Authorization for InfoArea

[#1]

Hi Experts,

Can anybody help me in the following issue? I've got two InfoAreas, one for reporting, one for planning InfoProviders.

I would like to create two types of users:

• Reporting: can create queries and display reports in the reporting InfoArea, but can't input data in the query which built on a cube in planning InfoArea.
• Planning: can create queries, display reports (both in the reporting and planning area), and can save data to BW from planning reports

I created an Authorization object called AUTH_TEST which has the same details as 0BI_ALL with the exception of my authorization contains only display activity. I created two roles for the reporting user who can't save data to BW:

object	Reporting role	Planning role
S_RS_AUTH	0BI_ALL	AUTH_TEST
S_RS_COMP	display, execute, enter, include, assign and restriction for reporting InfoArea	Display, execute
S_RS_ICUBE	display and restriction for reporting InfoArea	display and restriction for planning InfoArea
S_RS_ODSO	display and restriction for reporting InfoArea	display and restriction for planning InfoArea

When I assign only the planning role to a user, she/he can only display the planning reports(it's OK), but the user can't maintain query (not OK). When I'm assign the reporting role next to planning role, the user can type and save in input ready cells (not OK), and can maintain query (its OK).

I made the 0TCAIFAREA for authorization relevant in order to restrict it in the authorization object, but 0TCAIFAREA doesn't contain any InfoArea name.

Any recommendation how could I create the desired authorizations?

Thank you in advance!

Best Regards,

Adam

[Former Member]

Hi Adam,

Have a look at the changes in bold::

S_RS_AUTH	0BI_ALL	AUTH_TEST
S_RS_COMP	display, execute, enter, include, assign and restriction for reporting InfoArea	Display, execute
S_RS_ICUBE	display and restriction for reporting InfoArea	display and restriction for planning InfoArea change(02)
S_RS_ODSO	display and restriction for reporting InfoArea	display and restriction for planning InfoArea

I assume when you say Auth Object, you mean Analysis Auth.

I didn't understand the below statement. Please help me in understanding the same so that we can help you.

"When I'm assign the reporting role next to planning role, the user can type and save in input ready cells (not OK)"

Regards,

Sujit.

[Former Member]

Hi Sujit,

Thank you for your response! Sorry I'm new at the area of authorization. Yes, I mean Analysis Authorization.

"When I'm assign the reporting role next to planning role, the user can type and save in input ready cells (not OK)"

I have two roles for the two different InfoArea. In this case I would like to create a user who can display data and create, mainain queries in the reporting InfoArea (there aren't any input ready query) and can only display data in planning InfoArea (there are input ready queries so the restriction for displaying is a must). When a user got these roles at the same time, she/he can save data from the planning report to BW, despite I would like to let the user to display the data.

For the user who can save data to BW from planning report I can easily define the appropriate roles.

Thank you!

Best Regards,

Adam

[Anand71]

Hello,

If I understood your requirement correctly then you can try this:

Create two Analysis Authorization. role( i.e Two Zrole and not 0BI_ALL) with the following option

1)  characteristics 0TCAACTVT (activity) : Read (03) is set as the default activity

and  0TCAIPROV (InfoProvider) eg your infoprovider name or cube name

2) characteristics 0TCAACTVT (activity) : Change (02) for integrated planning and 0TCAIPROV (InfoProvider) eg your infoprovider name or cube name

Assign the above role to the user.

Note : You have to create authorisation role for the above info provider in T-Code:PFCG.

Thanks

Withe regards,

Anand Kumar

[Former Member]

Hi Anand,

Thank you for your response! Your solution works fine, I tried it before. The only problem with this solution is that when I create a new cube I have to maintain the authorization as well. That's why I tried to restrict it by the InfoArea, but the 0TCAIFAREA does not contain any area name... Do you have any idea how I could fill the 0TCAIFAREA object with the area names?

Thanks you!

Kind Regards,

Adam

[Anand71]

Hi Adam,

Try this:

Drag and drop the info cube-0TCAIFAREA into your info area. You can enable drag and drop in Setting tab in RSA1.

Thanks

Anand Kumar

[Former Member]

Hi Adam,

You can restrict 0TCAIFAREA with your info area name by manually typing in RSECAUTH tcode. You will not get the infoarea names in the input help.

If you want you can get the values from table RSDAREAT and load it to your infoobject which I think is not really necessary.

Please let us know if something is not clear.

Regards,

Sujit.