Limiting infotype 24 qualification maintenance based on value

[Former Member]

Several departments within our organization maintain a subset of values of IT0024. A situation came up recently where one department deleted an entry belonging to another department. We've been asked to investigate whether there is a way to preclude that from happening by limiting the set of values that each group is allowed to maintain.

The rules, for example, would look somewhat like this:

1. All users can read all IT0024 qualification values

2. Department #1 can only maintain values 5001*

3. Department #2 can only maintain values 5002*

..and so on..

Can anyone suggest how we can approach this problem?

Thank you,

Dan Roberts

Davey Tree Expert Company

[Former Member]

Hi,

Are you using PD profiles in roles? You can create profiles for each department and restrict maintain access for IT 0024. Say profile 1 for department 1 and so on. You will have to use the profile in auth object p_orgincon.

[Former Member]

We do currently have restrictions on who can maintain IT0024. The trouble is that when a user is granted maintenance privileges over that data, they can assign or remove any value. What I'm looking for is a way to further limit which values of IT0024 a user is permitted to maintain.

[Former Member]

Hi Dan,

How do you differentiate between different departments?

Are you using a PD profile to do so.

Kiran

[Former Member]

We use structural authorizations to restrict users to the subset of employee records that they are permitted to view/maintain. I've never heard IT1017 used in the context of this functionality though.. I set up profiles using transaction OOSP and assign them to users with OOSB.

Does that answer your question? If this sounds like a novice answer, it's because I am in fact a novice.

Thanks

[Former Member]

How do you determine the subset of employees? In the role, have you restricted it via personnel areas/employee group or subgroup? In the PD profile, have you specified the correct object id and evaluation path for object type Q or QK?

[Former Member]

Many users in our system are limited in which employees they can maintain by org unit (using structured authorizations, object type "O"). The users who currently maintain qualifications have access to all org units.

If I understand where you're going with this.. I would have to remove the "*" on object type Q and QK in their existing profiles, then create more restrictive profiles to assign each of the users based on the qualification or qualification groups they should be able to maintain. Is this correct?

[Former Member]

You are right.If you want users to have access to all org units but have restricted "maintain" access for Q,QK then remove * from object id's. For object type QK, specify the required catalog ids.

Hope this helps.

[Former Member]

Great, that helps! Thanks