Question Re: BEx Analyzer access in Technology Q&A

BEx Analyzer access

Former Member — Thu, 23 Jul 2009 21:08:54 GMT

Hi experts!

I have seen some posts about the subject but still is not very clear to me, i would appreciate your suggestions.

We need to restrict bex analyzer access and we want to know if it is possible to do by applying some authorization objects, roles or security settings at BI level.

We need to reinforce control over bex analyzer deployment in client installations, but this is not immediately possible.

Even if that would be possible, we would like to reinforce security using some authorization constraint at BI level.

Thank you in advance

Re: BEx Analyzer access

dennis_scoville4 — Thu, 23 Jul 2009 21:36:32 GMT

In the Authorization Objects S_RS_COMP and S_RS_COMP1, make sure the activities are 03 and 16 (Display and Execute respectively). That should remove their ability to create or modifty a BEx Analyzer query.

Re: BEx Analyzer access

Former Member — Thu, 23 Jul 2009 22:11:40 GMT

Thanks Dennis

That's true and actually users already have those restrictions.

In fact we want to prevent unauthorized download of data to excel sheets from users who have installed bex analyzer but are not authorized to do that. Certain users only have to access querys from web and shouldn't have to use reports from bex analyzer, even if by accident they have installed.

I want to know if the only way to do that is eliminating bex analyxer from their installations or exists another way to prevent this by using some authorization object(s).

Re: BEx Analyzer access

gaurav_kothari — Fri, 24 Jul 2009 05:14:44 GMT

Try removing the authorization for the T-Code RRMX. Hope this helps.

Regards,

Gaurav

Re: BEx Analyzer access

Former Member — Fri, 24 Jul 2009 07:12:19 GMT

You can do that restrictions in BI level by adding these authorizaiton components.

1. S_RS_COMP

2. S_RS_COMP1

in these you have to maintain the info areas, multiproviders and info cubes.

in S_RS_COMP1, please maintain the owners as well to restrict in user level.

Activity should be exeucte, display. if they are super users grant them create access.

Hope this would help you more.

Re: BEx Analyzer access

Former Member — Fri, 24 Jul 2009 23:30:46 GMT

Mohan

Thanks for your reply

Final users roles already have these authorization objects, they can't modify reports.

Maybe i'm not explaining clearly the problem. The only accepted way to access reports for all users is by using web querys published in our intranet. But many users have bex analyzer installed and we don't want that an unauthorized user download data to a excel sheet via bex analyzer.

I want to restrict bex analyzer access, not all access. We have a complete set of authorizations controlling data acces and of course final users can't create nor modify production querys. The only thing i want is specifically restrict access to bex analyzer. Of course too, if users don't have installed bex analyzer there isn't any problem, so they could only access web reports (the de facto standard) but the true is that yet we have a problem identifying and uninstalling bex analyzer from all the people who shouldn't have permissions to use it. Only a limited amount of authorized users may have the rights to do.

Thanks in advance

Re: BEx Analyzer access

gaurav_kothari — Mon, 27 Jul 2009 07:23:47 GMT

Hi,

Did you check whether the users have access to the t-code RRMX ? If so you need to remove this access. Thus they will not be able to acess BEx.

Regards,

Gaurav

Re: BEx Analyzer access

Former Member — Wed, 29 Jul 2009 19:04:50 GMT

Gaurav

Thank's again for your post.

I did a test, removing t-code RRMX from test user authorizations. This avoid access to bex from the transaction, but still let me use a report directly by executing START->Programs->Business Explorer->Analyzer.

As i seen removing t-code only avoids calling bex from "inside" the system, but don't restrict using analyzer from "outside".

Re: BEx Analyzer access

dennis_scoville4 — Wed, 29 Jul 2009 19:30:17 GMT

In the Authorization Object S_RS_COMP, do you have the following Activity values set for the users that you want to provide access to?

01 - Create or generate

02 - Change

06 - Delete

22 - Enter, Include, Assign

I'm assuming that this Authorization Object is already setup with Activity values:

03 - Display

16 - Execute

Re: BEx Analyzer access

Former Member — Wed, 29 Jul 2009 21:45:24 GMT

That's right Dennis, actually authorization object S_RS_COMP only have activities 03 (Display) and 16 (Execute) in users roles.

When you say "for the users that you want to provide access to", remember that the thing i need to do is restrict access via bex analyzer.

The scenario is this:

Of all the users we have, only a restricted amount of them must access reports via bex analyzer ... all the rest should only access reports via portal/intranet.

The problem is that, from the group of users who only have this access, there are many of them who have bex analyzer installed and access reports directly from their front end installation (Start->Programs->Business Explorer->Analyzer, not from RRMX).

Other team is leading the task of remove bex analyzer installations from unauthorized users, but i want to know if there is also another way to prevent access from bex analyzer for users who should only access reports via portal/intranet.

Thanks!

Re: BEx Analyzer access

dennis_scoville4 — Wed, 29 Jul 2009 23:03:08 GMT

From my recollection, there is no way to be able to allow a user to only use BEx Web while not allowing the use of BEx Analyzer, because the Authorization Objects for BEx are based on queries, query elements and objects (e.g. InfoProviders, et. al.). Since they have access to a query, they can execute that query by any means they have available to them.

Re: BEx Analyzer access

Former Member — Sat, 01 Aug 2009 06:05:19 GMT

Dennis, i think you are right, certainly we have to examine certain practices and policies.

This leads me to make other questions, but i think the particular issue is clear.

Thanks to all you for your answers

Re: BEx Analyzer access

Former Member — Sat, 01 Aug 2009 06:09:31 GMT

trying

Re: BEx Analyzer access

Former Member — Sat, 01 Aug 2009 06:10:24 GMT

closed

Re: BEx Analyzer access

Former Member — Mon, 18 Oct 2010 07:06:37 GMT

Just saw this thread in search for another.

IMHO it is possible to restrict the use of BEx analyzer. You can do this at userlevel. Mark the webquery users as "Communication users". Mark the BEx analyzer users as "Dialog users".

We used this in SAP BW version 3.1.