UME security vs ABAP security object level

Question

We installed Virsa Compliance Calibrator & Access Enforcer and trying to configure security in UME to control user access so that besides action level security, we need further restriction on for example, Functional Area, cost center & department access. Does UME have lower level authorization restriction capabilities similar to that of ABAP authorization object level security? If not, how can we utilize ABAP Virsa security objects to control JAVA front end access?
Your advice is much appreciated.
Thanks,

Answer 1

I'm not aware of a way to limit requestor access (you can request anything visible); however, you can provide direction by populating an attribute field (i.e. company) with valid company values for each role.  When a requestor searches for a role, if they filter by the appropriate company, they will only see valid roles for the request.  I did, however, point the request authentification towards a 'fake LDAP'.  This prevents individuals without specific UME credentials from submitting a request.
However, you can restrict approvers using a custom approver/determinator.  In my case, I wanted to use a combination of "role" and "usergroup" to determine approver, rather than use one approver set for all requests.  I have implemented and confirmed this works.  The unfortunate side affect, is that you have to maintain a seperate file for this custom A/D (which you have to refer to /append for any request for role approver information).