BI Analysis Auth object

[Former Member]

Hello guys, Can body please let me know how to solve " User is not Authorized " problem after executing the query.

trying to execute the query in SAP Backend system; it is pointing to sap netweaver portal; entering same user id and password of sap backend BI system ; then it is going to Bex Web browser and poping screen as " User is not Authorized "

Note : here we are not using portal system; giving same login credentails of backend BI system when it is popoing a screen while executing from the backend .

Steps followed :

1) Made info object Auth relevent

2) Created a new Analysis Auth object by Rsecadmin

2.1 ) provided the OTCAACTVT values as : 03,16,22

2.2) OTCAIPROV : given the infocube on which query build

2.3 ) OTCAVALID " *

2.4) Added " infoobject " and given the charterstic values in first tab and also in hiereacy authorizations " added Hierarchy name " ( type, HI, Validity range)

3) made a role by Assigng the Analysis auth object , Query, infoprovider .

4) Assigned the role to the user.

FYI: if i assign to test user 0BI_ALL auth object then it is performing well; but i don't want to give 0BI_ALL ; wants to give only Analysis Auth object which i created under S_RS_AUTH.

Please do let me know.

[Former Member]

Hi Ali,

You need to trace the authorization error. In BI system, goto transaction RSUDO, there give the test user ID, check box the logs option, make sure 1st option is selected below (RSRT report). Then execute. You need to give the query name for which the error occurs & then execute. You will then get the error as "no authorization". Go back to main page of RSUDO. Click on Analyze logs

You will find the missing authorizations shown in the logs.

You can also see the below threads:

/message/9047266#9047266 [original link is broken]

[Former Member]

Actuall when you are getting the user error , you can go to the backend system and take the SU53 for that user to see what is failing, have an end user role assigned to the user for S_RFC and S_( access control list ).

Report analysis you will have to follow Siddarth step, you can also do this from RSECADMIN if I remember correctly.

Edited by: Franklin Jayasim on Jul 16, 2010 1:05 AM

[Former Member]

Thanks Everybody for giving suggestions; I really appreciate alll your efforts.

I followed step by step book of kamaljeet and findout that , I was missing to add related info objects of the inforprovider .added those info objects to auth analysis object.

Now query is working fine without errors;

problem is i am not able to restict the query since it showing all the data ; i am trying to put only few values in "0wbs_elemt " .

I added 0wbs_elemt in my analysis auth object;

Clicked on 0wbs_elemt and kept values in value authorizations and also kept wbsh in hierarchy name , selected type 1, HI 0.

still i am unable to restrict the data;

Functinal consultants build WBSE set up on a hierarchy. like

18ICT-07/2011

18ICT-07/2011-1

18ICT-07/2011-1-AUDTM

18ICT-07/2011-1-AUDTM-01

18ICT-07/2011-1-CETX_

18ICT-07/2011-1-CETX_-01

they want to restrict like if we are giving 181ct-07 then they want to access every thing under it;

same way like 181ct-08 etc etc..

looks like they want to restrict the date very granuler level like restriction on " Attribute Navigation "

Can anybody please do let me know how can we achieve Navigation Restriction.

Thanks.

[Former Member]

Hi Ali MD,

Please look at object 0BWTC_C03_Q023 ( Using InfoObjects when Navigating )

Also please check out this link it talks about how you can lead yourself to find a solution

http://help.sap.com/saphelp_nw70/helpdata/en/a2/c3323c3980a57be10000000a11402f/frameset.htm

[Former Member]

Hi Ali,

Now query is working fine without errors;

problem is i am not able to restict the query since it showing all the data

You missed to remove infoobject which are restricted in other analysis.

or.

simply addd ZOBI_all by removing restricted infoobject from it.

2. What is length of OWBS_ELEMENT? What are the values you are assigning?

If length is 5, if values begin with A or B ( A00000 , please adjust the number of 0's or Z's depending on actual length)

if you are not able to restrict values then write a customer exit

Thanks,

Sri

Edited by: sri on Jul 16, 2010 2:25 PM

Edited by: sri on Jul 16, 2010 2:33 PM

[Former Member]

Just to clarify

The issue now is how to set security for BI Navigational attributes correct ( Granular level ?)

[Former Member]

I dont see a mention of activating the business content before you have done all this, please do that if you have not done it

give Complete hierarchy for test purpose and check.

[Former Member]

Hi Ali,

2.1 Make sure you give only : 3

Copy 0BI_ALL to Z0BI_ALL and remove restricted info objects and add it to s_RS_AUTH.

Why? From functional side we need provide input for fields which are not restricted.

Thanks,

Sri