Tracking of Authorizations

Hi All,
Is there any way to track the log of over-writing a particular user's authorizations in SBO? More specifically, if someone need to know when a user's authorizations are amended and what has been changed.
Regards.

When the Authorizations window is open, you can tranck the changes through Tools / Change log.

Similar Messages

Track-specific Authorization

Hi,
I set up Track-Specific Authorization in NetWeaver 7.0.
UME user "test_a" has NWDI.Administrator role, and the CMS Track Authority of user "test_a" is set as =>
====================================
Track A => select all Authorities
Track B => select only "Display" Authorities
====================================
I turn on Track Authority State without error.
When I practice the scenario that login as user "test_a", then modify Track B by adding runtime system.
User "test_a" is able to add runtime system on Track B.
The expected resuld should be "test_a" can not modify (ex. add runtime system) on track B.
Please Help.

HI Chen,
test_a has a NWDI.Administrator role assigned to it.
so test_a can do anything.
track authertices are set for the users. whom you just assigned
NWDI.Developer or other roles other than NWDI.Administrator

Status and Tracking System Authorization Objects

Hello,
I'm having questions on how to create roles for users to access the Status and Tracking System.
I've assigned the following Authorization Objects to my user
R_STS_PT
Activity: 16 Execute
Subplan: *
Planning sequence: *
R_STS_CUST
Activity: 16 Execute
R_STS_SUP
Activity: 16 Execute
And still when i try to execute STS (T-Code: BPS_STS_START) or Customize (T-Code: BPS_TC) i get an error saying "Without Authorization for the transaction BPS_STS_START" and "Without Authorization for the transaction BPS_TC"!
Can anyone help me, please! Waht am i missing?
Thanks

Hello Stephen
Thank you very much for the help.
Still i have some other questions that you or someone can help me.
By now, my Planning Coordinator can already access to BPS_TC, and my Planning Responsible access to BPS_STS_START.
The "normal" users must onle have the Authorization Object R_STS_PT.
I still have this issue that i'm not getting at.
I have created a user where i've assigned total access to Execute STS and Customizing.
Assigned the 2 transactions BPS_TC and BPS_STS_START and gave them the Auth. Objects R_STS_SUP and R_STS_CUST.
Issue: When my user tries to "Define Subplan" and "Define Planning Session" i get this error:
"No maintenance authorization for requested data
Message no. SV052
Diagnosis
You have attempted, in change mode, to access data for which you have no authorization."
Can anyone help me on this please.
Thanks
Vitor

Keeping track of authorization(updation )

hi all,
i am working on jdeveoper with jsp. i am handelling authorization module. in this module the user will view the data and authorise. This will be updated in the database. In that i want to restrict number of authorization for each user loged on. so that the user can athorise only 10 or 20 times for each log on.
thanx in advance.
null

Maintain the number of rows updated in a session variable, and set up your sessions to expire when the browser is closed. If you want to allow the user to log off and back on again without closing the browser, then reset the count to zero when the user logs off.

Need your help !!! -- Authorization error for Real-Time Bex query

Dear experts:
I have a Bex query built on a multiprovider, this multiprovider is consist of one standard cube and one real-time cube(virtual provider). When I run this query, I can retrive the data and no error occured, but when others execute this query, they will get the error message below:
Operation Generate a Request could not be carried out for DTP DTP_D7JVT8DGBQWPWL13VIUITNODG
You do not have authorization for the data transfer process
Errors occurred during parallel processing of query 2, RC: 3
Error while reading data; navigation is possible
Row: 54 Inc: WRITE_MESSAGES Prog: CL_RSDR_AT_QUERY
I used tcode rsecadmin to track the authorization, when I execute as user XXX, I can get the same error above, but when I go to "Display Log", no error showed there.
Did anybody meet the same error before? How to resolve that?
Any post would be appreciated and thank you all in advance!
Tim

I think there is some missing authorization,here
the user has no access to execute the DTP.
You can analyse it in rsecadmin or also see
which object you are getting in su53.
Thanks,
Saveen

CMS track problem (NWDI)

Hello!
Please help
I need to modify Web User Interface (component SAP-CRMWEB)
I make track with "Modify a Software Component" wizard (NWDI), than I add this track to NWDS.
And here are the questions:
1. I do not have "Development Configuration Perspective" in NWDS, but I have "Development Infrastructure Perspective" instead. Is it ok? Guide tells to do a few steps, including u201CInactive DCu2019su201D Panel, and I do not have one!
2. No components in the imported track in NWDS. Nothing to modify!
3. In CMS new track is marked as waiting for assembly and component SAP-CRMWEB as "developed". Why?

