topic Re: User Level Authorization in Position Based Security in Application Development and Automation Discussions

User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 04:27:59 GMT

Hi Geeks,

I'm facing a problem in restricting a user accessing from another users data.

Let me give you a picture of my issue.

I have assigned a position based role to a Position XXXXX, while XXXX is accessing his data, he is also able to see the data of User YYYYY, but as per my client requirement, User XXXXX can only see the data of his own, not other users.

Can you please let me know how to restrict this.

<removed_by_moderator>

Thanks

Venkat

Edited by: Julius Bussche on Jun 4, 2009 8:44 AM

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 04:38:02 GMT

Venkat, can you be more specific ?

Roles may be assigned to position but that itself wouldn't restrict the access, it is the authorization within the role that gives access to data.

Cheers !!

Zaheer

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 04:58:26 GMT

Zaheer, thanks for the quick reply,

here it goes. my client implemented SAP TV, & user X logs his expenses, while other users do.

but when User X is accessing his data (Expenses) he is also able to see the expenses of User Y.

I have used the Auth Obj, F_TRAVL_RW, TV_CREAT, TV_EVSIM, also assigned a T.Code KSB1/KOB1.

Let me know if u need more details.

Thanks,

Venkat

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 05:55:24 GMT

Hi Venkat,

Try restricting on P_PERNR, i don't have an HR system to check in, though i recall, P_PERNR should be able to restrict users on their own personnel numbers for the expense infotypes.

Cheers !!

Zaheer

Re: User Level Authorization in Position Based Security

Hank — Thu, 04 Jun 2009 14:33:44 GMT

Venkata, are you using Structural Authorization? You may want to look in to assigning structural authorization using PD Profiles.

Maintain Evaluation Path

Maintain Structural profiles

- rh_get_manager_assginment

- rh_get_org_assignment

"while XXXX is accessing his data, he is also able to see the data of User YYYYY, but as per my client requirement, User XXXXX can only see the data of his own, not other users."

Sapsec-HB

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 15:23:43 GMT

Hi Venkat

If user X is able to view data for another user it is probably the P_PERNR object. Try Interpretation of assigned personnel number (I) which allows users to view data for his own records. Structural auth will control the Org assignment however accessing Infotypes or data will be controlled by P_ORGIN /P_PERNR.

Let us know

thanks

santosh

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 16:09:14 GMT

> If user X is able to view data for another user it is probably the P_PERNR object.

That is the exact opposite of what P_PERNR does...

Probably P_ORGIN is proving the access via some other role assignment, or indirectly via a reference user.

Cheers,

Julius

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 16:19:03 GMT

thanks Julius

I meant to convey P_PERNR controls to update persons own data. like user cannot update his own basic pay. you are correct it is P_ORGIN ...my bad on the P_PERNR

thanks

santosh

Re: User Level Authorization in Position Based Security

Hank — Thu, 04 Jun 2009 16:37:06 GMT

Here is my understanding...

p_orgin providing access to infotyes with this object automatically gives access to both own user's reocord and the other employee records.

p_pernr when this object is present, including infotypes in this object allows you to control access to own record only(I), or other employee records only(E) excuding own.

Sapsec-HB

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 16:49:32 GMT

> p_pernr when this object is present, including infotypes in this object allows you to control access to own record only(I), or other employee records only(E) excuding own.

Stated like that it could still be misleading.

E does not grant access to other employees records. It only means that if the user already has access to other employees records (via P_ORGIN...), then this authorization will exclude their own personel number from that authorization, even although they have the access.

This can be usefull, for example to prevent the HR department from changing their own basic pay without stopping them from giving you a raise or a bonus...

Cheers,

Julius

Re: User Level Authorization in Position Based Security

Former Member — Thu, 04 Jun 2009 16:51:55 GMT

Thanks a bunch, Guyz, will mark it solved, once I try with the solution given.

Regards,

Venkat