BW authorization objects in BO

[former_member185138]

HI All,

We are in process of integration with BW server and facing a roadblock in importing the SAP BW roles in BO server.

We would need them to apply the data level restriction in BO.

BW team has used a new concept "Authorization Objects" for applying the security.

I am able to see all the roles in the import tab in CMC but not the Authorization objects.

Are Authorization objects supported in BO if not what can be the workaround?

[Former Member · Accepted solution]

Hi S N,

The authorization objects is not be available in BO. 

You should make use of the imported roles in setting security on folder / report level in BO.  Ultimately, because your data resides on BW, the authorization objects will determine what data is presented to the user.

To summarize:

- Security on the BO server determines which folders / reports the user is able to access

- Security on BW determines the data the user will see in the end

[former_member185138]

Thanks a lot everyone

[Former Member]

Hi SN,

BW Authorizations can be achieve in BO easily, below are the steps:

Create Authorizations in BW,

Use Authorization variable in the query or that infoobjecty or not its ur wish.

In BO > CMC > Authentication > SAP > Add the roles on which the users are part of.

Goto last tab of the SAP AUTH plugin and Sync users manually.

All users of that role will be imported in BO.

Create a BICS connection with Single Sign On, and use SAP AUthentication for login.

The user which will login will only see his authorized data.

also you can use third party users like AD, LDAP to alias with SAP user for that you have to use:

SNC for UNV approach

STS for BICS.

I hope this helps.

Thanks,

Avinash

[former_member185138]

Thanks a lot Cobus,Anil and Ashutosh for the response.

How will we import the SAP users then?

I mean do i need to import all the roles available in the BW system.

[Former Member]

Hi S N,

You can find all this information in the Admin Guide.

In our case we import the BW roles into the BI system and use these roles for folder level auths.  The answer to your question would depend on what kind of log on type you will be using (Enterprise, SAP BW, LDAP etc).

From the home screen in the CMC you can navigate to Authentication then in here you will see your available options.

[Former Member]

Hi S N,

You will find detail information in Admin guide under SAP authentication topic.

If you want all roles present in SAP BW in BO then you can import them otherwise you can import only required SAP roles in BO. With SAP roles, associated SAP users will also be imported in BO.

For more info related SAP SSO, you can refer below mentioned URL:

http://wiki.sdn.sap.com/wiki/display/BOBJ/Setup+of+SAP+SSO+Service+in+SAP+BO+BI4.0+CMC

Regards,

Aashutosh

[Former Member]

Hi S N,

If you are using single sign on in OLAP connections then based on user's authorization in BW, the data retrieved in reports. Hence, you need not worry about data level security in BO as it is taken care by BW itself.

But if you are using universe(UNX), you can apply data level restriction (row level and column level security) in IDT using security editor.

Regards,

Aashutosh

[Former Member]

hi SN,

In BW a new authorization concept came with 7.0 onwards differentiating object and data authorizations. Objects are secured with the same roles concepts and data is restricted with Analysis Authorization.

In BO - pulling data from SAP BW, will already be securing data level authorization when a report is executed by user; referring users log in ID.

Hope this clarifies what you required.

Regards,

Anil