Hi Alexander,
did you do what is desciben on help.sap.com for [track specific authorizations|http://help.sap.com/saphelp_nw70/helpdata/EN/04/551b42d10b5633e10000000a155106/frameset.htm]?
Could you please check whether your developers have the right to execute the actions CMS.Export* (Own or Foreign) as desibed in [here|http://help.sap.com/saphelp_nw70/helpdata/EN/94/6c7b401c976d1de10000000a1550b0/frameset.htm]?
Kind regards
Karin

NWDI: CMS Track Authority

Hello, we have an NWDI SP15 (nw04s) and we want that developers are able to transport. We activated CMS Track Authority for your tracks and have added our developers. But still developers aren't able to import transports. The import button is grey. Our developers have the authorization NWDI.Developers. If I give them NWDI.Administrator. They are able to import transports. What have I missed during the CMS Track Authority?
Regards,
Alexander

Hi Alexander,
did you do what is desciben on help.sap.com for [track specific authorizations|http://help.sap.com/saphelp_nw70/helpdata/EN/04/551b42d10b5633e10000000a155106/frameset.htm]?
Could you please check whether your developers have the right to execute the actions CMS.Export* (Own or Foreign) as desibed in [here|http://help.sap.com/saphelp_nw70/helpdata/EN/94/6c7b401c976d1de10000000a1550b0/frameset.htm]?
Kind regards
Karin

Restriction authorization

Dear Gurus,
Users in our production system have access to t-code se38,se11.
Now we want to remove these authorizations,but these authorizations are provided to the users via diffrent roles and its difficult to track these authorizations.
I want to know that is it possible to create a restriction authorization where we can define the t-code value as 'not equal' and restrict the desired authorization
Please update
Thanks and regards
Tushar

I agree with Netweaver Expert.
If you are finding it difficult to identify those roles then I suggest that someone on your security team gets training ASAP as it it a very, very basic task to ID roles with those authorisations. You can do it in SUIM or via table AGR_1251 in less than 10 minutes.

About authority-check object 'M_MATE_WGR'

hi all
I have a problem about authority-check object 'M_MATE_WGR'. the detail is bleow:
Read table T023 where the material group is in select option s_matkl. Then loop at the results and check for every found material group. If the user is authorized to use it with the ABAP statement AUTHORITY-CHECK with object M_MATE_WGR with parameters ACTVT = 03 (display) and BEGRU = the material group. When the user is allowed to use it, store it in an internal table and continue with the remaining materials groups from T023. When the user is not allowed to use it, set the status flag to X and dont save the current material group in the internal table.
After all checks have been done, empty the select option s_matkl. Loop over the internal table with the allowed material groups and fill up the select option s_matkl again with these records.
Thank you in advance .
Nick

You are on the right track. Authorization object M_MATE_WGR checks the Authorization Group (BEGRU) not the Material Group. You read table T023 with the Material Group to get the Authorization Group.
Step 1: Read table T023 where MATKL = the Material Group you want to check authorization.
Step 2: Retreive the value in field BEGRU from the record in table T023. Use the value in T023-BEGRU to pass to the AUTHORITY-CHECK object M_MATE_WGR.
Hope that helps.

Did Apple pay for all my CD's?

