Unable to restrict access to allow Write and Read for different data sets.

[jbahney]

I have a Business Planner role that allows a broad amount of access to users that perform multiple job functions. I have been trying to restrict the role to be able to have Write access to some items and Read access to a broader group of materials. I have had no luck doing this so far despite multiple combinations of settings and SAP note recommendations. The IBP Security Aspects has an example of where this should work.

For the Business Role, I have the Key Figure ID set to Unrestricted in the Write section per note 2634325.

I do not have Permission Filters set on the role for Write or Read. Based on note 27709286, if you have two planning filters on a role, the access will default to the filter with the broader amount of access, regardless if it’s on the Read or not.

If I set the permission filter up with just Read Access, I am still able to make and save changes. With the permission filter set up this way, it does restrict access based off Division and Product Line. However, the Permission Filter is set to No Access for Write.

The other thing I find odd is that when I try to set the Permission Filter up with a Location ID restriction, it will pull up no data in the Excel Add-in despite there being data available.

[former_member194529 · Accepted solution]

Hi John,

If there is UOM involved, you may try to turn ON the Auto-Complete Filter Criteria on the Permission Filter definition, to see if you get rid of the NO DATA message.

It also interesting that you check the "Permission Filter Report" tab to see on the fly what access will your Permission Filter be granting to the business users directly assigned to it or assigned to it via User Groups since you are not doing it via the Business Roles.

Best,

Ivan

[Former Member]

Hi John,

You can use Security Trace to check why you are getting No Data message and that will help you to troubleshot your issue and refine the role.

Regards

Ankur

[jbahney]

Thanks Ankur for the suggestion. I did run the trace and there are no failures for Location in the logs. The only failure is for Application Logs for the Admin.