Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Segregation of global layout and user Specific for IW38 with Activity 23

Former Member
0 Kudos

Hi All,

We have issue that users are able to change the Global Layout in IW38 transaction codes, which is causing lot of confusion for other users. Please can anyone help me to do some investigation around how the access to Global Layout and User-Specific layout can be segregated.

We would like to achieve below things:

1) Can we control provision access in such way users can only change layout specific to them?

2) They should not be able to change Global Layout

3) List of roles having Authorization object S_ALV_LAYO with activity 23.

If anyone already faced this issue, can you please let me know how they resolved it

Thanks in Advance.

8 REPLIES 8

martin_voros
Active Contributor
0 Kudos

Hi,

I am really confused because it looks like the answer is in your question. You can use authorization object S_ALV_LAYO to give user authorization to define global layout. Just use one of the reports from SUIM to get all roles with this authorization object and remove it from roles in which you don't want to have this authorization. Or use another report from SUIM to get list of users with authorization to change global layout. Or am I missing something?

Cheers

Henrik1
Participant
0 Kudos

If they are not allowed to maintain global layouts, you need to remove the object from all roles. They should be allowed to maintain their own layouts without this object.

Or am misunderstanding something here?

arpan_paik
Active Contributor
0 Kudos

For working with own layout object is F_IT_ALV. Regarding S_ALV_LAYO, should be given to selected people only suppose to make changes to global layout.

Former Member
0 Kudos

The question is not closed... so I'll take a shot at it.

Object for global layout S_ALV_LAYO has only one valid activity, which is 23 (maintain). However, leaving the activity field blank will give users DISPLAY ONLY of global layout. One tricky thing, I believe if the user has S_ALV_LAYO with 23 in one of thier many assigned roles (perhaps for one report auth.), s/he will still be able to change/overwrite all reports they have access to in other roles.

I recommend completely removing S_ALV_LAYO from individual roles, and include it in the generic system role given to all users (the role authorizing printing, RFC, etc.) with the blank value as DISPLAY GLOBAL LAYOUT only.

Create a separate role just for S_ALV_LAYO w/ 23 (maintain) access, and only then assign that separately to head managers of department, etc.

Good luck

Alice

0 Kudos

Hi Alice

I used this thread to restrict access to global variants a couple of months ago based on Arpan's advice - F_IT_ALV seems to work fine although we never worked out what the 'administer' activity meant. The hardest part was convincing the support unit as to who should be contacted to advise on the changes and who should be responsible for the global variants long term (S_ALV_LAYO)

should be given to selected people only suppose to make changes to global layout.

.

I recommend completely removing S_ALV_LAYO from individual roles, and include it in the generic system role given to all users (the role authorizing printing, RFC, etc.) with the blank value as DISPLAY GLOBAL LAYOUT only.

The standard S_ALV_LAYO object is, so far as I know, no use for normal day to day end users as it over-rides the restrictions?

Cheers

David

Edited by: David Berry on May 23, 2011 10:55 PM

0 Kudos

Hi David,

> The standard S_ALV_LAYO object is, so far as I know, no use for normal day to day end users as it over-rides the restrictions?

It's up to the business, but ours wanted the managers to set a global layout for all other users to display only... as sort of a standard report. I agree with you in the challenge of determining who to give the long-term S_ALV_LAYO w/23 global maintenance access. We used to have this S_ALV_LAYO in every role that contained a report access (honest design mistake), hence that is why we created a separate role contained just S_ALV_LAYO w/ 23 access --> to managers only.

In our generic system role that is given to everyone, we have both S_ALV_LAYO (as blank) and F_IT_ALV (as 01, 02) so all non-manager users are able to create/save local layout & still view global layout.

F_IT_ALV activity 70 gives the authority to overwrite other's local layout (the "Manage Layout" access), so we only gave 01 and 02. Be careful here, as giving 03 (display) will make all other activities inactive.

Best,

Alice

0 Kudos

Hi Alice

So - the administer allows a user to select another local variant created by another user and modify it? When testing we couldn't work out what the 'extra' activity was allowing so I'll look at this once I get a chance to access another SAP system. Thanks also for the nod on the 03 activity: again I'll check out the functionality once able.

Maybe the OP GummadiSrikanth can provide some test results for the thread?

Kind regards

David

Edited by: David Berry on May 24, 2011 10:50 PM

0 Kudos

The hardest part was convincing the support unit as to who should be contacted to advise on the changes and who should be responsible for the global variants long term (S_ALV_LAYO)

Some people take things into account once they are hit. May you should wait for the moment of glory;-)

we have both S_ALV_LAYO (as blank) and F_IT_ALV (as 01, 02) so all non-manager users are able to create/save local layout & still view global layout

Completely removing object S_ALV_LAYO (or inactive) will also work. Basically to view global layout this is not required.

Be careful here, as giving 03 (display) will make all other activities inactive

I have given 03 activity with 01, 02 and it is working fine.

Regards,

Arpan Paik