Workflow Authorization Modules

Can anyone recommend any good sites or papers or anything on creating WorkFlow Authorization models? We're building a web-based workflow application and are exploring different methods of building a flexible authorization system for different user's, roles, actions and tasks. Any help would be greatly appreciated.

Hi psummers8,
Why should you not treat this 'Authorization' only? And put in the Workflow related critirieons into the Authorization module. Thereby you may take advantage of the generic standards associated with 'Authorization'. Besides, you can also use the current technologies, tools for web based security for Confientiality and Authentication.
Have a look at http://www.wfmc.org/.
Rajesh
Note: You can get more answers if this question is posted in the appropriate forum. That is security forum.

Similar Messages

Trigger a workflow from module pool screen at save button

Hi,
I am new to workflow.Please help me.My requirement is trigger a custom workflow from module pool screen at save button.
Scenario is: Create a Z screen for material creation and after pressing save button workflow should trigger to approver and approver emailid should be fetch from Z table and have to provide a link in work flow for Z t-code which displays a report of material pending for approval..
Please suggest me process how i can acheive this..
Thanks

Hi,
If you're using standard bapi's to save the material, you can then use either the standard events which are already triggered or you coul add a change document for material changes or creation.
Then this event can be the trigger of your custom workflow.
Kind regards, Rob Dielemans

Workflow authorization for PS

Hello SAPians,
I am looking for some information regarding a workflow which is creting issue.
Issue is:
workflow has been created and this is the information of that.
**''Description**
**This workflow is triggered when a user attempts the release of an activity within a network contained in a project in the PS Module.**
**The workflow consists of three different authorization levels. All three levels must approve the release of the activity in order for this action to be available to the initiating user to carry out. If all three authorizations are granted, then the initiating user receives notification of this and is then allowed to release the activity in the corresponding transaction.**
**Furthermore, if an authorization fails to be given, the initiating user and any users corresponding to previous levels of authorization receive a notification that authorization has not been granted to release the activity.''**
But that workflow for authorization is wrongly sent to the wrong person who is not involved in that type of workflows.
Please let me know where I can check this?
Please let me know how I can proceed further in this regard. .what could be a solution for this?Please let me know the path for configuring this approval process route.
Please let me know if you need any information.
Regards

Hello,
I am not much aware of the workflow.Can you please let me know where I can check the table for configuring the user's.
Please let me know the Table and configuration details where I can check the PS Configurations and data relating to workflows for PS.
Thanks for your time in checking the issue.
Regards

Workflow function modules

I have a problem in my workflow email
creator submitted a request to approver through workflow.
work flow needs to send an email to approver that part is working fine for me.if request approved or rejected workflow needs to send an email to creator that part is not working for me.
is there any function module or class to send email to creator if something is there please let me know.
Thanks,
Message was edited by: priya katragadda

Hi Priya,
You can create a worflow container element which will have ID of request creator.
Pass this element with value of request creator as input to your task which will send mail. Your task have to used requestor ID to determine whom to send the mail.
Since you have already done half part ie. to send mail to Approver it will not be uch difficult ot send mail to Request Creator.
Regards,
Pl. reward useful replies.

Send ABAP Report as an Attachment with Workflow Function Module

Hi all.
Hopefully someone ever experienced with this requirements.
My requirements to send ABAP Report result to user as an attachment. Together with this attachment user need to receive work item/notification. Single workflow task has been defined based on SELFITEM object type to send workflow notification and its attachment.
Function module for this requirement is SWU_START_WORKFLOW. And this function module provide table parameter ATTACHMENT_LIST.
My question how to pass this ABAP report result/ ABAP internal table into this ATTACHMENT_LIST?
Thanks in advance

check the help on the SUBMIT statement ther are options to write the report to memory or spool.
Kind regards, Rob Dielemans

