User Maintenance

Hi
One of the user has a problem while accessing a report:
When the user access one of the report she gets a screen with only 2 selection criteria to execute the report, but that report should give 6 selection criterias i.e company code, posting date etc.
When I accessed the report I got all the 6 selections to execute.
I dont know how to solve this problem
Any suggestions will be appreciated
Thanks in advance

Hi .......
This is related to authorization problem.......Compare your and that user's profile......
SU01: User Maintenance (creating users, maintaining user specific data like address, password...)
PFCG: Role Maintenance (creating roles, maintaining authorizations...)
Also check this link :
http://help.sap.com/saphelp_nw70/helpdata/en/80/1a6859e07211d2acb80000e829fbfe/content.htm
Regards,
Debjani......
Edited by: Debjani Mukherjee on Sep 26, 2008 1:06 PM

Similar Messages

Removing the responsbility of user maintenance from the DBA

Suppose you were working with a customer whose DBAs refuse to be involved with user maintenance, i.e. creation and deletion of users, password maintenance, role and privilege assignment etc. What technology and/or approach would you recommend?
Some random thoughts along this line:
1. Ask the DBA to create one user with CREATE USER and ALTER USER privileges, and give that user access to SQL*Plus so that he can run the queries to create and maintain users himself. Obvious downside: Someone else has to know SQL, at least a few SQL statements, or have a custom user interface built for them that wraps the SQL statements. Is this really such a bad solution?
2. LDAP or OID. I don't understand enough about either of these two technologies to truly be able to discuss the pros and cons. How exactly do they work in a Windows network envionment, perhaps one with or without Active Directory and/or Windows Groups? Can they really allow someone other than the DBA to create users, maintain passwords and maintain roles and privileges? If so, doesn't the person in charge of assigning roles and privileges to users have to have CREATE USER or ALTER USER privileges anyway? Really, why would this be such an improvement over solution #1?
3. Any other approaches and/or experiences along this lines anyone wouldn't mind sharing?
Appreciating any and all insights,
DTXCF

THanks sybrandb.
On #2, suppose the application is set up in such a way that by default all of the security is handled in the database, i.e. when the application is installed and the scripts run to create the database it creates roles like these:
cst_role_product_editor
cst_role_product_admin
cst_role_product_viewer
cst_role_order_viewer
cst_role_order_admin
cst_role_order_editor
cst_role_store_viewer
cst_role_store_editor
cst_role_store_admin
in other words, for each object type in the database (stores, products, orders, coupons, catalogs etc.) all of these roles are created at the database level, and by default, each individual user has to be created using a CREATE USER command with the proper roles assigned.
If I take an application like this to the client and they say they want to implement LDAP and/or OID, when the people who create these users outside the database as you mention,
1) Does it create any additional actual Oracle users, and
2) Can LDAP and OID handle actually assigning these users to specific Oracle roles?
And one more question - can you explain what exactly is a proxy account to a rookie like me who thinks proxy sounds like the name of a night club you'd find in Las Vegas?
Sorry to impose so much but I do appreciate the help.

Where to see the user maintenance activity log (creation,deletion..)?

Hi, SDN Fellows.
This should be a Basis question. But I only able to find this category (Netweaver AS) to write this post.
Our current user management engine is taken the user data source from the ABAP System (CRM system).
I know that I can do the user maintenance tasks through TCode: SU01.
I just wonder where I can see the log for all the user management activities, i.e. 1) User account creation; 2) user account deletion; 3) user profile modification and etc for particular period.
Another question, can I see this activity through portal too? Assuming I am having Super Admin role portal.
Thanks,
Kent

Hi Kent,
You can view the information in SU01-->Information----> change documents for the user your 1,2, and 3 can be viewed here.
This information you can't see in the portal even you had super user access.
Regards,
Hari.

"System is not a child system in central user maintenance network" problem

Hi ppl,
I have added one new role for a user id. After that, I log on using that user id. However the message "System is not a child system in central user maintenance network" appeared. What has happened and how to solve the problem? Thank you.

