Auth Groups

[Former Member]

I have one question regarding to the authorization group.

We have a brand new PLM ECC 6.0 config to go live and currently I am working on the security role. We have created some Z* auth groups that need to put into S_TABU_DIS object field DICBERCLS. My problem is that I can manually input the object value without error but I can not pick it from the object value list. Since we are the first time to setup the system, I think it would be good for us to do it in a correct way.

I have done some research on the forum:

"TDDAT will show you the auth group you assigned to the table.

If you want it to appear as a pick list when you do F4 in the DICBERCLES field in S_TABU_DIS then you need to maintain it in TBRG. The two are not dynamically linked."

In our system I have checked the TDDAT table and the Z* groups are assigned to customized tables. Same as in table TBRG the auth groups are maintained there.

Since both the auth group tables are maintained correctly, why it still can not be shown in the pick list in PFCG? Are there other steps that I may have been missed?

Thanks

CC

[Former Member]

How did you maintain the auth groups in TBRG (texts in TBRGT)?

[Former Member]

Hi Julius,

Our developer had created the authorization groups using Tcode SE54.

I checked both table TBRG and TBRGT, the auth groups are defined properly.

Thanks

Cicy

[Former Member]

Cicy,

Can you please test one scenario for me: Goto transaction SU20 and find the auth field DICBERCLS and then display the field and click on the Test button on the top which say input help and see whether you can see all the entries. Let me know whether you see all the auth groups or not.

Regards,

Naveen

[Former Member]

Hi Naveen

Thanks for your help. The testing result is that none of the Z* groups are shown on the table. Please advise what the next step I need to do to fix it.

Thanks again

Cicy

[Former Member]

Cicy,

Are the authorization groups created in the same client?? I guess the table TBRG is client dependent and if the authorization group is not created in the same client, Please copy the transport or package associated with it into your Security development client (using txn SCC1), then it should work fine. I think this is what we are missing here. Let us know if it works.

Naveen

[Former Member]

Very good comment Naveen!

Although the authorization groups of the tables themselves are client independent; the users, their authorizations, roles and therefore the available authorization groups to assign the table to or pull from the input help in PFCG are of course client dependent!

Enjoy the weekend,

Julius

[Former Member]

Thanks all for your reply.

However we currently only have one client setup for development, and both, me and the developer who had created the auth group are working on the same client. I don’t see any client issue here.

Also I have given SAP_ALL to the test id to create the security roles. My purpose of using the test id is to check if the Z* groups pop up in object field in PFCG.

I am more concerned on the testing in SU20 – no Z* groups shown that have been assigned to the object S_TABU_DIS. I can see other auth groups but no Z* groups.

If the Z* groups are shown in table TDDAT and TRGB/TRGBT, why it is not showing in SU20 the DICBERCLS field for the object S_TABU_DIS? What steps we have missed and can it be manually added into the DICBERCLS field in SU20?

Thanks

Cicy

[Former Member]

Cicy,

When you hit the F4 button help in PFCG or click for the input help on the su20 screen for the auth field DICBERCLS, there is a small button just after the favorites button and before the print button that says Display all values/ Personal Value list, try clicking it if it is enabled. and see if it pulls up all the table entries. And Giving SAP_ALL will not help as this is not an authorization issue. Let me know if it works.

Naveen

[Former Member]

Naveen,

The button is disabled. any other way around?

I am login as the test ID with SAP_ALL for the purpose of reducing auth errors.

Thanks

Cicy

[Former Member]

Hi Cicy,

Please check in TBRG whether your Z* values for field DICBERCLES are indeed for object S_TABU_DIS.

DICBERCLES is also a field of some other authorization objects.

Cheers,

Julius

[Former Member]

Ok Cicy, I think I found the error your auth group should only be 4 characcters long. Please create a 4 character auth group name and try. In su20 you can verify the character length. Let us know if it works.

Naveen

[Former Member]

Hi Julius,

I copied the auth groups that are defined in TBRG:

Client Object Authorization Description

100 S_TABU_DIS ZPLT ZPLD_WF_CTL_PLNT

100 S_TABU_DIS ZCNT ZPLD_WF_CONTROL

From my understanding it has been correctly defined.

Thanks

Cicy

[Former Member]

Try remove the underscore seperator "_" from the "Description" field.

Edit: I tried this and it is not the cause on my system. If Naveen's various good advise also does not work, ask the developer to debug the lookup.

Use for example:

> ZPLD/WF/CTL/PLNT

or

> ZPLD-WF-CONTROL

or a "normal" description which someone else can also understand

> Product Lists for Workflow Control per Plant

Sometimes syntax checks do not like certain characters.

There are no underscores delivered with the standard DICBERCLES values...

Cheers,

Julius

Edited by: Julius Bussche on Apr 12, 2008 8:20 AM

[Former Member]

Cicy,

Why not try to create a custom field similar to DICBERCLES and look whether it will pull up the Z* auth objects. While creating the custom auth field please use the data element BRGRU and the table name for help as TBRG. Basically you are copying the same but let us see whether there is anything wrong with the definition of DICBERCLES. Let us know what the outcome is.

Julius,

Thanks for your comments on my posts.

Naveen

[Former Member]

Thanks Naveen,

I have got the same results -- no Z* groups shown on the table on the testing field ZTEST that I had just created.

Thanks

Cicy

[Former Member]

Cicy,

Try to execute the function module TABLE_ENTRIES_GET_VIA_RFC and see whether you can see the Z entries in the table output. If you can then ask your developer to see why you are not able to display the Z values. The above function module will display the entire table. Let us know what is the result of the function module.

Naveen

Edited by: naveen on Apr 14, 2008 10:51 AM

[Former Member]

Thanks Naveen,

Yes I have got the Z group entry results after executed the function module TABLE_ENTRIES_GET_VIA_RFC. I can see the ZCNT and ZPLT group names shown on both table TBRG and TBRGT.

The table TBRG shown as:

400S_TABU_DISZCNT

400S_TABU_DISZPLT

The table TBRGT shown as:

400ES_TABU_DISZCNTZPLD_WF_CONTROL

400ES_TABU_DISZPLTZPLD_WF_CTL_PLNT

Thanks

Cicy