Use of ":", "#" in authorisations

Hi,
can someone explain with examples?
thank you

Hi,
 Assume you have created a custom reporting authorization object to secure at Info Object level, for example 'Division' and assigned it to an Infocube. The aim is that the user should only be able to execute queries for his relevant division only.
Then all the queries which are defined on the info cube will check for your authorization object, even if the infoobject is not included in the querty defn.
Thus the query execution will fail. To avoid this you have to include ':' in the field authorization value of the Info object.
 Another use of ':' is when you want a user to display all employee names in a particular Sales Organization(eg 0001) and prevent him from displaying Employees in other Sales Organizations. You've to define authorization values as given below.
Sales Organization : 0001 (For displaying all employees in 0001)
Employee Name: *
Sales Organization : * (For restriction)
Employee Name: :
 If your Info object has 'Unassigned values'(#) and you want to display those values, then to avoid an authorization error, you have to give # in the Authorization value field.
Hope this helps.
Regards
Hari Krishnan K
Message was edited by: Hari Krishnan K

Similar Messages

Why when i want to sync my phone with the computer it wants to delete all my apps how do i not let this happen. this is a different computer to the 1 i always use. i have authorised this computer but still wants to delete my apps

why when i want to sync my phone with the computer it wants to delete all my apps how do i not let this happen. this is a different computer to the 1 i always use. i have authorised this computer but still wants to delete my apps

Why you can't redownload? Don't you have the Apple ID that used to download these apps?
You can "transfer purchaces" by right click on your iphone in iTunes but i guess you computer is not authorized and will ask you to authorize with Apple ID. Try it.

Using BAPI for authorisation check

Hi,
I am not sure if I understand what you want to achieve but you can check ABAP statement AUTHORITY-CHECK with addition FOR USER which gives you a way of testing authorization for different user. So if you use some RFC user to get BP partner then you can write your wrapper where you will pass user name to perform authorization check first.
Cheers

Hi Julius,
here is my design:
1 the search engine logs on to the CRM system using a super user account and fetches some informations about the Business Partner.
2 Subsequenntly, the search engine builds the URLs for each Business Partner after this pattern:
http://<serverhost>:<port>/sap/crm_logon/default.htm?crm-object-type=BP_ACCOUNT&crm-object-action=B&crm-object-keyname=PARTNER&crm-object-value=<partner_id>&saprole=MYROLE
3 Before a user can input a query to search for a Business Partner he/she is prompted to provide the credentials (username and passwort) for the CRM
4 These credentials are passed to the CRM. Using the credentials and a Authorisation Object i want to check which Business Partner the user is authorised to access. (For example, the user may be authorised to display only the Business Partner with a Business Role=EMPLOYEE). To perform this step i am looking for a BAPI
5 Subsequently, the search engine provides as search results only the business partner the user is authorised to access
6 By clicking on the URL the user can display a Business Partner in the WEB UI
I hope i culd explain my design. Thanks for help
Edited by: Nicolai Zaidman on Jun 1, 2010 10:13 PM
Edited by: Nicolai Zaidman on Jun 1, 2010 10:21 PM

Iphone cant be use outside of authorise countries? will it be hijacked?

i bought the unlocked phone from HK and unable to active it as next day been fly to malaysia for employment. successfully create a itune acount and key in a Malaysia account and activiate it with a malaysia sim card. When i click on the itune icon on the phone, it shown that i am in different country and unable to log on.
1) I been to Mac shop in Malaysia, the sales person warn me that do not download anything include update anything from itune store as maalysia is not a official selling iphone country, Apple may lock my phone. Will it be true?
2)is that mean i can only download from third party web site to itune and transfer to my iphone without any deal with itune store?
3) i have set my itune account and activiate it, will it possible to rese/rebuild a itune account and update with my phone again? but i am already update my phone and using it.

Hi,
AFAIK, all phones sold in HK is UNLOCK. You can use in any country with that country local sim card (except Japan).
As for your case, I assume you did not activate the phone in HK after you bought it and activate in Malaysia with a Malaysia iTunes account.
I suggest that you open iTunes and log on to your HK iTunes account (or create one if you do not have one. From there, activate your phone with the HK iTunes store account, that should solve you problem. After activation, you can plug in a Malaysia sim card to use it. Cheers!

HT204053 How can I reset my authorised laptops?

I've had the same apple ID for the past 8 or so years, and I've used itunes for a few laptops. I know the situation with 5 authorisations.
The first laptop I had, was the 1st device authorised, the HDD was repaired, so when I re-installed itunes. it used up a second authorisation, it didnt bother me too much. So I got a new laptop in 2009 and it used a third authorisation, and I updated from vista to win7, so I think it was the 4th authorisation used. I've just bought a new laptop and I thought i had managed to get it authorised, but when I connect my iphone to sync, it says I've used my 5 authorisations and I can't transfer apps etc, and I really don't want to reinstall them one by one. I have an ipod touch also, which I haven't used on this laptop yet, but my question is - I don't have either of those first 2 laptops any more, is there any way I can de-authorise those laptops from my account, so I can get the authorisation back and update my phone etc? I believe it's due a software update, and don't want to lose everything just cos of a case of authorisation

You can find that option by logging into your iTunes account. The instructions are on this page: http://support.apple.com/kb/HT1420

Ad Hoc Query & HR Structural Authorisations

Good day,
Can you kindly suggest solutions to the following?
Users with access to IT0008 can view basic pay across company codes. Iam using user groups for restriction per company code and PD Profiles for structural authorisations - there is also a restiction on personnel areas for the company code in the role in which IT8 is allocated...
Can you advise how i can restrict IT8 access for users across sites/company codes?
Thanks have a lovely day!