This error message occurs when a user tries to logon to the CUA master system and when his account is not assigned to this logical system (see SU01: tab "systems", displayed only in the CUA master system).
You need to define the CUA master system also as CUA client system and assign that system to the user master record; otherwise the user cannot logon to the CUA master system.
Regards, Wolfgang

Mass User Maintenance in Portal

Hi All,
is there a way to do mass user maintenance in EP (7.01) just like we use SU10 in the ABAP stack? We need to change the user mapping for system access for all users (400+) for MDM catalog integration.
Any help is appreciated.
Marco

Hi Pavan,
If your requirement is just to assign user groups to a single user who exists in the Portal, you can do that through Identity Management by searching for the user and by modifying the assigned groups.
If the user does not exist in the Portal and you wish to import the user and assign the groups simultaneously, you can use the Import feature of UME. Using the import functionality, all the user information will get imported, including the roles and groups assigned. Please refer to the below format:
[User]
uid=userid
last_name=Lastname
first_name=Firstname
language=en
accessibility=0
role=pcd:portal_content/com.sap.portal.xxx;
group=Administrators;
Hope this helps!!!
Regards,
Anurag

Need SMTP_ADDRESS Mandatory on New User Create/User Maintenance

Is there a way to require entry of email address upon new user creation or user maintenance without an ABAP enhancement?
It appears that function module ADDR_PERS_COMP_COMM_MAINTAIN writes email address to database for users, but before I try to enhance the code, I'd like to see if this is a change that can be made without code modifications.
Use of report RSADRCK7 is not feasible; users would need to be done one at a time.
This requirement would apply only to functions (SU01) by BASIS/Security; users must remain unable to maintain their email address via System>UserProfile>Own Data.

> enhancement inserted for SU01, screen 0900, to error when SZA5_D0700-SMTP_ADDR is initial, in SAPLSZA5, form D0700_OK_CODE.
If that does not work, then the easiest option is a check after the user creation to verify that all users who are meant to have an SMTP entry in the address data, also have one (from the correct domain, etc...).
Alternately, you can create a standard transaction variant for SU01 and change the screen of the address data tab. When saving (or proceeding to the next screen), the address data must have been maintained.
The first option is certainly much easier and less intrusive to implement...
Do you also use self-registration scenarios? Is that the reason for your question?
Cheers,
Julius

Gateway user maintenance for FIORI app

We are currently in the process of implementing FIORI and are working into the user creation on the Gateway.   We do not want to turn on AE because we do not want it to be visible to users.   From our analysis, there does not seem to be a standard process.   We are going to develop a new auto role maintenance process.   We want only the relevant tiles to display based on the user's role(s).
We came across this Note:
Note 1868136 - Adding tiles to Fiori Launch Pages without PFCG
Solution
This note describes a way, how the set of tiles enabled for a specific user by implementing a BAdI.
In this BAdI implementation you change the list of catalog provider nodes extracted from the
standard menu tree based on the current set of roles assigned to the user. You can remove existing
entries or add new ones.
To accomplish this, please perform the following steps:
1. Apply Netweaver UI AddOn 1.0 SP08 or, alternatively, apply the correction instructions of
this note.
2. Copy the class /UI2/CL_ROLE_EXT_CATALOG_PAGES to a page in your package and namespace, e.g.
ZCL_ROLE_EXT_CATALOG_PAGES
3. Create a BAdI implementation of the BAdI definition /UI2/BADI_NWBC_RT_EXTENSION, named e.g.
ZNWBC_TREE_EXT_BI
4. Assign the copied class to this BAdI implementation
5. Change the method ZCL_ROLE_EXT_CATALOG_PAGES->GET_CATALOGS. The source code contains some
template code meant to guide you in this task.
We tried implementing ‘/UI2/BADI_NWBC_RT_EXTENSION’ BADI in gateway system as per the instruction
given in the note and kept a breakpoint and launched the Fiori launch page. But
BADI was not triggered.
There is no information on; when and where this BADI
will be called by gateway system.
Can anyone give more information on this Note, BADI, or the Gateway user maintenance process for FIORI?
Is the custom solution the best way to do the user maintenance?
Thank you,
Judy
Tags edited by: Michael Appleby