Did Apple pay for all my CD's from the 80's, 90's and 00's I uploaded to my Itunes? Seems like they did because to manipulate the files in any way (changing names, adding artwork) I have to go through several steps to "Authorize" myself to do so...Why? The tracks when Clicked on are all "greyed" out. I did some searching online to figure out how to take control of MY OWN music once again. However going through a series of silly prompts FOR EVERY SINGLE TRACK is time consuming and just...like why? I 've bough quite a bit of music (and other media) from ITunes over the years but 70% of my collection is CD's I BOUGHT MYSELF. In some cases starved for, as if a new Rush disc was out that week and it was that or lunch that day, there was no contest. Now I'm not blaming Apple for starving me during certian points in my life but what I'm saying is I PAID for all this music MYSELF with my MONEY. I OWN IT. Or do I? Once I uploaded all my Cd's they were given away traded off to shops or put in boxes never to be seen again. Why would I need them?
Well now that anytime I want to turn up a track a bit, fix some art, or edit spelling, I need to go through each album track by track and authorize MYSELF to do so???
Please some sane person explain this to me while I go through my 99 track Motorhead boxset so I can make it all one listing and not have it broken up in "CD's" as almost ALL of my multi disc releases are now. Man I hate when rich people mess with us unwashed...
Had to edit this because I was "Mad Typing" and the spelling and grammer was just amazing....
Message was edited by: TheWickedTenants

Not being able to edit details may be a permissions problem...
Repair Permissions
Right-click on your main iTunes folder and click Properties, then go to the Security tab and click Advanced. Use the Change Permissions... button grant to your account (or theUsers group) and SYSTEM full control of this folder, subfolders and files, then tick the option to Replace permissions entries... which will repair permissions throughout the library. When complete switch to the General tab, click in the Read-only check box to clear it, then click Apply.
If you don't have the option to change the permissions then use the Owner tab and Edit...button to take ownership from an account with administrator privileges. Tick the option to Replace owner on subcontainers and objects.
Repeat with the media folder if it isn't stored inside the main iTunes folder.
For tips on organizing content in iTunes see Grouping tracks into albums.
If you gave away/sold some of your CDs then you should also have deleted the ripped copies. You're only entitled to keep the ones that you have in storage.
tt2

Help - Want iTunes Shared in multiple accounts!

Hello,
Now that my wife has her own ipod and is downloading music, workout music and other crap I do not want anywhere near my ipod, I was hoping to get her using her own account / environment on the Mac and that way she can set up her icons and iTunes any way she likes.
The Problem is that when we log in to her account on our Mac iTunes is empty!
Is there a way for me to copy the iTunes library from my account over to hers so she can at least get the music she has already downloaded and the rest that we have copied from our CD collection?
The goal is to let each of us have our own iTunes library to mess with as we please.
Thanks,
Brad

Couldn't be easier!
First, make a playlist that has all the songs you want in her library.
Then select all the songs and drag them to a folder in the Finder. Make sure that her account can access the folder.
Switch to her account, and drag the songs into iTunes. Once that's done you can delete that intermediate folder.
And if your really want those songs out of your library, go back to your account, click on that playlist, Select All and Option-Delete. That deletes the songs from ALL playlists and the iTunes Library. It asks if you want to keep the songs in the iTunes Music Folder or move them to the trash -- you want to move them to the trash. (She's got her own copy, you don't need multiple copies on your hard disk!)
The only thing I don't know is how iTunes keeps track of authorizations for the iTunes Store: will it ask for her iTunes to be authorized, even though it's on the same computer, or not? Probably not a problem either way, since it would at worst mean that you're using 2 of your 5 allowed authorizations.

WSUS Client Removal Problems

Good Morning,
First, a little background into software and setup.
SERVER: Windows Server 2008 R2 Standard with the BDC role and WSUS 3.2.7600.226 Installed. Windows 2003 Domain, using Group Policy to push out a "WSUS Computers Policy" with the correct WSUS settings.
WORKSTATION: Windows XP Pro SP3, with latest updates, that resides in the "WSUS Computers" OU, using "WSUS Computer Policy". Firewall Disabled, Antivirus Removed for testing purposes.
This has been somewhat frustrating for me. We have recently purchased GFI MAX Remote Management and would like to use this to keep track and authorize windows updates, not to mention numerous other features. I would like to move away from WSUS. WSUS is currently
pushing out updates to my workstations and does not have a problem doing so, I am just looking for a more centralized solution for pushing updates and patches to not only Windows, but to 3rd party applications without breaking the bank.
Now, the problem I am having is that when I remove the test computer from the "WSUS Computers" OU and place it in "Computers" OU to just pull the Default Domain Policy, I am not able to run windows updates from the default microsoft updates site. In my Default
Domain Policy I do not have Windows Updates configured, they are set to the default "Not Configured" option. I have tried creating a test policy to see if I just need to push a clean policy and still unable to receive updates. I can provide logs
if need be, the error I get when trying to run windows updates after removing the computer from the OU is:
"Error number: 0x80190193"
Any help would be greatly apprciated. Thank You in advance.
Jon

