Delimit a authorization role for a period..

[Former Member]

Hi all,

I would like to delimit a role for a period because we have a OM Maintain stop. Therefore I want to deactivate the OM role so that nobody will maintain the OM structure by accident.

In PFCG it is not possible to set a period. Is there another option to deactivate a specific role?

[Former Member · Accepted solution]

Hi Becksen,

There are multiple ways of doing it. One of them is given below:

1 - Take out the list of all the userIds who have that role assigned currently. This can be done by the user of agr_users table.

2 - Now take the help of SU10(Mass user maintenance) , put all the user Ids at one go> Change> Role tab-> Enter the role name and the delimition period i.e If you want the role to be delimited between 02.03.2010 to 05.03.2010 then first expire the role on 02.03.2010 by putting the expiry date -->click on save. Then again assign the same role through SU10 for same set of user starting from 05.03.2010 to 30.12.9999

Let us know if that worked out. )

[Former Member · Accepted solution]

Hi sap.sec.akshay ,

thanks for your hint.

I tried it but the issue is, that changes with SU10 seem only to affect direct role assingments. Unfortunately we have indirect role assignments through positions, therefore I the solution does not have the expected effect.

[Former Member · Accepted solution]

Hi becksen,

Search this forum with key work"Indirect role assignment" you might get your answer.One of the thread link is pasted below:

[Former Member · Accepted solution]

Hi,

that is exactly what I was searching for. Thx.

For every body who looking for SAP Note 578271with the detailed decription follow the link.

[https://websmp230.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=578271|https://websmp230.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=578271]

[Former Member]

Hi Becksen,

The same is already discussed in sdn. So, for you refrence check the link below.

Hope this helps