Restrict Cost Center Report KSB1 or S_ALR_87013611 by Employee Subgroup

[Former Member]

Hi

Having searched the threads, I have found similar issues but very few with difinitive answers. So I thought I would popst in detail.

I have a requirement to provide users within the business access to Cost Centre Reports while restricting Employee Subgroup 12 from being displayed.

I copied a User with access to a role that contains the following Auth Objects and Activities:

S_TCODE

Transaction Code S_ALR_8701361

P_ORGIN

Authorization level E, M, R, S, W

Infotype 0001

Personnel Area DB, LO (internal master)

Employee Group *

Employee Subgroup 01-11, 13-99

Subtype *

Organizational Key *

P_PCLX

Authorization level R

Area identifier for cluster in B1, B2, CU, PC, TX

P_PYEVDOC

Activity 03, 28

Company Code X, Y (substitued for real values)

The User also has a role with Auth Object

K_REPO_CCA

Activity 27, 28, 29

Controlling Area *

Cost Center *

Cost Element *

The User executes S_ALR_8701361 (which calls KSB1) and I ran a trace. The User is able to drill down line items and display data from employee subgroup 12. When I removed Activity 28 from Auth Object P_PYEVDOC, the user can no longer drill down so this doesnt serve the right purpose either.

From the trace it is hard to evaluate where Employee Subgroup 12 is being checked if at all. We would like Managers to be able to view costings for the Salary & Wages Cost Element but only for the likes of contractors or employees being paid weekly/fortnightly (the latter 2 being identified by Employee Subgroups).

Is it possible to restrict this so that Employee Subgroup can be ommitted from the report or would a custom transaction be required in this case?

regards

Nicholas

[Former Member]

Nicholas,

KSB1 beiing indirectly called thru tcode S_ALR_87013611

The User also has a role with Auth Object

K_REPO_CCA

Activity 27, 28, 29 ( try to remove 28 ) and see whether it works.

IPls search on google : KSB1 Restrict viewing of salary cost elements

Thanks,

Sri

[Former Member]

As far as my memory goes restrictions using SAP standard security for Employee subgroup is really challenging

you are heading for customization for this scenario.

I will update with the correct note regarding this in a short while.