FP05 - how to restrict access to clarification post processing?

[Former Member]

Is there any standard way to restrict the user who manually creates payment lot in FP05 to not be able to post process the same directly thru FP05 post process option?

We want to have separate people doing FP05 and FPCPL.

[AmlanBanerjee]

Hi,

The Clarification list authorization is controlled by auth objects F_FMCA_SHE and F_FMSHER. You can remove these authorization objects from the User's Role and then check for the same.

Hope it helps...

Thanks,

Amlan

[Former Member]

Hi thanks for your quick response and suggestion. I don't see these authorization objects in SU24 for these Tcodes.

In fact after lot of research I see that auth object F_KKZK and S_CFC_AUTH can help me.

Are you sure that the two auth objects you have said really are the ones???

[AmlanBanerjee]

Hi,

I have checked the auth object F_KKZK previously and can confirm that it will not help as because the activity type (02 and 10) that is assigned for Postprocessing is also used for posting and changing the payment lot.

So, if you remove them, the users will not be able to post the payment lot as well.

The auth object S_CFC_AUTH is a general Auth object for all the clarification processes.So, if you remove it, then the Users will loose the authorization for all other clarifiaction worklist as well.

Now, on clicking the postprocess button in FP05, transaction code FP05CLE is executed.

So, if you remove the authorization of the transaction FP05CLE from the User's role,then they will not be able to do postprocessing from payment lot screen.

Please note that as there is no change in the access for the Transaction FPCPL, so users can go in to FPCPL and then re-process the items in the clarification worklist.

Hope it helps.

Thanks,

Amlan

[Former Member]

I have checked the auth object F_KKZK previously and can confirm that it will not help as because the activity type (02 and 10) that is assigned for Postprocessing is also used for posting and changing the payment lot.
So, if you remove them, the users will not be able to post the payment lot as well.

Thanks again for your quick response.

I tried this and I believe this is not the case.

F_KKZK - ALL checked

01    Create or generate

02    Change

03    Display

06    Delete

10    Post

S_CFC_AUTH - None checked

03    Display

05    Lock

10    Post

70    Administer

So since we have 10 Post available separately in both we can control them differently and my test also shows that.

I agree for change. But even if person having FPCPL change tries; ultimately he cannot post thru FPCPL directly as we can remove posting value 10 for FPCPL. So effectively change is not of much use to him per se. (Infact system is not allowing FPCPL change also and says - You do not have authorization to edit an appl. item with activity 10)

(Removal of access for all clarification activities is fine).

[Former Member]

Hi Sunando,

This is a great control on your process flow, there should really be two different personnel who will act on creating payment lot and the one who will act on posting the payment.

What you can do is create a role for the creator and another for poster.

For the creator, limit the actvt of F_KKZK to create.

For the poster, limit the activity to post.

Cheers,

Rod