Query on Workflow/SRM

Hi All,
I have a query on workflow/SRM.
Recently our client upgrade from 4.6c to ECC 6.0 and we are facing with the below problem after the upgrade.
Users create Purchase Orders through shopping carts in SRM system; requisitioner will receive a notification mail on creation of PO in the backend system. When the shopping cart is converted as PO (after releasing from sourcing), a workflow is getting triggered in backend ( ECC 6.0) which sends the PO notification mail to the requisitioner. In that notification mail, the Cart No and Cart Description is missing for the PO. This issue occurs only after the upgrade. We have analysed, it is because of the delay to update the PO number on the shopping cart, which happens with the help of batch job CLEAN_REQ_REQ_UP which is running for every 5 minutes in SRM system. To confirm this we had included Wait Statement in the workflow function module which will delay the work flow by 5 minutes and the workflow is running fine now. But I want to know whether the above change will affect the performance of the production system, since this make the workflow wait for every PO. Also as an alternative we are thinking of manual triggering of workflow using batch jobs instead of automatic.
Please advice which is better in terms of system performance and maintenance.
Regards,
Rag

I'll suggest to add a background step to verify if the PO has been created instead of waiting. BCOZ if the PO has been created and it is in last few seconds of next scheduled run of the this report, it has to still wait for atleast 5 minutes.
Regards, IA

How to create and configure a custom authorization service

Anyone has any idea how to create a custom authorization module? Can anyone tell me where can I find a documentation or some example how to do it?
I appreciate any idea.
Regards.

The Access Manager developer guide on the Authentication SPI should be all you need to get started
http://docs.sun.com/app/docs/doc/819-4675/6n6qfk0nf?a=view

What is Material master workflow

Hi gurus ,
Can anybody explain what is Material master workflow & Function Module ?what is its use?
Dev
Edited by: dev .. on Oct 15, 2008 8:21 AM

Dear,
You can find much info about workflows at: http://www.erpgenie.com/workflow/index.htm
http://help.sap.com/saphelp_46c/helpdata/EN/04/926f8546f311d189470000e829fbbd/frameset.htm
Workflow is a tool for automating the business process so that the process itself flows smoothly, without bottlenecks and without dead ends. Critical parts of the process can be streamlined with deadline monitoring and contingency options. Participants are informed of milestones in the process. The process definition itself is powerful enough to allow business re-engineering with re-training and to eliminate the impact of workforce changes on the basic business process.
SAP Business Workflow is the R/3 tool for handling the process automation within R/3 or between R/3 systems and other systems involved in the business process. It is flexible enough to handle ad hoc processes such as the circulation of an electronic document. It is robust enough to handle mission critical process in the production system such as the creation of a material master.
The different R/3 applications supply standard workflows for the commonly occurring processes. Once these workflow templates are activated, they are ready for immediate use. A complete set of workflow tools, including the workflow editor and workflow generation wizard, are provided to enhance these standard workflows or create new workflows. These tools are complemented with transactions for monitoring, tracking and the statistical analysis of the processes.
Because the business process often does not step at the R/3 boundary, various interfaces and third party tools are available for extending the process across systems.
Function module
Function modules are procedures that are defined in special ABAP programs only, so-called function groups, but can be called from all ABAP programs. Function groups act as containers for function modules that logically belong together. You create function groups and function modules in the ABAP Workbench using the Function Builder.
Function modules allow you to encapsulate and reuse global functions in the SAP System. They are managed in a central function library. The SAP System contains several predefined functions modules that can be called from any ABAP program. Function modules also play an important role during updating and in interaction between different SAP systems, or between SAP systems and remote systems through remote communications.
Unlike subroutines, you do not define function modules in the source code of your program. Instead, you use the Function Builder. The actual ABAP interface definition remains hidden from the programmer. You can define the input parameters of a function module as optional. You can also assign default values to them. Function modules also support exception handling. This allows you to catch certain errors while the function module is running. You can test function modules without having to include them in a program using the Function Builder.
The Function Builder also has a release process for function modules. This ensures that incompatible changes cannot be made to any function modules that have already been released. This applies particularly to the interface. Programs that use a released function module will not cease to work if the function module is changed.
http://help.sap.com/saphelp_nw70/helpdata/EN/9f/db988735c111d1829f0000e829fbfe/content.htm
Regards,
Syed Hussain.