Hi Anders,
Thank you for the reply,
We are using HR structural authorisations with context solution P_ORGINCON, we have a HR Organisational based structure - where roles and PD profiles are linked to postions (PD Profiles are per company code as well nd linked to IT1017 on object S)... That is correct In our HR enterprise structure the personnel area is a breakdown of the section/s within a company code.
My roles have the personnel area restriction specified however when using Ad hoc query it is still allowing cross company access on it8. is there perhaps an object that is allowing this access we are not using object S_QUERY at this stage. could P_ABAP be allowing this access?

Electronic authorisation of invoices

I run a small business which is looking to streamline its accounts payable coding & authorisation function - possibly using acrobat. Currently we:
a) receive invoices at head office;
b) manually stamp the invoice with the coding stamp (fields - date received, entity, gl code, authoriser, date authorised);
c) scan the invoice into a pdf document (via a multifunction center);
d) e-mail (using Outlook) the pdf document to the applicable manager;
e) manager completes coding (via text tool into boxes of manual stamp applied in b above) and authorises (via Acrobat stamp);
f) manager e-mails (using Outlook) coded + authorised pdf to head office for payment.
Can this be done better via "form fields" (instead of manual stamp) or via an Acrobat add-on? If so, who should I get in touch with (we are an Australian company).
Thanks!

Mrudula
I understand that you want to send IDocs to XI and from XI you want to send to vendors site. So in this case you need an IDoc and a HTTP Adapter. Eventhough you use XI2.0 you have this adapters with you. The configuration for these adapters is given here:
http://help.sap.com/saphelp_xi20sr1/helpdata/en/ab/bdb13b00ae793be10000000a11402f/content.htm
http://help.sap.com/saphelp_xi20sr1/helpdata/en/b9/c5b13bbeb0cb37e10000000a11402f/content.htm
http://help.sap.com/saphelp_xi20sr1/helpdata/en/44/79973cc73af456e10000000a114084/content.htm
http://help.sap.com/saphelp_xi20sr1/helpdata/en/82/f4993c03e0cd37e10000000a11405a/content.htm
http://help.sap.com/saphelp_xi20sr1/helpdata/en/bf/27fd3b651f6a1ce10000000a11402f/content.htm
If you need a sample scenario it is given in:
/people/ravikumar.allampallam/blog/2005/03/03/creating-purchase-order-idoc-through-xi
Also you require some configure steps for posting idocs:
/people/ravikumar.allampallam/blog/2005/02/23/configuration-steps-required-for-posting-idocsxi
If you have any issues post back here in SDN.
---Satish

Authorisations based on Sales Orgs in crm 2007 Web Client

I have a requirement to restrict the visibility of data (both masterdata and transactional data) based on a specific sales org. For a specific business role i need to restrict visibility for our account managers utilising the web client application to business partners from a specific sales org and also fortransactionsal data from the sames sales org.
I have been using the following authorisation objects to effect this but with limited success:
CRM_ORD_OP
CRM_ORD_LP
CRM_ORD_PR
CRM_ORD_OE
Whilst i can restrict users from viewing some of the specific data 9based on sales org), the transactional data and indeed customer master data still appears on the web client searches. What needs to happen to ensure that the data does not even appear in the relevant searches. The same requirement for searches of customers should also be
Has anyone met this type of requirement and if so what dod they do to implement it.

Eddie,
Are you familiar with Access Control Engine (ACE)?
Go through this -> http://help.sap.com/saphelp_crm50/helpdata/en/04/0177f9bb67ac4cafb84bb4d4c1d8fc/content.htm.
and https://websmp205.sap-ag.de/~sapdownload/011000358700002121742006E.
Authorizations in CRM are controlled through ACE.
Hope this helps.
Amar.

Use of S_RS_AUTH

I am a sap basis admin.
I want to know the use or S_RS_AUTH authorisation
Please help me

Hi Emerald,
please search the forums first before posting questions. This avoids redundant effort and saves time and resources of your peers.
Please use the search term "S_RS_AUTH" or refer to the online help
<a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/55/46eb411a7f6324e10000000a1550b0/content.htm">http://help.sap.com/saphelp_nw2004s/helpdata/en/55/46eb411a7f6324e10000000a1550b0/content.htm</a>
Cheers
SAP NetWeaver BI Organisation

Enhancement CNEX0002 - EXIT_SAPLCNAU_002 PS Authorisation check for WBS

I would like to use the enhancement to allow only certain users access to change certain fields in CJ02 / CJ20N. Other users must still be able to change other data on a WBS element.
We created our own authorisation object which is checked in the exit. When we activate the customer enhancement project, the WBS are greyed out and nothing can be changed (even if you have the authorisation).
Does anyone have any knowledge of whether this function module can be used to limit authorisation to change certain fields only?
Thanks in advance
Silke

Thanks Gupta,
I managed to get it working for project definitions and wbs elements - for the whole transaction and for certain fields only as well - the only field we still battle with is the 'short description' of the wbs where we want to avoid unauthorised changes by just any user. SAP is also battling with this one and thus far we had no correct answer from them.

