Question Re: Is this possible in RSECADMIN? in Technology Q&A

Is this possible in RSECADMIN?

Loed — Wed, 26 Aug 2020 15:24:17 GMT

Hi guyz,

I would just like to check if this is possible in BW authorization? I already tried several testing but I wasn't able to achieve my desired report.

Here is my transaction data:

These are my users and I need to limit them in accessing the following:

It means that even if company code BBB and CCC has the plant Z, USER1 should only see the plant Z under company code AAA.

RESULTS:

Is there a way to achieve this?

Thank you.

Loed

Re: Is this possible in RSECADMIN?

FCI — Wed, 26 Aug 2020 15:46:19 GMT

Hi Loed,

Sure, just create an AA with both company code and plant. Then, only the combination will be authorized. This is called multi-dimensional authorization (you will find blogs and posts on the subject).

The difficulty, here, is more a selection issue than an authorization one, As authorization variable does not work with more than one infoObject, the users have to select the right combination (or you have to find a way to select for them).

Regards,

Frederic

Re: Is this possible in RSECADMIN?

Loed — Thu, 27 Aug 2020 09:16:03 GMT

Hi cincet.frdric2.

Sorry my sample was incorrect.

This is the right scenario:

USER1 should only see the transactions above even if PLANT Z is present for all company codes.

Thank you.

Loed

Re: Is this possible in RSECADMIN?

FCI — Thu, 27 Aug 2020 09:32:17 GMT

If you create an AA with both infoObjects with the values AAAA/Z and BBBB/X the user should only have access to this data (even if plant Z exist for the company BBBB.

Regards,

Frederic

Re: Is this possible in RSECADMIN?

Loed — Thu, 27 Aug 2020 10:18:05 GMT

Hi cincet.frdric2.

Were you able to try it on your side?

Because I tried to create 4 AAs first for AAA, BBB, X and Z. But I had the result below which is INCORRECT.

Then I tried next to create 2 AAs for AAA and Z then BBB for X, but got the NO AUTHORIZATION error.

Thank you.

Loed

Re: Is this possible in RSECADMIN?

FCI — Thu, 27 Aug 2020 11:26:35 GMT

You have to create 3 AA with both infoObjects (company and plant):

AAA/Z
BBB/X
BBB/Z

And you have to filter on the company code and the plant at the query level.

Re: Is this possible in RSECADMIN?

FCI — Thu, 27 Aug 2020 13:59:17 GMT

But you're right, the user will be able to get the data for one combination only (selection on one company and one plant) and will send an error message if you try to display more (no authorization).

This behavior is described in note 557924 (old one and for authorization variables but whose principles are still valid and valid also for classical variables).

You can have a look to the following wiki for possible solutions : here (though I never implemented it).

Re: Is this possible in RSECADMIN?

Loed — Thu, 27 Aug 2020 14:14:38 GMT

Hi,

I tried it. I created 2 AAs for AAA/Z and BBB/X, but got the NO AUTHORIZATION error.

Were you able to try it on your side?

Thank you.

Loed

Re: Is this possible in RSECADMIN?

FCI — Thu, 27 Aug 2020 14:16:56 GMT

I tried it. I created 2 AAs for AAA/Z and BBB/X, but got the NO AUTHORIZATION error.
Were you able to try it on your side ?

Which filters did you use for company code and plant ?

Re: Is this possible in RSECADMIN?

Loed — Thu, 27 Aug 2020 14:40:48 GMT

These two(2):

AAA/Z

and

BBB/X

Thanks.

Loed

Re: Is this possible in RSECADMIN?

Loed — Thu, 27 Aug 2020 14:49:57 GMT

Here is the error log with actual values:

ZDW_BU/ZDW_CU

First AA = 00615/0247

Second AA = 00616/39

ZDW_CU 0247 is also available in 00616..But I only wanted it to be shown under ZDW_BU 00615..

Re: Is this possible in RSECADMIN?

FCI — Thu, 27 Aug 2020 15:18:42 GMT

Have you seen my previous comment ? This is what I was explaining.

But you're right, the user will be able to get the data for one combination only (selection on one company and one plant) and will send an error message if you try to display more (no authorization).
This behavior is described in note 557924 (old one and for authorization variables but whose principles are still valid and valid also for classical variables).
You can have a look to the following wiki for possible solutions : here (though I never implemented it).

Re: Is this possible in RSECADMIN?

Loed — Fri, 28 Aug 2020 10:55:37 GMT

Thanks for the link. But I can't find any link or documentation on how to implement it.

Do you have any idea?

Thank you.

Loed

Re: Is this possible in RSECADMIN?

FCI — Fri, 28 Aug 2020 15:28:28 GMT

I must admit that if I have to implement this I will serioulsy investigate the alternative solution that would be to manage a concatenation of both infoObjects into a new characteristic (company code + plant). This allowing the use of an authorization variable.

Re: Is this possible in RSECADMIN?

Loed — Mon, 31 Aug 2020 05:30:25 GMT

I might be needing all combinations for me to implement this concatenation since I'm using 4 authorization objects now.

Anyway, thanks for the idea Frederic. 🙂

I will also check how to implement the blog you shared.

Thank you.

Loed