SAP standard authorization concept for specific document access control?

[Former Member]

Hi all,

I have a requirement whereby the business wishes to use SAP standard authorization techniques to handle a custom development. The requirement calls for specific documents to be available for Edit or Display to an individual user based on authorizations. Not ALL or none available for Display or Edit as is the standard way of using SAP Authorization objects.

Example: I wish to be able to do an authorization check for "Change" of document #15 by user XYZ -> SAP standard authorization check must return a yes\no.

The only way I can think of doing this at the moment is to create a separate "Change" Role for each and every document and assign only that role for that specific document to that specific user... (It is generally a "one user edits one document" rule). But then I would have to create a Role for every single document in the system!

Is there an easier way to do this? Using one authorization object and one role with a document specific key that is linked to a user?

Many thanks for your ideas.

Regards,

N

[Former Member]

Hi all,

I have a requirement whereby the business wishes to use SAP standard authorization techniques to handle a custom development. The requirement calls for specific documents to be available for Edit or Display to an individual user based on authorizations. Not ALL or none available for Display or Edit as is the standard way of using SAP Authorization objects.

Example: I wish to be able to do an authorization check for "Change" of document #15 by user XYZ -> SAP standard authorization check must return a yes\no.

The only way I can think of doing this at the moment is to create a separate "Change" Role for each and every document and assign only that role for that specific document to that specific user... (It is generally a "one user edits one document" rule). But then I would have to create a Role for every single document in the system!

Is there an easier way to do this? Using one authorization object and one role with a document specific key that is linked to a user?

Many thanks for your ideas.

Regards,

N

[Former Member]

Are you suggesting creation of an authorisation object for document numbers? In that case, what happens when new documents are generated?

I would suggest that you base your checks on Company code/profit-cost centre assignement/plant. etc, instead of restricting the user based on document numbers alone.

Hope this helps.

Sudha

[Former Member]

Hoping to avoid just that... yes, then each time a new document is created, a new role will have to be created and assigned to the user as well! Not a great solution...

Unfortunately there is no 'grouping' criteria - I know what you are proposing - but there just is no commonality between the documents that should be editable by a certain user...

Looks like I'll be custom coding something...

Thanks for your input though...