topic Re: Authorisation question (basic) in Application Development and Automation Discussions

Authorisation question (basic)

Former Member — Tue, 16 Mar 2010 14:23:38 GMT

Guru's,

A small authorisation question...

User A can change documents of cc 1000

User B can change documents of cc 2000

Now we want to give both users also display rights to the other company documents.

User A can change documents of cc 1000 and view documents of cc 2000.

User B can change documents of cc 2000 and view documents of cc 1000.

Is this cumulative? According to SAP rules can user A now CHANGE documents from cc 1000 AND cc 2000?

Can someone verify this?

Thanks,

Kris

Re: Authorisation question (basic)

ramesh_mahankali — Tue, 16 Mar 2010 14:26:10 GMT

no..user A can not change in both company codes. He can change in the CC where he has ACTIVITY = 2(change) in authorizations.

Hope this helps.

Ramesh

Re: Authorisation question (basic)

Former Member — Tue, 16 Mar 2010 14:29:03 GMT

Try to assigne the authorization object twice:

- the first one having DISPLAY as only action

- the Second one having CREATE/CHANGE as only actions

Max

Re: Authorisation question (basic)

Former Member — Tue, 16 Mar 2010 14:39:41 GMT

so there's no talk about cumulation of activities?

User A - CC 1000 & 2000 - Activities 1 & 2

User B - CC 1000 & 2000 - Activities 1 & 2

So both users max activity in both CC's.

Does anyone have proof or facts on this please?

Re: Authorisation question (basic)

Former Member — Tue, 16 Mar 2010 15:08:16 GMT

The activities aren't accumulate, but just as I said you need to use the same object several times with different activieties.

I've create a test profile with the object FI_BKPF_BUK, I use it twice:

- A) Activity: 03, BUKRS = A

- B) Activity: 02, BUKRS = B

Then I've created a report in order to test this profile:

.parameters: p_buk type t001-bukrs.

AUTHORITY-CHECK OBJECT 'F_BKPF_BUK'
         ID 'BUKRS' FIELD p_buk
         ID 'ACTVT' FIELD '03'.
write: '03', sy-subrc.

AUTHORITY-CHECK OBJECT 'F_BKPF_BUK'
         ID 'BUKRS' FIELD p_buk
         ID 'ACTVT' FIELD '02'.
write: / '02', sy-subrc.

If I run (for a particular user having the profile above) that report for the company code A the result is:

03 0

02 4

If I run it for the company code B:

03 4

02 0

Max

Re: Authorisation question (basic)

Former Member — Tue, 16 Mar 2010 15:28:09 GMT

Thanks !