Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Need to restrict HR payroll Roles on Payroll area

Former Member
0 Kudos

Hi,

Can anybody pls guide me how can i restrict HR payroll roles on Payroll area Level.As of now system is not checking the payroll area value as authorization relevant.

if the solution is through org key, pls explain the detail process of using org key.

if it is through custom object, pls clarify the implication on the system once we run the standard program.

Secondly i also want to restrict the roles on Personal Sub area level and OM roles on Org.ID level.

appericiate your early response.

Regards,

Ramakrishna

9 REPLIES 9

Former Member
0 Kudos

Hi Ramakrishna,

Could u pls tell me wat exactly u want to restrict?I mean query components or access to workbench objects like infoareas, infocubes etc..

Regard,

Jaya

0 Kudos

Hi Jaya,

my requirement is i want to create payroll roles, with payroll area wise.I want to restrict the users to run the payroll for respective payrol areas.

Thanks,

Ramakrishna

Former Member
0 Kudos

Hi,

Sorry to bug u again n again.Actually i dont have domain knowledge on HR.

What i understood is u have a payroll information and that info is divided area wise and now if the user is from area-1 he should be able to see only the info related to area-1 and not able to see any other data.

Please let me know whether my understanding is right. Hope i can help u if this is the case.

Regards,

Jaya

Former Member
0 Kudos

Hi Ramkey,

HR Roles having following Organizational things. These are

1. Personnel area

2. Employee group

3. Employee Sub group and Etc. If u have that levels u can create easily pay role area wise. U

ask ur Functional Consultant(HR).

Regards

kesav

0 Kudos

Hi keshav,

i have all the levels and values which are mentioned by you.

can u pls explain the process/procedure to restrict at payroll area level through roles.

0 Kudos

Okay, let's get technical. Maybe this wil help to elaborate on this question further

- Read/Create/etc. access to Infotypes (i.e. for employees or applicants) can easily be set up with authorization objects P_ORGIN, P_ORGXX or P_ORGINCON, P_ORGXXCON if structural auth profiles are used. It has got the appropriate fields for employee group, sub group, area, and so on.

- But if we look at the object controlling the start/simulation of payroll processing - which is as far as I know P_PCLX - there are no such fields. Maybe this is part of the question?

Or there's simply a lack of role build knowledge here.

KRReddy, are you familiar with building roles and authorizations with PFCG?

Former Member
0 Kudos

Hi jaya,

yes i want to restrict the users with respective to their payroll area only.I am not using structural authorizations.

Former Member
0 Kudos

Hello everyone,

I was in here searching for a way to secure by Pay Area or something that I haven't thought of, and I guess there isn't a way, as of yet..

We currently run payrolls for several different countries. I secure by Personnel Area, Cluster and Pay Area. (However, Pay Area only restricts the PA03 trnansaction. It is very limited. )

So, I use the Organizational Levels and/ or P_Orgin Personnel Area and limit the users to their specific cluster as well. So, for example, we have a Payroll in India. We have all the India employees in the Personnel Area of X5IN. And, I secure the P_PCLX cluster for IN. They do not get AU (Australia), (CN (China), etc.

IT works so far for about 6 payrolls but our new payroll may have 2 Pay Areas and only 1 Personnel Area. Hence, the reason I was in here searching.

IHopefully, this gives you some help to resolving your issue.

Thanks,

Penny

Frank_Buchholz
Advisor
Advisor
0 Kudos

Hi Ramakrishna,

According to the documentation it seems to be possible to check authorizations for the payroll area with the authorization field VDSK1 of the authorization Object P_ORGIN if the feature VDSK1 is mapped to the payroll area. (However, I'm not sure about this because I never have worked with this option myself.)

Online help

[VDSK1 (Organizational Key)|http://help.sap.com/saphelp_470/helpdata/en/17/4bba3b3bf00152e10000000a114084/frameset.htm]

If you use this authorization field VDSK1 this way I suggest to turn it into an "Org. Level" field using report PFCG_ORGFIELD_CREATE, too. This enables you to work with derived roles instead of normal roles. See note [323817 |https://service.sap.com/sap/support/notes/323817] "Creating org.level fields for the Profile Generator" .

Kind regards

Frank Buchholz