Hi Masa,
    Right now we have only tested the PR approval in FIORI and are getting ready to implement that. We are looking at the best way to do user maintenance in the Gateway for FIORI.   We have designed a custom solution but were wondering if the Note above will help us implement a better solution.
    The requirement is to show the relevant tiles to a user based on their role in the application. Ie. for PR approvals, if they have the approver role(s) in ECC then they should see the PR approval tile in the FIORI launchpage.
    What are you referring to when you say 'catalogs and Groups'?
Thanks and regards,
Judy

Changing Configuration Table to user maintenance table

Hi SDN team,
I recall that there was an OSS note that described the procedure to change a table in configuration to a user maintenance table. We have a scenario where the purchasing group table is maintained via IMG and the business process wants to maintain this as a master data table. Can anyone either walk me through the process of setting this up or point me to the OSS note that references this functionality?
Thank you.
Nguyen

Communicate your approach and dont forget the newbie who may join your company in future !!!
if one is not aware that you maintain customizing tables in production, and does customizing as usual in developement system and transports the changes, then he may create a lot problems.
It happened to me personally. I was not aware that purchasing groups had to be maintained in production system as I joined a new company. (But still the request for a new purchasing group is send to IT) . so I just took the free next number in dev-system and transported to production. And here I overwrote an entry that was only present in production.........

Last Changed On field in User Maintenance

Is there any possibility to delete last record in Last Changed On field in SU02 transaction?
Where is (in what database table) this record stored?
Firstly I checked USH2-4-10-12 tables but with no luck, then I discovered that recent changes can be seen via Change Documents (Information -> Change Documents for Users). There I can see chenges but cannot delete them.
Then I discovered RSCDOK99 report that allowed their deletion but even when last record is deleted (from CDHDR) the value in maintenance window doesn't change.
What is the trick? Can you suggest the db table that stores this record?

Why do you want to Change / Delete history data?
- Abhinab

VIEW_MAINTENANCE_CALL - parallel user maintenance?

Hi there
To maintain the data within a view, I know, that the function "VIEW_MAINTENANCE_CALL'" can be used.
But the problem is, the maintenance of the data is only seriell and not parallel. (only one user at the time can work within this view in the modus change).
Is there any function or method, that alows parallel maintenance of a view?
Thanks.
Petra

I don't think so that solution is there for your question, but U can avoid using VIEW_MAINTENANCE_CALL FM when It is assigned to a transaction code. in SE93 just maintain in Default values tab:
Name of Screen field Values
VIEWNAME Z_MYVIEW
UPDATE X
just save the transaction code and execute it. It works like how U managed writing a program and calling above function module.
Enjoy SAP
K.R.Reddy

Can FDM user maintenance be automated through backend?

We have a FDM environment with 2 FDM apps for 3000 entities and about 700 users. You might have figure out that maintaining security across large number users since each one has to be done manually across both apps. Now we are about to start using FDM for our planning application and the security scenario gives us a nightmare.
Has anyone automated FDM security maintenance? Is it through APIs or SQL backend?
Any help would be really appreciated.

