topic Re: Role authorization for FAGLB03 in Application Development and Automation Discussions

Role authorization for FAGLB03

john_pietrowski2 — Mon, 23 Aug 2010 18:16:31 GMT

I am trying to create a role the only contains FAGLB03 and I would like to be able to restrict which accounts and comany(s) the user can see. When I create the role there are no authorization objects associated with FAGLB03 so I cannot restrict it. Is it possible to do this, and if so how?

Re: Role authorization for FAGLB03

Sri_S1 — Mon, 23 Aug 2010 18:57:33 GMT

Hi John,

FAGLB03 transaction is same as FS10N, Add FS10N instead of FAGLB03.

Thanks,

Edited by: sun on Aug 23, 2010 8:57 PM

Re: Role authorization for FAGLB03

Sri_S1 — Mon, 23 Aug 2010 19:05:43 GMT

Hi John,

you need to maintain Values in SU24 , if you want to see them inside the role.

Thanks,

Re: Role authorization for FAGLB03

john_pietrowski2 — Mon, 23 Aug 2010 19:13:23 GMT

this is great, but it only allows me to restrict by company, so I am half way there.

Re: Role authorization for FAGLB03

john_pietrowski2 — Mon, 23 Aug 2010 19:16:24 GMT

Could you give me specifics for restricting accounts also. I am new at this, and I have never worked with SU24

Re: Role authorization for FAGLB03

Sri_S1 — Mon, 23 Aug 2010 19:24:54 GMT

Hi John,

Go to SU24 and type in transaction FS10N and activate the ones you need. inorder to know what needs to be activated run the transaction and see what object it is checking and activate those in SU24.

Thanks,

Re: Role authorization for FAGLB03

Sri_S1 — Mon, 23 Aug 2010 19:27:35 GMT

Hi John,

go to"A collection of threads: FAQ's, intros and memorable discussions " in this forum and you will find good documentation on SU24

Thanks,

Re: Role authorization for FAGLB03

Former Member — Mon, 23 Aug 2010 20:05:51 GMT

Enable the below objects for company code related fields

in SU24 for transaction FAGLB03

F_BKPF_BUK

F_SKA1_BUK

also follow the instruction regarding how to use SU24, as posted by others

Re: Role authorization for FAGLB03

Former Member — Mon, 23 Aug 2010 21:11:50 GMT

Note that F_SKA1_BUK (and more likely F_BKPF_BES in this case) is only exclusive if you have protected the master record.

If you have not, then it is an "optional" object as documented in SU21 - the check is suppressed.

So, the intention is to protect accounts at the master record level and only then can you grant access selectively.

Cheers,

Julius

Re: Role authorization for FAGLB03

Former Member — Mon, 23 Aug 2010 21:20:28 GMT

Also note that PFCG recognized Su24 proposals of parameter transactions. If not found in the calling tcode, the parameterized tcode will be evaluated for proposals.

So you need to make a decision here as well (from the view of the role build).

It is an art form...

Cheers,

Julius