SERVER: Windows Server 2008 R2 Standard with the BDC role
"BDC role"???
I would like to move away from WSUS.
...and you're asking for help in doing this IN the Microsoft WSUS Forum!? Gutsy!
Now, the problem I am having is that when I remove the test computer from the "WSUS Computers" OU and place it in "Computers" OU to just pull the Default Domain Policy, I am not able to run windows updates from the default microsoft updates site.
Well, first, merely removing a computer from the scope of a GPO configuring WSUS does not disable or reconfigure any of the WSUS functionality. To explictily revert a client back to being an "Automatic Updates" client you will need to put it in an OU with
a GPO linked that explicitly DISABLES the "Specify the Microsoft intranet update services location" policy -- or some other method that explicitly sets the UseWUServer registry value to FALSE (dword:0x0).
However, is this case, your description does not read like this is an *AU* problem, rather it sounds like a *WU* problem, which is a totally different beast.
the error I get when trying to run windows updates after removing the computer from the OU is:
"Error number: 0x80190193"
On a Windows XP system, this error -- trying to access Windows Update (from the Start Menu or Internet Explorer) -- has nothing at all to do with whether the client is a WSUS client or not. Windows Update can
always be accessed, regardless of whehter a client is, or is not, configured as a WSUS client.
This is an HTTP 403 error, and it's typically caused in a WU scenario because the client's
WinHTTP proxy configuration does not match the organization's proxy implementation -- essentially the client is not configured to use a proxy, and an existing proxy server is blocking access to the Internet for that client.
There are other less-common causes, but they generally do not manifest when trying to connect to Windows Update, but rather generally only in active WSUS environments.
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2011)
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
My Blog: http://onsitechsolutions.spaces.live.com

Error while Creation on Track(create/save) CBS authorization exception?

Hi All,
I am trying to create Track in CMS in NWDI. When I am saving after importing relevant SC (ESS/MSS),
I got below error while saving.
CBS (URL http://sapdevep:50000/tc.CBS.Appl/archiveapi2/) authorization exception: User not authorized to log into build server. ( Service call exception; nested exception is: com.sap.engine.services.webservices.jaxrpc.exceptions.InvalidResponseCodeException: Invalid Response Code: (401) Unauthorized. The requested URL was:"http://sapdevep:50000/CBSWebService/CBSHttpSOAP?style=rpc" )
request you guide me for this problem.
Thanks,
Rafi Shaik

Rafi,
You might want to refer to this
Cannot create a new track: User not authorized to log into build server
Also check this SAP Note
#840523 -- NWDI server configuration: user, group and security role
Thanks
Prashant

Authorize track for new account

iTUnes asks me to authorize some of the tracks on my machine before I am allowed to play them. So it asks me for password for my OLD iTUnes account that does not exist any more. So I fill inn user name and password for my NEW and active account. Then iTunes says "This machine is already authorized", but when I then try to play the track the first demand for Authorization comes back (with the non existing account). I fill inn my new account, only for a new round in the carousel....HELP!

kvitberg wrote:
thanks. its understandable in a way, but i have lost 6 albums i love. such arrangements are very good arguments for file-sharing.
Which is why I don't purchase anything from iTunes. I buy CDs or use other online services which do not have that silly authorization and protection built into the files or require me to update my iTunes just to download the "plus" tracks.
Unfortunately I don't know what people usually do in situations like yours since I don't use the iTunes store other than to look things up. I don't buy from them.
Patrick

Authorization object for requirement tracking number

I want authorization object for requirement tracking number in PR ME51N.
I have to make control over User against requirement tracking number that particular user can use this tracking number only while using ME51N.

Check the t code su21 whether your requirement is fullfill or not.
If not make a authorization object with the help of abaper and assign this object to the particular user in their profile.
Hope this is help.

Tracking of Authorizations

Similar Messages

Maybe you are looking for