I have multiple FDM applications as well as a test environment. I usually sync all of the production App to the other pieces and override certain sections for instance :
A.) Production - This is production Actual Reporting App
B.) Budget - This is a Budget FDM App. I want to keep all of the users, locations, etc. However, as we use multi-load, I don't care about the individual maps. Instead I map everything to * as the multi-load templates use our HFM accounts.
I have a SQL script I wrote which copies the necessary details from A to B and then I do an update to set every location of the proper type to have a parent map for a special location I called BudgetLocation.
I also have FDM app C.) Tax
Tax is an EXACT copy of actual. The reason I keep it separate from the normal production app; however, is they load to production HFM server but to different scenarios. End users (no offense) are not aware enough to realize what Scenario (category) they are in so things get messy if we are not paying attention.
I made a more generic SQL Server Stored Procedure that copies a GOOD NUMBER (BUT NOT ALL) of the FDM tables. This will copy users, groups, locations, mappings, etc. It does not copy Categories, or other System tables (periods, currencies)
Additionally, keep in mind if you have any custom scripts, you will need to sync the /Data/Scripts folder....
If you use this, great; however, USE THIS AT YOUR OWN RISK. I AM NOT RESPONSIBLE IF YOUR SERVER BECOMES SELF AWARE AND ATTEMPTS TO TAKE OVER THE KNOWN UNIVERSE. Seriously though, use this at your own risk........ so test it. It works for me. (NOTE this works for SQL 2005 and newer only, not 2000)
-=-=-==-=-=-=-=-=
-- NOTES
-- ##TARGETDB## - Replace this with the name of the Database that you want to SYNC
-- ##SOURCEDB## - Replace this with the name of the Database that is the data source
-- disable referential integrity
EXEC sp_MSForEachTable 'ALTER TABLE ? NOCHECK CONSTRAINT ALL'
--Clear User Security
TRUNCATE TABLE ##TARGETDB##.dbo.tSecUserPartition
TRUNCATE TABLE ##TARGETDB##.dbo.tStructPartitionLinks
delete from ##TARGETDB##.dbo.tStructPartitionHierarchy
TRUNCATE TABLE ##TARGETDB##.dbo.tDataArchive
TRUNCATE TABLE ##TARGETDB##.dbo.tDataCheck
--Attempt to clear out the tDataMapSeg tables
EXEC sp_MSForEachTable '
DECLARE @TableName VarChar(100)
Set @TableName = PARSENAME(''?'',1)
IF left(@TableName,8) = ''tDataMap''
TRUNCATE TABLE ##TARGETDB##.?
GO
--Attempt to clear ou the tDataSeg tables
EXEC sp_MSForEachTable '
DECLARE @TableName VarChar(100)
Set @TableName = PARSENAME(''?'',1)
IF left(@TableName,8) = ''tDataSeg''
TRUNCATE TABLE ##TARGETDB##.?
GO
TRUNCATE TABLE ##TARGETDB##.dbo.tLogActivity
TRUNCATE TABLE ##TARGETDB##.dbo.tLogProcess
TRUNCATE TABLE ##TARGETDB##.dbo.tDataArchive
delete from ##TARGETDB##.dbo.tSecUser
delete from ##TARGETDB##.dbo.tPOVPartition
TRUNCATE TABLE ##TARGETDB##.dbo.tBhvValEntItem
delete from ##TARGETDB##.dbo.tBhvValEntGroup
TRUNCATE TABLE ##TARGETDB##.dbo.tBhvImpItemFile
delete from ##TARGETDB##.dbo.tBhvImpGroup
-- RECOPY Data from Prod DB to Budget DB
insert into ##TARGETDB##.dbo.tBhvImpGroup
select * from ##SOURCEDB##.dbo.tBhvImpGroup
insert into ##TARGETDB##.dbo.tBhvValEntGroup
select * from ##SOURCEDB##.dbo.tBhvValEntGroup
insert into ##TARGETDB##.dbo.tBhvValEntItem
select * from ##SOURCEDB##.dbo.tBhvValEntItem
insert into ##TARGETDB##.dbo.tBhvImpItemFile
select * from ##SOURCEDB##.dbo.tBhvImpItemFile
insert into ##TARGETDB##.dbo.tPOVPartition
select * from ##SOURCEDB##.dbo.tPOVPartition
insert into ##TARGETDB##.dbo.tStructPartitionHierarchy
select * from ##SOURCEDB##.dbo.tStructPartitionHierarchy
insert into ##TARGETDB##.dbo.tStructPartitionLinks
select * from ##SOURCEDB##.dbo.tStructPartitionLinks
insert into ##TARGETDB##.dbo.tSecUser
select * from ##SOURCEDB##.dbo.tSecUser
insert into ##TARGETDB##.dbo.tSecUserPartition
select * from ##SOURCEDB##.dbo.tSecUserPartition
--Attempt to import data
SET IDENTITY_INSERT ##TARGETDB##.dbo.tDataMap ON
insert into ##TARGETDB##.dbo.tDataMap (PartitionKey, DimName, SrcKey, SrcDesc, TargKey, WhereClauseType, WhereClauseValue, ChangeSign, Sequence, DataKey, VBScript)
select PartitionKey, DimName, SrcKey, SrcDesc, TargKey, WhereClauseType, WhereClauseValue, ChangeSign, Sequence, DataKey, VBScript from ##SOURCEDB##.dbo.tDataMap
SET IDENTITY_INSERT ##TARGETDB##.dbo.tDataMap OFF
-- Update parent locations ...
-- This is used for my budget copy to get every location working for multi-load * mappings
--update ##TARGETDB##.dbo.tPOVPartition
--set PartParent = 'BudgetTemplateLoc'
--where
--PartName <> 'BudgetTemplateLoc' and PartControlsType = 1
-- enable referential integrity again
EXEC sp_MSForEachTable 'ALTER TABLE ? CHECK CONSTRAINT ALL'
GO

