.
    If required you can convert that warning msg to Error also.
    You can do it by using T.code OCHS.
    But keep notice that you have to go that Classification tab manually - there is no other option in
    Regards,
    Dhaval

  • Table for CO-PA-Value Field Texts

    Hi together,
    does anybody know the table where the texts for the CO-PA-Value-fields are stored?
    Kind regards
    Udo

    Hello,
    both tables do not match my expectations.
    Table V_TKEVG3 is for assignment of value field groups, table TKCTK is for key figures.
    Kind regards
    Udo

  • Substitution Rule for Payment Term

    Hi Expert,
    I have to have Substitution for payment term the following criteria:
    Company Code = '1000' AND Document Type = 'L1' AND Posting key = '14', then ... substitution bseg-zterm with certain payment term.
    Problem: there is no substitution for bseg-zterm.
    I read the post at http://sap.ittoolbox.com/groups/technical-functional/sap-acct/substitution-rule-for-payment-term-489202
    and found that I need to apply a SAP note 42615 in order to enable the BSEG-ZTERM field in Substitution Rule for Payment Term, and after that run Program RGUGBR00 to regenerate the substitution.
    But, problem again, our SAP is ECC 6.0, and the said SAP note is not applicable.
    Kindly advise is there any other way that I can enable the bseg-zterm field at substituion.
    Thanks,
    sbmel

    Hi
    1. Go to SE16N and enter Table GB01
    2. Enter &SAP_EDIT in the command prompt i..e the space where you type your T code and press enter
    3. BCL TAB = BSEG and Field = ZTERM... Execute
    4. Remove the X for the field BEXCLUDE.. SAVE....
    5. Select this entry and menu Table > Transport > Include in tr request
    6. Run RGUGBR00
    Br, Ajay M

  • Data not coming from DOE to Mobile After defining Rule for device attribute

    Hi All,
    I have created a DO and rule for it.In case of Bulk Rule for all definition when i triggere extract from Portal then all the data comes to outbound queue but when i define rule for Device attribute then no data comes to my Outboun queue.Here is the scenario what i am doing :
    1. I have order header in my backend which has a field named "Work_Center" and this will be criteria field.
    2. In CDS table i have all the records for all the work center.
    3. Now in RMM under customized , i have added an attribute named "Work_center".
    4. Now i defined a rule with Device attribute mapping and activated the rule.
    5. Now on Portal i assigned this data object and in the device attribute tab i assigned the value(this value exist in CDS table for few orders) of a   Work center to the attribute "Work_Center" .
    6. Then i triggrere extract but its Outbound queue is empty, what could be the reason.
    Is my approach is correct
    Regards,
    Abhishek

    Hi Abhishek,
    You can check one ore thing, after you have performed all the steps till step 5, i.e. just before triggering
    extract. Check if the AT table for ur DO has entries based on the criteria specified by you...
    1. In the workbench click on the Data Object, and then right click and select "View Metadata".
    2. Select Distribution Model tab.
    3. Now select your DO's Association table.
    4. For the input field DEVICE ID specify your corresponing device id,and also for status field specify it 
        as "I"  and execute
    If there are any entries now in the AT table, and on triggering extract if they are not coming to the
    outbound Q there is some EXTRACT Q blocked. And is there were no entries in the AT then the rule
    specified is not  the satifying.
    Thanks,
    Swarna
    Now if you have entries w

  • Can we assign two values to the same parameter? If yes how? For details ple

    Can we assign two values to the same parameter? If yes how? For details please go through the following SAP related program.
    Here I need to print 2 queries using the same parameter "QUERY" the value assigned to this parameter(query) is REPORT_TEST1. I want to assign one more value to this Parameter. Is is possible? This question may sound stupid if it is not possible please kindly reply.
    I want to do this to print two documents(values) with a single command (parameter)
    Anybody please help quickly,
    Now, I have 2 tables from different queries. I have a print (HTML written) option in my WEB Template
    JAVA PROGRAM:
    <param name="QUERY" value="REPORT_TEST1"/>
    function PrintReport(typePaper) {
    document.title ='Report';
    if (typePaper == "0")
    {var CurrentReportName = '&?mp=U&ptot=1&rtot=0&psize=' + escape(typePaper) + '&fsize=' + escape('39') + '&qtitle=' + escape(document.title);};
    if (typePaper == "1")
    {var CurrentReportName = '&?mp=U&ptot=1&rtot=0&psize=' + escape(typePaper) + '&fsize=' + escape('52') + '&qtitle=' + escape(document.title);};
    CurrentReportName += '&ASOFDATE=' + escape(AsOfLabel.innerText);
    var openCMD='<SAP_BW_URL>';
    openCMD += '&DATA_PROVIDER=REPORT_TEST1&TEMPLATE_ID=DPW_PRINT_PAGE&CMD=RELEASE_DATA_PROVIDER';
    openCMD += CurrentReportName;
    openWindow(openCMD,'MainTitleNow',800,600);
    The data provider here is REPORT_TEST1. Now it only prints the corresponding data for the data proviedr 1 i.e., REPORT_TEST1. I have a second table whose data comes from the data provider 2 when i use this HTML to print I want the second table contents from the data provider 2 (REPORT_TEST2)also to be printed simlutaneously.
    Please help.
    THANX A LOT,
    SRINI

    Hi,
    Try assigning two values seperated by a delimiter ( say '|') to the same parameter.
    In the function get the parameter value and seperate the values using the same delimiter.
    <param name="QUERY" value="REPORT_TEST1|REPORT_TEST2"/>
    Regards,
    Uma

  • ALE : conversion rule for field value to become null

    Dear experts,
    I need to pass a material from one system to another with ALE. The problem is that the field marc-prctr (profit center) of this material is populated in the first system, but it does not exist in the second, so I assume transaction bd79 should be used to convert somehow the value of prctr to initial.
    How can I do that??? I have already tried defining a conversion rule and assigning it to message type MATMAS, segment E1MARCM, but it did not work.
    Please help.

    Did you check this?<a href="http://help.sap.com/saphelp_erp2005/helpdata/en/d3/06f6679aaf0e44b67ca6d6b58d91df/content.htm">http://help.sap.com/saphelp_erp2005/helpdata/en/d3/06f6679aaf0e44b67ca6d6b58d91df/content.htm</a>

Maybe you are looking for