Keeping track of authorization(updation )

hi all,
i am working on jdeveoper with jsp. i am handelling authorization module. in this module the user will view the data and authorise. This will be updated in the database. In that i want to restrict number of authorization for each user loged on. so that the user can athorise only 10 or 20 times for each log on.
thanx in advance.
null

Maintain the number of rows updated in a session variable, and set up your sessions to expire when the browser is closed. If you want to allow the user to log off and back on again without closing the browser, then reset the count to zero when the user logs off.

Cprojects and workflow

Hi everybody,
I am working in workflow (Cproject module),
Standard business object events are not triggered,
ex: BUS2172 for project - created event is not triggered.when i create a project this created event is not triggered.
I dont know why the standard events not triggered,
I think any configuration is required, can any one help me?

Hi Camilo,
The workflow which you find in standard is e.g. TS 28700002 (Task Released). But this is send immediately when the task is released, not 2 or 3 days before it is due.
Alternatively you could use threshold values and alerting (see evaluations in cProjects). Or last not least a customer-specific program. But the two other possibiliies seem easier for me.
Best regards
Thorsten
Edited by: Thorsten Schneider on Jul 24, 2010 12:40 AM

Workflow approval for sb

I'm in the extended classic scenario. I need to check the workflow approval before of the sb saving. How table, objects contains this information?
thanks
Sabrina

Hi
What do you mean by sb ? Is it sc (Shopping cart or something else ) ?
Couple of ways to find the equired details.
1) By SRM GUI logon, incase you know the shopping cart number, using BBP_PD Transaction, you can get the complete Shopping approver details there itself.
2) By SRM Web page, if you created a new shopping cart, in the Approver Preview section, just one level above the Order button, you can see the list of managers, who will be approving the shopping cart (With their details in 2 manner - graphical/ tabular details - like name, next level approver, etc )
3) By using the Standard SRM Workflow function modules, incase you know the Shopping cart details, you can get the approver list with their names, approving limit etc.

*-- get Approval preview - on the Shopping cart applet information - Standard SRM uses this function to get the Approval preview in the shopping cart
CALL FUNCTION 'BBP_PDH_WFL_PARAM_APPLET_FILL2'
By creating a custom program, you can use the logic of fetching the approvers in advance, as done by SAP, you can get all the required details.
Refer this link for details.
Re: where i can get Badi approvers..
Try BBP_WFL_APPROV_BADI using SE18 Transaction to determine SRM N-step level Approval Workflow
Regards
- Atul

Server API for authorization

Hello,
I'm looking for something similar to FOR LOGON trigger in SQL Server, but FOR/AFTER AUTHORIZATION. I prefer solution in T_SQL. If there is any SQL Server API, to hook on event like OnAuthorization it is also OK (C++, C#, etc).
Any idea?
Thanks in advance,
DG

I need to do some work just after authorization is finished - I guess SQL Server executes query in the following workflow:
Authorize --> If user not authorized than return Exception
--> Else Parse query --> execute query --> return result
Not really. Rather then interaction between client and server is:
Client (knocks on the door): May I come in?
Server: Show me you credentials.
Client: OK, here they are.
Server: (a) Ah welcome, please come in.
(b) No, you don't belong here.
(c) Your credentials were good, but the logon trigger threw you out.
Some time passes, could be microseconds, could be days.
Client: I have a query, please run it for me.
Server: (a) OK, here is the result.
(b) Nice try, but you need to study the SQL syntax a little closer.
(d) No, you are not permitted to perform that action or read that data.
(d) Oops, I ran into a serious problem, goodbye!
The above is repeated zero to N times and eventually:
Client: Oh, gotta rush! See you later!
Server: It was nice talking to you.
That is, once the user has logged in, no further authorisation takes place except for permission checks. But there are no hooks for permission checks. Furthermore, permission checks can be performed during execution. For instance if a stored procedure calls
a second procedure that has a different owner from the first procedure, the permission check does not occur until the EXEC statement is reached.
If you explain what your really want to achieve (rather the solution you think you have), maybe we can come up with something.
Erland Sommarskog, SQL Server MVP, [email protected]

