Variables in Authorizations

Question

Hello Gurus,
       I hope you can help me with a problem. We use BI7 and at the moment we have 3 authorisation relevent objects Sales Office, Cost Centre and Sold To. We load this data via spreadsheets for each user, some will have a * and some will have restrictions based on values (certain Sold To's or Sales Offices etc. However, we would like to introduce a new authorisation object called Ship To. There is a one to many relationship between Sold To and Ship To held in a table called ZCUST_SLS. So, instead of creating another spreadsheet for Ship To and loading this, I would like to explore using a variable to determine Ship To's from the Sold To using a customer exit variable in RSECADMIN.
          I know that the variable will be of the format $<variable_name> and will be created in CMOD using enhancement RSR00001 for the necessary coding, but what I would like to know is how do I reference the Sold To for this user to be able to determine its relavent Ship To.
For example
User DJONES
Current Authorisations
Sales Office *
Sold To 1234567
Cost centre *
I would like to add a new Auth object called Ship To using a customer exit variable which uses abap code to look up the table ZCUST_SLS to determine the Sold To's,
many thanks

Answer 1

HI,
Authorizations with Variables
Definition
Instead of using a single value or interval, you can also use variables of type customer exit in authorizations. The customer exit is called for these variables while the authorization check is running. The call is carried out with I_STEP = 0. The intervals of characteristic values or hierarchies for which the user is authorized can be returned here. By doing this, the maintenance effort for authorizations and profiles may be considerably reduced.
Every cost center manager should only be allowed to evaluate data for his/her cost center. Within the SAP authorization standard, a role or a profile with the authorization for the InfoObject 0COSTCENTER equal to u2018XXXXu2019 (XXXX stands for the particular cost center) would have to be made for every cost center manager X. This has to be entered in the user master data for the cost center manager. In organizations where cost centers change on a regular basis, this involves significant administrative effort.
Using a variable reduces the authorization maintenance workload with the InfoObject 0COSTCENTER equal to u2018$VARCOSTu2019, as well as with the role or the profile, which is maintained for all cost center managers. The value of the variable u2018VARCOSTu2019 is then set for runtime during the authorization check by the CUSTOMER-EXIT u2018RSR00001u2019.
Maintaining the authorizations restricts the entries for the values to the length of the existing InfoObject. It is possible, however, to use both limits of the interval. In the example 0COSTCENTER with 4 spaces, the variable u2018VARCOSTu2019 is, therefore, entered as u2018$VARu2019 u2013 u2018COSTu2019.
Use
Exit variables can be entered beginning with $. If there is a variable value in both the lower and the upper limit, the two are combined as subnames of an overall variable in authorization processing. Intervals are not corrected automatically by the system if an error was found during the check. You get an error message and can analyze the error yourself.
There is a buffer for these variables. If this buffer is switched on, the customer exit is only called up once for a variable with the authorization check. In doing so, you avoid calling up the customer exit for variables over and over, as well as decreasing performance. If you want to call up the customer exit each time, you have to deactivate this buffer in the maintenance of analysis authorizations. To do this, in the main menu, choose Extras ® Buffering Variables ® Deactivate.
You can also call up the customer exit for authorizations for hierarchies.
Enter the variables of type hierarchy node into an authorization. To do this, in the hierarchy authorization maintenance, under Node, choose a variable with  Select Exit Variable. The customer exit is then called up while the authorization check is running. In the return table E_T_RANGE, the technical name of one or more nodes is expected in the LOW fields. In the HIGH field, the InfoObject type of the node is expected.
Tarak