ESS User maintenance by T-code HRUSER - User ID change

Hi,
I have been creating ESS users ( P Users ) by T-code HRUSER. For instance, there is an employee number 5. It does two steps for us.
1. Creates R/3 user as P00000005.
2. Maintains system user name at IT 105 as P00000005.
But, now I need to change the user id format created by HRUSER. I need to create using only alphabets Eg. GEORGEME.
Please let me know how to achieve this.
Thanks.
Suganya

Did you figure out how to create users using different user id? If you have can you update thread.
Thanks,
Joe

LDAP + User maintenance

Dear all,
One of our outsource Basis consultant recommends to configure the As ABAP system to LDAP directory.
When we configured LDAP, could we maintain the users in the transaction SU01? or SAP trusts the LDAP user management therefore the user cannot be maintained anymore in SU01?

Users are still maintained in SU01, you can "replicate" them to the LDAP sever using transaction LDAP.
Markus

User Maintenance after HR-Org replication

Dear Community,
in a sandbox environment I am currently evaluating HR-SRM Org recplication connecting SRM 6.0 to a copy of an existing HR-system.
I already learned that after active HR-Org replication, I will need to maintain my users in HR directly.
Problem: I know SRM very well but have no clue about HR.
Anyone can tell me which transactions in HR to use to maintain an employee in a way that it will be usable in SRM after replication? I use ECC 6.0 based HR. Alternatively a useful link to the right note or documentation page is highly appreciated.
Thanks and greetings, Julian

Hi
Please check SAP OSS notes 550055 et 934372 that explain everything
Please refer note no.312090 ,this is a primary note.You can get link for other notes.
There is also a document called TRANSPORTINGEBP_14.pdf in http://service.sap.com_
Use the search engine to find this official document.
Note 447651 Transporting EBP Systems and organisation modell will point you to the document in service.sap.com. Do not be misslead with the name of the document.
Please use SAP OSS note 550055 EBP/CRM: New integration for business partner. - Using classic scenario with separate HR system and you will found this note very useful. In related notes part you can find other useful notes.
Also, you need to set a distribution model from HR to SRM for HRMD_ABA message, and set numbering range for org units to be the same in HR and SRM system (Tcode OONR).
Please try these Very helpful links ->
Re: HR-SRM question
R/3 to SRM
Till SRM4.0, SRM supports only 1:1 positions :user, while SAP HR Org.Structure supports 1:n.
But SRM5.0, Org.Structure supports multiple assignments like in HR. So distribution of HR Master Data/Org.strcture from SAP HR to SAP SRM is better with SRM5.0.
Also see; if this will help, but have a look at note 391085 and report RHALEHRMDORIGXPERT.
Hope this will help. Do let me know.
Regards
- Atul

SAP User Maintenance Against SAP License

Hi Everyone,
I would like to ask for an assistance regarding sap user. This is the scenario: The company has Employee A which was given sap userID with corresponding roles/profiles. Correct me if I'm wrong, the sap license depends also on the number of user in sap system. On this company, they reached the limit of their license according to number of user, for example 400 user. Suddenly, Employee A resigned. New employee came, Employee B which will replace the job doing by Employee A. If we add another userID on sap system, the number of user will be 401 which exceeded the max user based on the license agreement. One way to solve this issue is to delete the userID as well as the profiles of Employee A and create new userID and profile of Employee B. Another way is to change the userID of Employee A and used its profile to Employee B. Is there available documentation from SAP supporting the above procedure?
Regards,
Ronald

Licensing is based on active users. So if you lock user A, set its validity date to the day he/she left and take away the roles and profiles this user will not count for your licenses anymore sou you can safely create a new account for user B.
Deleteing users can cause issues in workflow related proceesses and troubles searching in change documents. There have been some discussions about this in the Netweaver forum.

User Maintenance

Similar Messages

Maybe you are looking for