Movement type restriction

[Former Member]

Hello Gurus,

I am facing a authorization issue. There are many transactions like QA 32, MIGO etc that use movement types like 300,301,303 etc. about 100 in count. There are many users that need different combinations of restrictions types. I found that we can use authorization object M_MSEG_BWA to restrict movement type.

But since there are around 70-80 users that need different combination of movement type, i m confused how to fulfill the requirement. One solution could be creating a roles for each user exclusively. But this is very tedious solution as i wil have to create 70 -80 roles.

Can any one help me out.

[Former Member]

Hi,

Other than master role and dervie role, I dont see any other method.

Find out from ABAper whether they have any solution?. In BI we have thru variable,where it pulls values from table.

Thanks,Sri

[mvoros]

Hi,

you have to maintain somewhere assignment between user and movement types. IMO the custom tables for this type of requirements is not the best option. It's much better if everything is under one roof. If you use roles then you know that for each new user you just need to create a master data for user. You don't have to go to SM30 and maintain additional entries. You avoid initial errors about missing authorization.

I would suggest to speak with functional guys or business users about unifying your business process. It's not really usual that you have around 70 users and each user has unique combination of movement types. Maybe you can identify a subset of the most common movement types which are assigned to each user and then sets of additional types. This might help you to minimize number of required roles.

If you can't minimize the number of roles then you can try to automate your role generation. Julius mentioned that they had a requirement where they had to create a large number of simple roles for various combination (don't remember what it was). As far as I remember they wrote a report which generates an output in upload format of PFCG. He might correct me if I am wrong or add additional info about their solution. But I guess that it would take more time to develop and test this report than manually create simple 80 roles.

Cheers

[Former Member]

Hello Martin,

Thx for the reply.

I thought that there will be some method to restrict the access on user level. I will get in touch with functional team and will ask them to send me user list department wise and ask them to categorize the users, so that i have to make less roles.

And can you please provide me more details about that automatic process of creating roles. I would really appreciate you help.

Thanks & Cheers..

[mvoros]

Hi,

I don't have more info about automatic generation of roles. As I mentioned in my previous post Julius Bussche mentioned this solution on this forum. So unless he adds his comment to this thread I can tell what I would do. I would create a simple example of my role in PFCG and download it to file. After that I would try to revere engineer format of this file and try to write a report which would generate files in this format.

Cheers

[Former Member]

Hi

This direction may help you a little, in SU01 under parameters tab you can maintain a parameter for each user and specify value .that parameter value will be used when user logged in .Check with ABAPERs if there is any parameter existing for movement types .if not there you can create customized one I believe

Please let us know incase you have solved your problem.