SAP BPC 10.1 NW Security Configuration

[Former Member]

Hi Experts,

i am currently on SAP BPC 10.1 NW Classic Version and facing some issues while doing the Security Configuration

Issue :

While Doing the Headcount Planning my Client wants to restrict some users for displaying of salary values on particular category  i.e out of 10 users 3 users should not be able to see the salary values in report.for Actual Category.

also for the 3 users mentioned above should also not be able to create the new report on Salary.

Solution so far tried :

1) created a new Team , Task profiles , Data Access profile for the 3 users  -------  got success by restricting the salary values  but after that my BADI Fails as some calculation needs to be done

2) created a separate template with access to the  3 users but still user was  able to create the new report on salary values.

Decided to implement  the Shared Query Engine BADI

3)  Facing issues While Implementing the SQE BADI for this issue

As the solution trying to implement the Virtual Security by keeping the same template across the  users and will show the salary values to 3  user as 1 in salary column in  front end (BPC template) but the  actual value should remains in the backed.

i.e Every time if the report is refreshed by the 3 users they will be able to see the values as 1 in salary column in front End and post that the user will run the BADI

but  my ABAP Consultant. is not able to achieve this

Do anyone have faced this issue and if yes how you have resolved this kind of scenario

will Appreciate any Inputs or any alternate method to achieve this

Regards

Bhupendra Arya

[Former Member]

Hi Bhupendra,

1) What BADI fails and can you explain why?

Regards,

Gersh

[Former Member]

Hi Gersh,

  The BADI is for Calculating the Benefits of Employees

it Fails by giving an  Authorisation Error

[former_member186338]

Hi Bhupendra,

Please read:

You can implement the same code in your badi for Calculating the Benefits of Employees

Vadim

[Former Member]

Thanks a lot Vadim

will  implement  the same

Regards

Bhupendra Arya

[Shrikant_Jadhav]

Hi Bhupendra,

Until you get reply from experts, try this -  I am not sure whether it is best practice or not, But you can try something like - Follow your first approach within that while executing BADI change the user internally who has full access.

Discuss with ABAP consultant, they can do it easily.

Shrikant   

[Former Member]

Hi Srikant,

Thanks for your prompt reply

will discuss with this with ABAPER but what about the Ad-hoc report restriction coz in my 1st approach the user was still able to create a new  report with the salary values 

Bhupendra

[Shrikant_Jadhav]

Hi Bhupendra,

As you said

Solution so far tried :

1) created a new Team , Task profiles , Data Access profile for the 3 users  -------  got success by restricting the salary values  but after that my BADI Fails as some calculation needs to be done

So that will be taken care by security.

Shrikant

[former_member186338]

Report restriction by SQE BADI is a bad idea. Use normal security (1) and in the badi impersonate user if required.

Vadim

[Former Member]

Hi Vadim,

Thanks for your Reply

i have achieved both the Objectives of Restriction Without SQE BADI

But i need Help on How to Impersonate the user when the BADI is Executed

i have Communicated to my ABAP Consultant for the same but he Need some Guidance/Help

as he is doing for the first time

Regards

Bhupendra Arya