cancel
Showing results for 
Search instead for 
Did you mean: 

Restrict project's access on PS

Former Member
0 Kudos

Hi everyone,

I have a question about PS: is there a way to control which users have access to some projects? i.e. can I assign a project to a specific group of users so only they can view/modify the project.

So far what I know about PS is that you have users with roles, and these roles give either full access to all projects or none at all.

I want to have many users that can create/modify projects, but only those they're assigned to.

Thank you all in advance

--

JD

Accepted Solutions (0)

Answers (4)

Answers (4)

schneidertho
Advisor
Advisor
0 Kudos

Hello Juan,

have a look at note 638781. I think this note addresses your issue.

Cheers

Thorsten

Former Member
0 Kudos

Thanks Jose. I will try this out. As you very truly pointed out, if multiple people work on multiple projects and if there are several projects, it is an administration nightmare for the basis team.

Former Member
0 Kudos

Hi Srinivas,

You have done a very good job of explaining the process of defining the security role in detail. I needed some clarification for step 16:

"16.Now the authorization role is ready. This setting will ensure that any person who is assigned this role will only be able to “Display” the projects , if the responsible person is “XYZ”".

Are you saying that if User XYZ is the responsible person and another User A is assigned this role (even though he/she is not the responsible person XYZ), User A will be able to display the projects?

If you can clarify this, I would greatly appreciate it.

Thanks!

Nirmal

Former Member
0 Kudos

"Are you saying that if User XYZ is the responsible person and another User A is assigned this role (even though he/she is not the responsible person XYZ), User A will be able to display the projects?"

Yes, that is it!!!

Bear in mind that authorizations give a lot of work to basis people...

For example, if you create another project with manager ABC, you will have to create a new role with ABC and give this role to all users who will access this project.

If a user has access to projects managed by XYZ and ABC, he will have to have both roles.

And what happens if you change a project's manager?

I have been to a couple of PS implementations where people start wanting to control access to every project and later on notice that this is not feasible.

Sit down by a good basis consultant and he will tell you everything about authorizations...

Former Member
0 Kudos

Hi Juhan,

Yes you are right, users can have roles either full access to all projects or none.

Also if you want to control the users access to only projects with an organisational elements like company code OR palnt can be done. However if projects coming under same organizational elements cannot be done.

With best regards,

Harisha

Former Member
0 Kudos

Thanks Harisha!

We have only one Company code and I don't know what a 'plant' (I assume that's what you mean) means in PS, so I'll have to live with the idea that all users can modify each other's projects. Sounds scary... 😄

Thank you.

--

JD

Former Member
0 Kudos

Hi Juan,

I think the restriction is very much possible. At the project defnition level, there are three Authorization objects i.e

1. Based on the controlling ( C_PROJ_KOK Controlling area )

2. Based on the Profit Center ( C_PROJ_PRC Profit center )

3. Based on the project Manager ( C_PROJ_VNR Project manager )

In your case you can use the 3rd Authorization Object. You can use this authorization object to control who has access to the project definition in the Project System depending on the person responsible for the project ("project manager").

For more details on this subject refer the IMG documentation on the link SPRO --Authorization Management - project system

Please reward points , if you feel that this answer addresses your query.

Warm regards,

Srinivas Potluri

Former Member
0 Kudos

Hi Srinivas,

You're giving me hope on this! sounds great. Now, another question: Can there be more than one project manager? Because it would be nice to have project access restricted to managers but if this applies to only one user, then it's not practical since the projects can get really big and some responsabilities are assigned to different users.

Thanks

--

JD

Former Member
0 Kudos

Hi JD,

I think only one project manager is allowed per project.But in your case you can restrict the users based on the authorization object <b>C_PRPS_VNR Project manager</b>.You can use this authorization object to control who has access to the WBS elements in the Project System depending on the person responsible for the project ("project manager").

Please refer Examples in the link which I suggested in my earlier mail.

Hope this helps.

Bye,

Srinivas Potluri

Former Member
0 Kudos

Wher we can link User ID to responsible person?

Regards,

Venkat

Former Member
0 Kudos

Hi Srinivas,

Thanks for all your help... I'm just so embarrassed for not understanding much of what you say. I'm a HUGE noob on SAP.

So could you please be a little more specific on the link you provided earlier? I tried going into <b>SPro_Admin</b> and from there to <b>IMG Reference</b> then to <b>Project System</b> then <b>Authorization Management</b> and read some of the help found on those items but all I could found is a description of the different 'Roles' and I really don't know how to work with that.

Is there any tutorial where I could read how to use the information you provide me? I mean, where can I read about using that authorization object?

Thank you for bearing with me.

--

JD

PS: I'm sorry if some of the <b>names</b> don't match the english version... I'm translating from a spanish version of the GUI

Former Member
0 Kudos

Hi JD,

There is nothing to feel embarrassed my dear friend. SAP is an ocean and I am sure all consultants / users will agree that it will take ages to learn the whole module.

What I guess from your mail is that you got the link, but you are executing the transaction. Please do not execute the transaction (T code pfcg), as it will take you to the Role maintenance. Please go to the last node of the link, and click on the document link (IMG Activity Documentation) on the left side of the execution button. Here you will get to know all the information about the authorization objects.

Generally Speaking the functional Consultants will not have authorization for the transaction code "pfcg" and its BASIS persons who would handle this issue. Following are some basic steps in creating a role and assigning it to the users. (This is with reference to IDES only and specifically to your query)

1.Go to T-Code pfcg

2.Create a Role by giving a name say “ZPSTEST”

3.Click on Authorization tab

4.You will be asked to save the profile first

5.Go to “ Change authorization data”

6.Choose “SAP_ALL” and adopt reference.

7.Confirm “ Yes” to insert all authorization

8.Go and expand the link “project system”

9.Expand the link “ PS: Project Manager for Project Definition”

10.Here you will see two fields “ Activity for Authorization che” and Number of responsible per”

11.Click on change button on the first field.

12.Here click on “Cancel full authorization”

13.Now, here you can choose what all functions you want to assign for this authorization Role.

14.Choose say “ Display” and save

15.Click on “ Number of responsible person” and choose any person , say “ XYZ”

16.Now the authorization role is ready. This setting will ensure that any person who is assigned this role will only be able to “Display” the projects , if the responsible person is “XYZ”

17.Go back to the pervious screen. In the process” Generate” the profile also.

18.Once you are in “Change Roles” Screen, go to tab “USER”. Here you can assign this role ZPSTEST to various users.

Try to experiment with authorizations in IDES by creating a Dummy user and assigning a Authorization profile to him.

Hope this clarifies all your queries. Please take help from your BASIS person.

Do reward points, if you feel I have clarified your query.

Warm regards,

Srinivas Potluri

Former Member
0 Kudos

Dear Srinivas Potluri,

You have given an excellent explanation. Thanks a lot.

Regards,

Venkat Srinivas Konda

Former Member
0 Kudos

Hi Srinivas,

You really earned some points for all the time you took to give such a detailed answer!!!

I will try to follow your steps and will let you know how it goes. From reading it, sounds like the solution to all my problems 😄

Thank you VERY much.

--

JD