RAR for BCS

[Former Member]

Hi Guys,

I am working on a ruleset for BCS and as part of this there is an SoD between Submission and Signoff for a particular company code.

This is all related to a single authorisation object (R_UC_TASK).

Submission is made up of the following:

Tcode Auth Obj Field Value

UCMON R_UC_TASK ACTVT 16

UCMON R_UC_TASK TASK SUBMITGRP

UCMON R_UC_TASK TASK_FLD2 Company code

Signoff is made up of the following:

Tcode Auth Obj Field Value

UCMON R_UC_TASK ACTVT 16

UCMON R_UC_TASK TASK ZSIGN*

UCMON R_UC_TASK TASK_FLD2 Company code

The SOD is only an issue when the person can perform both functions for the SAME Company code.

In ERP, this could be generated into an ORG unit and we could configure RAR to consider this via the Org Rules. The only way I can think of to do this for BW is to effectively create a function for Submit for every company code and also a function for every Sign off. These can then be configured individually as risks.

I have no desire to be hard coding in the Company code into the rules as that will have massive maintenance efforts and duplication of effort not to mention the potential performance impact on running the risk analysis.

If you can think of a better way of achieving this, I'm open to suggestions.

Simon

[Former Member · Accepted solution]

Hello Simon,

What i could understand from your problem is that you do not want to enter each and every company code into the rules so that they could give you correct SoD instead of false positive which exist when person cannot perform function is same company code but still shows as violation. If this is correct then, you do not need to put each and every company code in the functions permission object. All you need to do is put a $ sign in front of the org value. for eg. for BUKRS ideally you would replace it with the exact company code in the rules. However, when you will put it as $BUKRS instead of exact value in function permission then the system will automatically replace the exact value of company code in place of $BUKRS for performing risk analysis. So if a user is having multiple values of company codes associated with it, during the run time the system will automatically replace $BUKRS with each and everyone of them one-by-one to conduct risk analysis based on each and every company code and will show the result.

This way you are saved from the effort to duplicate the function permission and put each and every company code value there..

Hope it helps.

Regards, Varun

[Former Member]

Hello Simon,

Here is the link to documentation about org rules

https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/805a8744-42ab-2a10-5194-b45be270...

in this document it should tell you about exactly how you need to modify function permissions so that you do not have to put every org level value in it.

Regards, Varun

[Former Member]

Hi Varun,

Thanks for this. I already knew about Org levels but this is restricted to the ERP ones! I don't see how we can do this for BCS fields which are not set up as org level values.

If the backend authorisations are not already set as Org Levels, then RAR will not treat them as such. For the ERP side of things, this works but this does not seem to be available for the BCS side of things.

Effectively I would be looking for $TASK_FLD2 within the Auth object R_US_TASK but this is just a standard text field not an org level.

Simon