topic BI Secrity issue in Application Development and Automation Discussions

BI Secrity issue

Former Member — Mon, 26 Apr 2010 09:40:55 GMT

Hi All,

If I give a : for a particular infoobject in an anlaysis authorisation and in another analysis authorisation the value of that same info object is * then will we have full authorisation or intersection where : will be effective and hence we will not get the detailed result.

Regards

Wajid

Re: BI Secrity issue

Former Member — Mon, 26 Apr 2010 14:36:26 GMT

Hi Wajid,

As per my view systemwill check the restriction on aggrefation level first and then populate the report on aggregation level.

Better if you check this with test case.

Re: BI Secrity issue

Former Member — Mon, 26 Apr 2010 17:13:22 GMT

Wajid,

Is the restrictions on the InfoObject for the same InfoProvider? If they are for the same InfoProvider but in different analysis authorizations they will merge and consolidate on run-time per SAP optimization. Additionally if the InfoObject is shared between MasterData objects it will have the same behavior. (ie 0ETHC_ORGIN used in 0EMPLOYEE and 0VENDOR) since its a shared master data object giving someone access to 0ETHC_ORGIN anywhere will grant access to both 0EMPLOYEE/0VENDOR if user has authorization to either.

Hope that helps or provide more details if still stuck.

Thanks.

Matt

Re: BI Secrity issue

Former Member — Fri, 14 May 2010 10:56:59 GMT

Hi Wajid

It is indeed a interesting question as in R3 it access provided will be the intersection of two auth objects. However in BI it is the other way around.

If one Analysis Authrization(AA1) has a " : " for a particular infoobject and in another Analysis Authorisation(AA2) the value of that same info object is " * ". If both analysis authrization objects are assigned to the same user then user will be able to view the entire data for the Infoobject. I am already using a similar scenario which provides full access for the info object to the users.

Thanks.

Anjan

Re: BI Secrity issue

Former Member — Fri, 14 May 2010 11:39:09 GMT

Hi Wajid,

This is the key difference in the earlier concepts of BW3.0 and BI . In BW, the authorization was provided as an "intersection" of Authorizations but in BI the union of the "authorizations" is provided .

Hope this helps.

Regards,

Manisha