Security in SAP BI 2004s

[Robert_Thompson]

Is it possible to assign an Authorization Role to a User's Position instead of assigning the Role to the individual's User ID. This is done in SAP ERP Security in order to minimize the changes required when a person is moved from one position to another. Is it possible to load/maintain the HR Positions and User IDs in BI via ALE and then use these positions for a position-based security model?

[Former Member]

Hi,

you can solve it with the HR structural authorization.

Check this:: http://sapbasis.msspro.com/securitydocs/structural_authorizations_step_by_step.doc

<a href="http://sapbasis.msspro.com/securitydocs/structural_authorizations_step_by_step.doc">http://sapbasis.msspro.com/securitydocs/structural_authorizations_step_by_step.doc</a>

hope it help's

[Robert_Thompson]

The functionality that we trying to implement is what SAP calls "Integration Using Organizational Management". While we have implemented this in our ERP system, we are trying to discover a way to keep our BI system in sync with the Position Assignments and relationships in the ERP System. The functionality is present in BI to create positions, and to use "relationships" to tie these positions to Users and Security Roles. These HR objects and relationships are stored in BI in tables HRP1000 and HRP1001. We are looking for a way to keep these tables in sync with the HRP1000 and HRP1001 tables that are maintained in our ERP system. If we tie BI Security Roles to positions instead of User IDs, whenever a person changes positions, that person will inherit new security roles according to the security roles that are tied to their new position. By keepng the BI HRP1000 & HRP1001 tables in sync with the ERP tables, position changes that occur in the ERP system would then be automatically carried through to the BI system.

[Former Member]

Hi Robert,

I haven't done this, but have a thought that may help you.

Have you considered using the Authorization DataStore Objects that exist in BI 7.0? They are named 0TCA_DS01 through 0TCA_DS05, and are used to automatically generate Analysis Authorizations, as well as assign them to users.

Once you copy them to your own namespace, you can then link them to your HR data using a DTP or other facility.

You can set up a process chain to load and activate the data, and then call the generation program. (RSSB_GENERATE_AUTHORIZATIONS)

Since the Analysis Authorizations can contain fields such as InfoProvider, User, Date to/from, and all Authorization-Relevant InfoObjects, you can set these up to suit your needs.

You can use the generation program to either create/change the authorizations, or just assign them to the users. (they are assigned directly to users, rather than existing in roles)

Hope that helps...

Cheers

rob

[Robert_Thompson]

Hello Rob,

Thanks for the info. I'll explore some of this functionality.

Thanks,

Robert