Authorisation objects while BI upgrade

Hi Guru's,
We are planing to upgrade our BW system from 3.5 to 7.x. We have some authorisation objects in our system. Before upgrading should we do any consistency check for these objects.
Regards
Savi

Hi,
I need to develop field level authorization.
I need to create BW Role that will restrict access based on region.
I made region as authorisation reveleant.
In BW 3.5
In RSSM i used to create authorisation object based on region and in PRCG i use that authorisation object and restrict it with a value i desired.
What is the procedure in BI 7.0
Thanks

BI Authorisations

Hello All,
I am attempting to use the five authorisation DSO's for HR (0TCA_DS01 to DS05). The problem is DS05 creates the users in the BI system. For this I am using a flat file to load. It does appear to be creating the users in BI i.e when i go to su01 the user is not present, but when I check the table of users, the user is there, but is not active, therefore I can not see the user in su01.
Any ideas on how to resolves this?
Thanks,
Nick.

Chk this:
http://help.sap.com/saphelp_nw04s/helpdata/en/80/1a68b4e07211d2acb80000e829fbfe/frameset.htm
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a6c54319-0e01-0010-20a4-fb81ad32f330
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/659fa0a2-0a01-0010-b39c-8f92b19fbfea
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/ded59342-0a01-0010-da92-f6b72d98f144
Thanks

Authorising computers

hi
is there any way to see the computers that have been authorised to connect to your account?.. because there are more than i remember and i want to deauthorise them!
thanks!

You can only deauthorise a computer you have access to. You cannot deauthorise or list other computers.
If you have used all 5 authorisations an option should appear in your store account allowing you to deauthorise all your PCS. You can only do this once a year.
Sometimes you can end up with multiple authorisations on one PC. To check for this deauthorise you PC repeatedly until you get the message that the computer was not authorised, then reauthorise.
If you reinstall Windows and you did not deauthorise your PC first, you will use up an authorisation but you can't do anything about that until you have used all 5.

Regarding the analysis authorisations.

Hi experts,
I was new to concept analysis authorisations .Actually i am creating the authorisations for the company code we are having 10 company code among that one for 1100 i am creating the authorisations for to restrict the data of the 1100 to an particular user .Using the analysis authorisations i created and passed the parameters 0tctactv ,....ect like this on which infoprovider,and on which company code i am making the restrictions to the particular user .when i am executing the particular user all the reports what ever it is having on the cube is comming but here i need to get the report based up on only the company code 1100 .but i dont need the data from the 1000,2000,like that for that user.can you tell me experts where exactly i am doing the mistake .if it is possible can you give me the screen shots for the analysis authorisations .
bye.

Hi,
Use following link to create role and auth object
http://help.sap.com/saphelp_scm50/helpdata/EN/0c/515bb287fe41829556fb4227820e52/content.htm
Regards
Pramod

Mod_ntlm/AD/LDAP How is the users password recovered and used.

I have an application that currently uses LDAP authenticationand authorisation based on a username and password derived from the page 101 login screen. I am trying to convert it to a SSO solution using mod_ntlm to retrieve authenticate the users windows login against Active Directory. I authenticate fine with a standard mod_ntlm page sentry letting me access the application and I can use the owa_util.get_cgi_env('remote_user') to get the username. What I haven't established is how to retrieve the users password to pass as a parameter into the existing LDAP authorisation functions.
I've based a lot of the ground work on the following article
http://withasmiletomeltathousandhearts.wordpress.com/2009/01/29/apex-windows-integrated-authentication/
However, this relies on a prestored LDAP_user and LDAP_Passwrd to retrieve data from AD. Rather than doing that I am trying to use the currently logged on user, whose login name I can retrieve but I have not found a way to retrieve and use their password?
What am I missing?
Thanks in advance
FunkyMonky

My question is regarding how to use LDAP to retrieve the users AD group information. mod_ntlm has successfully authenticated the windows user to get into the application without having to login. I now want to implement the applications functionality based on that user's Active Directory groups. Prior to the ntlm solution this was done with using LDAP with the authorisation and the credentials were available from the user manually logging on.
The LDAP group determining method I referred to in my original post relies on a stored user to access the LDAP information rather than the actual logged in user as we had originally done it. Is this the only way we can implement our group based authorisation requirement?
Cheers
FunkyMonkey

Use of ":", "#" in authorisations

Similar Messages

Maybe you are looking for