Restrict all ECC6 roles on Comp Code / Plant restrictions

[Former Member]

Hi

thanks for your time and trying to help in advance

we have a requriement where we need to restrict all roles in ECC6 to a combination of Comp Code & plant to which they belong with few exceptions

we dont want to go the route of derived roles due to huge maintennace , are there any custom developments options where in we can restrict based on an user exit or create a custom table and check with the user runs a bunch of tcodes ( problem is its not just one as in ECC6 we need this restriction for large number of tcodes and multiple roles

is it worth looking at any options ?

thanks

[former_member701183]

Hi,

The general convention is the creation of derived roles as per the CC and seggregation implemented via ORG level values. It wont be prudent to use some other technique for this purpose.

Regards

Aveek.

[Former Member]

Hi,

Do the job with derived roles. This will save considerable time and expense over trying something like dynamically entering CC/Plant into an auth check as it would involve modifying hundreds of SAP programs (as you have already identified).

If you suddenly have a new restriction requirement then your company/client need to accept that there will be an overhead for the change.

One method that may be mentioned is "value roles" or "enabler roles" (if you use the search for term = enabler, you will get some info), but while they may slightly reduce time to implement these, the ongoing support will be increased and there is a high potential to leave your build in tatters.