transaction S_BCE_68001397

[Former Member]

Best Regards,

Someone could help me please, I have a transaction S_BCE_68001397 objet M_MSEG_WWA in field center, the data value value, the data shows me that income shows everything related to the entered letters:

Example: Join in CO06 value center and shows me everything that contains that letter as CO60, CO61.CO10

I need show only CO06

Thank you very much

Liliana

[Former Member]

Hi Liliana,

If I understand you correctly, you are getting more roles returned in your query than you are expecting, and some of these appear to be incorrect - for example you are seeing roles that are named xx_CO61 when you only want to see xx_CO60?

In your screenshots, you only show the names of the roles that are returned. A name is just a name, and does not necessarily mean that the authorisations contained within that role match the name.

Try selecting one of the roles that appears to be incorrect, and display that role in PFCG. In the authorization data, look for the object M_MSEG_WWA, and see what values are entered in the CENTRO field. I suspect you may find that the field is maintained with CO60, CO61 and CO10, or more likely CO*.

[Former Member]

Hi,

Agree with Will. You might also have roles with "*". Please, take a group of roles and check the authorizations in order to know what's exactly going on. The report itself shouldn't have any issue itself.

I'd check using values centro="*" (do not forget the quotes!) for example, or centro=CO* as Will already mentioned.

This kind of things are usually the result of an incorrect role implementation.

Cheers!

Diego.

[Former Member]

Regards Will and Diego.

Thank you very much for your answer, yes, you're right only show the image, not actually present but look directly entering each role and looking for the object pointed M_MSEG_WWA shows that brings everything CO06 containing the text, may be normal in center field have admitted several centers but look who mostly just a center and not just the one I'm looking for.

I found several notes which correct the inconvenience but I have installed and I also indicate the Support Package corrects it but I applied because I have a more advanced version  Support Package (SAPKB70025)

https://websmp230.sap-ag.de/sap(bD1lcyZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=882205
https://websmp230.sap-ag.de/sap(bD1lcyZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=823915
https://websmp230.sap-ag.de/sap(bD1lcyZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=0000847027&nla...

By consulting as indicated Diego, entering the center field "CO06" reducing the number of roles but also are not correct, as centers sample CO61, CO62 having only permit a single center.

Appreciate all the help you can give me.

Liliana

[Former Member]

Hola Liliana,

mmmhhh.. I refuse to believe that this is a report issue... I mean, it could be, but at your SP level... it's weird. And your query is very simple to be prone to errors.

I'd perform the same query, but instead of looking for roles, I'd look for profiles. You can also do the same by checking table UST12 with SE16 for example. You should look for the authorization ID (field AUTH). You have to activate the technical names in PFCG for that. With one of the authorizations IDs of one of your latest examples, you should

search for it in table UST12.

If you have differences, it could be due to a pending profile generation in the role. Despite what you see in the role using PFCG, if

the profile isn't generated in its last version it could contain different authorizations.

And a final question: do you know if the user who has these roles is able to operate in the plants??

Cheers,

Diego.

[Former Member]

Yes, I am also a little confused how this could be happening, but I have seen some screwy results from SUIM queries before. Some other things I would look at:

1. Check the roles in table AGR_1252 (query on the CENTRO field) and see if this matches what you see in PFCG.

2. When looking at the role in PFCG, click the "Organizational Levels" button, and see if the values entered for CENTRO match what is showing in the object field.

I am assuming that your organisation has not "demoted" Centres and that it is still an Org Level field. If so, I wonder if maybe someone has maintained the field at object level (*see edit*), and that the Org Levels dialog is what is being read by the query.

3. Simplify the query right down to the M_MSEG_WWA object, and only one Activity (don't put anything in the "or" fields), and the Centre, and see what this returns.

These are only some suggestions but they might put a bit more light on the problem.

*edit* This is the third time I've edited this, because I've just realised my understanding of Spanish is terrible. Does "modificado" mean "changed"? If so, then I think my suggestion may be why you have this problem. If it means "maintained", then my suggestion is almost certainly not correct.

[Former Member]

Hello Will,

*edit* This is the third time I've edited this, because I've just realised my understanding of Spanish is terrible. Does "modificado" mean "changed"? If so, then I think my suggestion may be why you have this problem. If it means "maintained", then my suggestion is almost certainly not correct.

Despite my native language is Spanish, I usually log on in English to avoid confusions and missing translations

Modificado = Changed

Mantained = Actualizado

Estándar= Standard

..... and so forth.

And I'm looking forward to hear news from Liliana...

Cheers!

Diego.

[Former Member]

Hello Diego and Will

Again thank you very much for the cooperation.

I tell them I followed your instructions and here I show the pictures, there is something that I can serve and that he had not commented before because I had not noticed, we are consulting roles that are derived from a single role, I placed only one example of roles but my question would be where he is trying to bring the field or a composite role?

thanks

Liliana

[Former Member]

Hi Liliana,

Your derived roles seem to be OK.

Could you perform the same query mentioned in your first message, but instead of roles->by authorization values, search for profiles->by authorization values using transaction SUIM?

Check if the profile of the role: ZD:MM:G:IM:GOOD_MOV_261_2_C060   (see authorization tab) is part of the results.

Cheers,

Diego.

[Former Member]

I agree, the derived roles look ok.

Liliana - can you confirm that you checked the organizational levels for the Centro field either in table AGR_1252 or by looking in the organizational level dialog in one of the child roles? Were they the same?

Diego - many thanks for the translation - I can now add three more Spanish words to my vocabulary. Cerveza is still my favourite, but of little use in SAP Security. Although now I come to think of it...

[Former Member]

Hi Diego,

I followed your steps as directed by Will saw that the level of organization if same in both roles, simple and compound.

As I watch you indicate that T-PD304326 profile is not in the values ​​of the Suim authorization, check it in the pictures please.

Was this the real reason?

Liliana

[Former Member]

Hi Will,

I followed your instructions and the level of organization if same in both roles, simple and compound. SE16 and the PFCG

Look at the pictures

Liliana

[Former Member]

Hi Liliana,

Ok, I was expecting the single and compound / composite roles to look the same, but I was thinking that maybe there had been some manual editing of the org levels in the single roles.

But as you say this does not seem to be the case, and the AGR_1252 picture looks correct.

So let's see what Diego can suggest - I will keep thinking in the meantime

[Former Member]

Hello Liliana,

Are you sure that you've performed the same query as in your first message but asking for profiles instead of roles??? I mean... you have a huge difference: 23 roles, but only 2 generated profiles???.

I can also infer that profiles are generated in production system directly, am I correct?

As per profile names, I guess that they where generated in PRD system (Note 1380203):

"...During automatic profile name generation, the system uses the first and third character of the three-character system ID to determine the third and fourth character in the profile name..."

Then a profile named T-PDXXXXXXX means that the profile was generated in a system named P?D.

Do you know exactly how these roles/profiles get the production system?

Cheers,

Diego.

[Former Member]

Hi Diego,

Thanks for all the assistance provided

regards

Liliana