topic Re: Roles mapping for a user in Application Development and Automation Discussions

Roles mapping for a user

Former Member — Thu, 05 Apr 2007 11:20:51 GMT

Dear experts,

I have a BASIS query.

I have created a role "ABC_XYZ" which has authorization for company code - "1000" and has been assigned user "SMK001".

My query is,Can I use the same role "ABC_XYZ" assigned user "SMK002" but having authorization for different company code - "2000" only.

Can we restrict the legal entities and other business objects at user level instead of role level?

Any input appreciated.

Thanks in advance.

Re: Roles mapping for a user

former_member74904 — Thu, 05 Apr 2007 11:33:49 GMT

yes you can. by making the companycode an organizational level (SE38: PFCG_CREATE_ORG_LEVEL or something like that) and using derivation for your roles, you can quite easily make duplicates of your ABC_XYZ role (which should be the 'mother' role and make 'child' roles which only differ from the mother on organizational level(s).

http://help.sap.com/saphelp_47x200/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm

Message was edited by:

Dimitri

Re: Roles mapping for a user

Former Member — Thu, 05 Apr 2007 11:46:01 GMT

Thanks for the quick reply.

Derived role will create a new role? or The same role will be used to restrict the organizational entities?

I have requirement of not creating a different role for company code restrictions.

Please advice

Re: Roles mapping for a user

Former Member — Thu, 05 Apr 2007 11:56:01 GMT

Dear Dimitri,

I have gone through the document,It says:

" There are two possible reasons for deriving a role from an existing role:

· The role menus are identical but the authorizations for the menu actions are different in the derived role.

· The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role."

My objective is transaction used in both the roles are same...but only the org entities like company code , Plant and BA etc authorization would be different.

Re: Roles mapping for a user

Former Member — Thu, 05 Apr 2007 12:02:03 GMT

Hi Sandeep,

You can use the concept of Master/derived role to enforce organizational level restrcitions.

- Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.

- The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.

- Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.

Please visit http://www.sapsecurityonline.com/tutorials/derived_role.htm

for more info on derived roles.

I dont think that it is possible to restrict two different company codes using a same role. You will have to go for Derived role concept to enforce the org level restrictions.

Hope it helps.

Please award points if it is useful.

Thanks & Regards,

Santosh

Message was edited by:

NAVABOTHU SANTOSH KUMAR

Message was edited by:

NAVABOTHU SANTOSH KUMAR

Re: Roles mapping for a user

former_member74904 — Thu, 05 Apr 2007 12:09:32 GMT

I somehow managed to <u>not</u> read that requirement you posted

the solution I wrote will require you to make different roles for different companycodes.

the deriving part normally works as follows: when creating a new role in the first tab(description) you can specify from which role the new one should be derived.

I'm not sure how to realize this without using more than a single role, I imagine that the companycode field should somehow be dynamically changed to allow different users to get the correct access. I don't know how this can be done, but maybe someone else can?

Re: Roles mapping for a user

former_member74904 — Thu, 05 Apr 2007 12:14:24 GMT

· The menu and authorizations of the derived
role are identical, but the organizational levels are
different in the derived role."
My objective is transaction used in both the roles
are same...but only the org entities like company
code , Plant and BA etc authorization would be
different.

this is what can be done easily with the derivation principle, but if all transactions, reports etc. are identical you will end up with the same amount of roles as you have companycodes/plants/business areas or whatever field you want turned into an organizational level.

kindly ask the projectmanager to allow you to use more than one single role for this and you should be in the clear )

Re: Roles mapping for a user

Former Member — Sat, 14 Apr 2007 08:07:16 GMT

Thanks Dimitri,

Problem is solved...I managed to convince my client of having diffrent roles.

Thanks again.

sandeep