Roles mapping for a user

[Former Member]

Dear experts,

I have a BASIS query.

I have created a role "ABC_XYZ" which has authorization for company code - "1000" and has been assigned user "SMK001".

My query is,Can I use the same role "ABC_XYZ" assigned user "SMK002" but having authorization for different company code - "2000" only.

Can we restrict the legal entities and other business objects at user level instead of role level?

Any input appreciated.

Thanks in advance.

[Former Member]

yes you can. by making the companycode an organizational level (SE38: PFCG_CREATE_ORG_LEVEL or something like that) and using derivation for your roles, you can quite easily make duplicates of your ABC_XYZ role (which should be the 'mother' role and make 'child' roles which only differ from the mother on organizational level(s).

http://help.sap.com/saphelp_47x200/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm

Message was edited by:

Dimitri

[former_member74904]

yes you can. by making the companycode an organizational level (SE38: PFCG_CREATE_ORG_LEVEL or something like that) and using derivation for your roles, you can quite easily make duplicates of your ABC_XYZ role (which should be the 'mother' role and make 'child' roles which only differ from the mother on organizational level(s).

http://help.sap.com/saphelp_47x200/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm

Message was edited by:

Dimitri

[Former Member]

Thanks for the quick reply.

Derived role will create a new role? or The same role will be used to restrict the organizational entities?

I have requirement of not creating a different role for company code restrictions.

Please advice

[Former Member]

Dear Dimitri,

I have gone through the document,It says:

" There are two possible reasons for deriving a role from an existing role:

· The role menus are identical but the authorizations for the menu actions are different in the derived role.

· The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role."

My objective is transaction used in both the roles are same...but only the org entities like company code , Plant and BA etc authorization would be different.

[former_member74904]

I somehow managed to <u>not</u> read that requirement you posted

the solution I wrote will require you to make different roles for different companycodes.

the deriving part normally works as follows: when creating a new role in the first tab(description) you can specify from which role the new one should be derived.

I'm not sure how to realize this without using more than a single role, I imagine that the companycode field should somehow be dynamically changed to allow different users to get the correct access. I don't know how this can be done, but maybe someone else can?

[former_member74904]

· The menu and authorizations of the derived

role are identical, but the organizational levels are

different in the derived role."

My objective is transaction used in both the roles

are same...but only the org entities like company

code , Plant and BA etc authorization would be

different.

this is what can be done easily with the derivation principle, but if all transactions, reports etc. are identical you will end up with the same amount of roles as you have companycodes/plants/business areas or whatever field you want turned into an organizational level.

kindly ask the projectmanager to allow you to use more than one single role for this and you should be in the clear )

[Former Member]

Thanks Dimitri,

Problem is solved...I managed to convince my client of having diffrent roles.

Thanks again.

sandeep

[Former Member]

Hi Sandeep,

You can use the concept of Master/derived role to enforce organizational level restrcitions.

- Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.

- The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.

- Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.

Please visit http://www.sapsecurityonline.com/tutorials/derived_role.htm

for more info on derived roles.

I dont think that it is possible to restrict two different company codes using a same role. You will have to go for Derived role concept to enforce the org level restrictions.

Hope it helps.

Please award points if it is useful.

Thanks & Regards,

Santosh

Message was edited by:

NAVABOTHU SANTOSH KUMAR

Message was edited by:

NAVABOTHU SANTOSH KUMAR