Restricting the posting period to particular users

[Former Member]

hi ,

we have a requrement to restrict the posting periods to limited users only .

when i tried doing it in ob52 , there they say we need to give the authorization group for that particular posting period .

the auth .object 'F_BKPF_BUP' has been assigned with full auth for all the users in our company .

now how to do this . this is my first assignment is security , kindly help me to solve this

[Former Member]

Hi,

If you read the documentation for OB52 and object F_BKPF_BUP then it gives you all the info you need to know.

Basically the FI team need to put authorisation groups against the posting periods & put a process in place to maintain the OB53

You need to remove all access to F_BKPF_BUP except to roles which require it & then amend the object in the relevant roles with the correct auth groups as defined by the functional team.

It is often seen that a role containing only F_BKPF_BUP + correct auth group is created and assigned only to the users requiring it. F_BKPF_BUP is then inactivated in all other roles.

[Former Member]

our requirement is that when the posting period is opened in ob52 all the FI users needs to access that

but for few special persons they need to open it for some extra months also .

in ob52 docu they have given that this could be achieved by auth.group .

my thought of implementing that would be ,

1. created a new auth group using se54 named 'samp'

2. for all the users in PFCG under F_BKPF_BUF instead of giving full auth , i would select F4 and press Select ALL button and then deselect the 'samp' alone

3.now in ob52 for that extra posting period month , this SAMP can be assigned

my doubt is ,

if i give F4 in the F_BKPF_BUF there are more than 500 auth groups , if i give select all button will only the first 500 auth group will be selected ? if so how to select the rest .

what is the importance of the auth group that are getting displayed there

suggest whether i am in the correct direction

[Former Member]

Hi Susin,

In OB52, auth group is maintained against the posting periods by teh func team. All you need to do is enter that value in the object field, no need for using F4 etc.

[Former Member]

but i just want to know the importance of the values that we get when we press F4 for the object F_BKPF_BUP .

bcoz currently all the users have full authorization .

what would be the effect if i remove the '*' there and give the auth .gp which has been given in the ob52 alone ?

will it effect anywhere else ?

[Former Member]

When you press F4 for F_BKPF_BUP it pulls out a list of some auth groups which are configured in the system and can be used for many different purposes.

Auth group is an arbitary field and an option which SAP gives to provide more control in some areas & it's application is widespread and often haphazard.

The only auth groups you are interested in for F_BKPF_BUP are the ones which your func team have assigned against posting periods in OB52. None other matter in this object. If you have * in there then those users will be able to post to all periods protected by an auth group.

If you remove the * & give only what is in OB52 then users will be able to post to that protected period and any open ones which are not protected by an auth group. If you leave it blank then they will only be able to post to periods not protected by auth groups. it will only refer to posting periods and the financial tx which are relevant. You can get a rough list if you search tcodes which are maintained in SU24 for object F_BKPF_BUP (this is only rough list though)

Does that clarify things?

[Former Member]

OB52 field is free form, so you dont' have to configure the auth group. As long as you have the exact same values in OB52 and PFCG then it works.

[Former Member]

Bree, I agree - I hope that is what I put in my post! Same as most other uses of auth group field

[Former Member]

>

> OB52 field is free form, so you dont' have to configure the auth group.  As long as you have the exact same values in OB52 and PFCG then it works.

I haven't ever tried this for OB52, but if you activated S_TABU_LIN for the TBRG object field and there is no reason to grant the other objects to be selected, then the F4 might filter the others out.

I am aware that this does not always work for all F4 help functions, but it might work in this case (for TBRG)?

Cheers,

Julius

[Former Member]

In OB52 under the AuGrp section, it is free form. If the business puts some values in there you can control it by the object 'F_BKPF_BUP'.

In the past, I've deactivated the object 'F_BKPF_BUP' out of all transactions in su24 by changing the value to C instead of CM.

Then after expert mode generation of the roles in order to remove 'F_BKPF_BUP' I've created some posting period roles with just the object 'F_BKPF_BUP' in it with the values corresponding to the OB52 table. Then you can control who has access to what posting period authorization group.

An example would be that on the 1st of the month all people with posting access would have access to XXX1 auth group. They could then post for the next month but not the previous month. Then group xxx2 could post for the previous month for 1-4 days and and the corporate team/closers xxx3 could post for up to 5 days (or how long it takes to close) without it impacting the bulk of users.

Additionally, instead of deactivating the object in all tcodes you could just put in the value for end users to post to the next month and create the special roles for the people that can post outside of the current period. All in all, it needs to be controled in OB52 and the object 'F_BKPF_BUP'