Change an Autotrization objet to an organisation level

[Former Member]

Hello Expert,

In my parent role there is an authorization object which we have changed in all derived roles.

But if we generate parent role, these old values disappear and we must restore it for each derived roles.

The values of organisation levels don't change if we generate the parent role and his derived.

SO, to resolve this probleme I suggest to transfert or change this Authorization object to organisation level.

Is this possible and how ??

If not, how can I resolve my probleme ??

Thanks all.

[sdipanjan]

Hi,

First of all, I must say that the concept in use to maintain your Ref-Der roles is totally Incorrect..!!!

Derive roles should only differ with each other in Organization Level Values and there should not be any change performed in Object level.

This is the most blunder people used to do while using Ref-Der role structure. Do Not change any Object in the derive roles and always Generate them from Reference roles.

If you want to maintain different values for a particular Object, then this should be included into different ref roles which also make sense to have same Job role hierarchy in different Org. Units. So, to resolve the issue, I would suggest you:

1. Either you do not make any change to that Object.

2. Or, distribute this change (if truly required) into different Reference roles. Means, segregation of duty for a particular process (may be a TCode / Connected chain of TCodes and same authorization Object pulled by them) as per the Job role. Then you derive those roles -> maintain Org. levels -> Add them to the User master either by direct assignment or through Composite roles.

Let me know for any confusion.

Regards,

Dipanjan

[Former Member]

AHH YES.

But, why we have the possibity to change values of authorization objets in derived roles??

What is exactly the difference between authorization objets an organization levels in a derived role??

For what we use:

- authorization objets

- organization levels

in derived roles ?

I have same confusion here.

Thank you very match.

[sdipanjan]

Hi,

When we use roles to provide certain access to users then we are basically maintaining those in (atomic structure you may say) Authorization Obejcts. Role itself doesn't provide any authorization, it points towards the Profile (generated) where these Authorizations are stored and which is understandable to system (in layman language). in a nutshell:

a. Role contains profile (in 1:1 ratio)

b. Profile contains Authorization

c. Authorization is defined as an Instance of an Authorization Object with all values.

d. These values are stored is stored in Authorization Fields (this is more granular layer - you may visualize as electron, proton, neutron layer)

So the exact authorization comes from a properly maintain Authorization field and then from the Object containing such a bunch of fields (these are check with AND operator while checking auth for users)

In SAP, *there are certain types of Authorization fields which are being used by several authorization objects. You can see them in PFCG -> Auhorization Data ... These fields need exactly same value for all the Objects using in a particular role. For ease of maintenance of authorization data, SAP marked them with a new property called as Organization Levels*. So, you don't need to put the same value to those fields in every occurrence, rather you will maintain those fields from a Central Position.

You can see the list of SAP delivered Organization Level fields in table USORG.

Now i hope you have got some idea of Authorization Object, Authorization Field and Organization Filed.

(you can go through ADM 940 book for more detailed information on this topic).

Feel free to ask us for any sort of query.

Regards,

Dipanjan

[Former Member]

> But, why we have the possibity to change values of authorization objets in derived roles??

Not sure, but it can be usefull to build roles using a parent role with derived org roles up to a certain point, and then divorce them from the parent when they reach a level of "maturity" where you want them to survive on their own.

But then you should "retire" the parent role.

People make mistakes as well, which only become apparent later.

Cheers,

Julius

[Former Member]

> a. Role contains profile (in 1:1 ratio)

This might not be correct in all the cases. In case of very big role having a lot of transactions, it can have more than 1 profile.

Regards,

Edited by: Lakshmi Venigala on May 12, 2009 8:41 AM

[sdipanjan]

No it is Not correct. One Role contains exactly One Profile.

Regards,

Dipanjan

[Former Member]

Round 1 goes to Lakshmi...

[sdipanjan]

Hi,

Every role is pointed towards exactly one profile. You may argue when you see more than one entry in the profile tab. But please keep in mind that the entries in the profile tab in PFCG are enlisted with succeeding counters (nn). These are known as Profile Torso and holds the extra authorization when number of authorization instance exceeds limit (as Laxmi said).

To make you more clear: Please answer me one question: When you generate the Profile of a Role, how many Profile name SAP proposes to you? More than One?

Ref: SAP Authorization System by SAP Press.

Regards,

Dipanjan

[Former Member]

Round 2 goes to Dipanjan...