How to Generate Authorization

I have a role that was created by my predecessor. It has started to not work and returns a no authorization error now. The role is used to run a PC to upload several flat files to an ODS and cube.
How can I check the access and or generate a new profile for the needed access.
I have ZERO knowledge of BW security so step-by-step help would be nice.
Thanks
-Barnaby

Hi Barnaby,
Please refer these link about roles and authorizatons
http://help.sap.com/saphelp_nw04s/helpdata/en/52/671285439b11d1896f0000e8322d00/content.htm
To Add the T-code in new role (or which ever role you want to enter)
Go to PFCG type the role Z:xxxxxxx click on the change buttone (Pencil icon button)
You will be prompted with tabs ( description, menu, workflow, authorizations, user..)
Click on Menu Tab
You will find the Role menu tab
if you have multiple (folders) under role menu choos the Folder in which you want to add T-code "yda3"
Click on the Transaction button icon.
You will prompted with blank pop up with Transaction code and text
Just enter the T-Code in Transaction code block Ydar and click on Assign transactions (bottm left button)
You can see the T-Code ydar in the list of menu (or) in the folder which have choosen
NEXT
Go to Authorization tab
Click on Expert mode for Profile Generation (Bottom and last button)
you will be prompted with pop up with three options
choose 3rd option --- Read old status and merge with new data
Again search for the objects and values which you have noted in
If you have same values then just generate the role (shift+F5) or click on menu Authorization you will have drop down in that you will have option of generate.
once generate go back (F3).
By this you will have the T-Code yda3 in the role.
Repeat the above steps to add another T-Code to another Role.
Hope this helps,
Regards,
Karthik.
Assign points if helpful

External authorization for Adobe LC

Hello,
I'm new to LC and I'm trying to understand the authentication and authorization modules of LC. I see that Live Cycle can use external authentication. I would like to know as to whether Live Cycle can use an external authorization mechanism as well?
eg: I have a web portal that is running on CAS SSO and Spring Security. I would like LiveCycle to participate in this SSO and there by I should be able to use the common set of roles defined in Spring security to be used in LC. I see that this is possible in Rights Management module (as per the documentation), can this be applied to the whole of LC?
Any help / pointers on this would be sincerely appreciated.
Thanks in Advance.
Dheepak.

Hi there
I could only find an order for a Creative Cloud Photography plan under your account. This was started on November 7th and is billed $9.99 each month.
Did you sign up for this? What is your Photoshop order number?
Kind regards
Bev

Giving authorization for img

Hi experts
Can any one explain me how to give img authorization module wise. for example
for SD consultant should access only activity related to SD in IMG, So what can be the easiest process for it. Also it is possible to restrict them to display access ?
Awaiting for your great replies. Thanks for your help in advance

The way I usually do it is first to create an IMG project for the area that I want to restrict it to. e.g. if I wanted to create an SD config role, I would create an SD project in the IMG which will allow me to build the role
Once the IMG project is created in SPRO
1. Run PFCG, create role & navigate to menu tab
2. select menu option Utilities->customising auth
3. Click on Add and select IMG project (note: this won't work if an IMG project is not defined). Select the project that you want to build a role for & it will pull in all the respective transactions within that project node.
You will still need to maintain the auth objects but this can really speed things up.
edited to add: you can restrict them to display access by ensuring that the underlying auth objects are display only. As much of the config is dependant on table access, a fair bit of it will be controlled by S_TABU_DIS so ensure that is actvt 03 only.
Message was edited by:
Alex Ayers

Workflow Authorization Modules

Similar Messages

Maybe you are looking for