[Former Member]

It is one profil

[Former Member]

Using SE16 you can find various tables that hold Role/ProfileInformation:

AGR_1016: Role to Profile.

AGR_PROF: Role - Profile - Text

PRGN_CUST: Profile Generator customization settings

USOBT_C: Default values for Profile Generator

USOBX_C: Check indicators for Profile Generator

USR11: Profile description

USR04: user profile assignments

UST10C: Composite Profiles

UST10S: Simple Profiles

[Former Member]

I have created a simple parent role and I have added to this role the transaction SE11.

I find in this role many authorization objects as S_DEVELOP for ABAP workbench.

In the field ACTVT of this object, there are many values:

01: create or generate

02: change

03: Display

06: delete

07: Avtivate, generate.

Now I can affect this role to an user without problemes.

But Now I want affect to another user the same transaction and authorisations

without possibilties Delete (06) in S_DEVELOP.

So what can I do for that?

I have to create a derived role of this role and disactivate option 06: delete in S_DEVELOP?

Or I have to create organization levels? Or what ??

N.B: I don't have organization levels in this role.

Thanks.

[Former Member]

>

> To make you more clear: Please answer me one question: When you generate the Profile of a Role, how many Profile name SAP proposes to you? More than One?

To make it less clear again, when you look in SU02 does that single profile contain all the data or do you have to look in the subsequent generated profiles too?

It seems SAP treats them in 2 ways:

As a single profile (profile creation - simplification is the key to the profile generator)

As multiple profiles (assignment to user & in SU02, probably user buffer population too)

[Former Member]

> But Now I want affect to another user the same transaction and authorisations

> without possibilties Delete (06) in S_DEVELOP.

One option is to remove 06 from SU24 as you only want it for the SE11 object types for "special users" - they should not have 06 simply on the grounds of having SE11.

Then either identify a role or transaction from which those "special users" only can derive this authorization value and ensure that it is a proposed value there, or, you could possibly also edit the object for that "special role" which will set the authorization to "Changed" status and SU24 will ignore it in future.

Cheers,

Julius

[Former Member]

Thank you for this answer.

So I don't need to create derived role.

But if I change se11 in SU24, it will be changed for all the roles where there is se11??

And if I want to create others roles with others values in this objects, I have to modify

SE11 whenever before to create a role ???

best regards

[sdipanjan]

Hi,

> So I don't need to create derived role. Yes, you Don't need.

>

> But if I change se11 in SU24, it will be changed for all the roles where there is se11?? Yes

>

> And if I want to create others roles with others values in this objects, I have to modify

> SE11 whenever before to create a role ???

No, it is not like that. When you are in PFCG.. Authorization Data... Just Copy the Authorization Object S_DEVELOP and then deactivate the "Standard" Object pulled by SE11. Now remove the field value from ACTVT (or any field you want) from the Copied S_DEVELOP.

I totally agree with Julius to remove ACTVT = 06 from SU24 while you are maintaining the roles.

Regards,

Dipanjan

[Former Member]

But if I change se11 in SU24, it will be changed for all the roles where there is se11?? Yes

I don't want to delete this option for all roles, I want do this just for my new role.

So If I understand you Dipanjan Sanpui, I don't need to use su24. I will just copy my role and

change the values witch I need and affect my new role to the user.

[Former Member]

Best is to make a general decision about changing SU24 and stick to it.

Using the "least number of roles affected" is tempting, but will confuse you when you see a Changed or Manually authorization.

In my opinion there should be less impact for special users, possibly less roles and certainly more transaction contexts to use for bringing in the special authority.

Try to keep your end user roles clean and maintain SU24 for them, make exceptions for special users only. This also makes it more analyzable (and auditable...).

Cheers,

Julius

[Former Member]

This message was moderated.

[jurjen_heeck]

> But if I change se11 in SU24, it will be changed for all the roles where there is se11?? Yes

>

> I don't want to delete this option for all roles, I want do this just for my new role.

It will not automatically update existing roles. Only in new roles and roles where you modify the profile and choose 'merge' when editing the profile.

[Former Member]

Not all objects and fields are appropriate for org levels, but if you want to deviate from what SAP delivers you can search for [org field create|https://forums.sdn.sap.com/search.jspa?objID=f208&q=orgfieldcreate].

Cheers,

Julius