Restriction on cost/revenue reports on roles

[Former Member]

Hello Experts,

My client deals with Power and Infra and has a requirement that at least 5 senior level project executives has to be assigned a same role within the same plant and should be authorized for all project profiles/types. These 5 senior executives should be able to view only cost/reports for the projects these executives are working on and should not be able to view all the projects in the plant.

Is that possible.? I am already in touch with Basis consultant and he is working on this. Is there any other alternative that can be look upon.?

Thanks,

Lakshmi Shukla

[Former Member · Accepted solution]

Hello Experts,

Is there any enhancement available for this purpose.?

Thanks,

Lakshmi Shukla

[Former Member · Accepted solution]

Hi,

I can see that experts have suggested you to reach out to your security consultant. It would be good if you can provide us the outcome of the conversation that happened between you and your security consultant before you ask for another question.

Anyways, since you have asked. Then, you may go for CNEX0002 enhancement. If it does not work for you then you can try using the same report Enhancement: i.e S38MREP1 - Exit at start report and RTR00010 - Exit in report tree (display transactions). You should use the code in following way

“AUTHORITY-CHECK OBJECT ‘A_S_GSBER’

ID ‘BUKRS’ FIELD i_bukrs

ID ‘GSBER’ FIELD wt_tab-gsber.”

Assign them in the person responsible field in their project. Then run a report using the dynamic selection on person responsible.

Discuss this process with your security consultant and let me know if it works. Else, wait for other experts to comment on this.

Regards,

Amit

[Former Member · Accepted solution]

Thanks,

Issue Closed.

[Former Member]

Hi,

Did you get a chance to discuss with your security team before positng this requirement? if so what was there response to your requirement. Let them set up test role and test accordingly. you need not to provide any authhorization object since they are very well aware which objects to pick up.

Discuss with your Security team and still not resolved you can post your requirement with specific question.

Thanks,

Sudhakar

[Former Member]

Hi,

If Plant is same, check If Profit Center is different for all 5 projects, then roles can be created with restriction of Profit Center.  Check for Auth Object C_PROJ_PRC  with your Basis Team.

Regrads

Shishir

[former_member195427]

Hi

For reporting authorization : Create a Z-Role as  ZS_COMP_PS_GEN_REP_DISP and input reports transaction into 'Menu' tab of this role. Insert the name of all those executives under 'User' tab (PFCG) to whom you want to authorize for displaying reports.

Now, if these reports are made to display specific projects then you have to do little development.

Example: CJI3, You create a screen format through development just like CJI3 and make fields project,posting date, layout etc. as input fields and during execution of it you need to call the standard transaction CJI3 using 'Call Transaction' functionality in ABAP and it will ultimately display project specific data. (You can develop 5 screens this way and can freeze project id's there also)

It's a bit tedious but can be effective. (tedious because you are not sure about the nomber of reports they will be using), a single screen can also be used to call multiple transactions with some preconditions, but it all depends upon ABAPer.

(The above is more useful when authorization comes specific to project id)

Now, to authorize as per project type use Auth. Obj C_PRPS_ART,

To authorize specifically to transaction, use Auth. Obj. C_PROJ_TCD

Regards

Saurabh

[MTerence]

Hi,

Do reach out a Security Consultant, who can easily help you out on this.

We have composite and single roles in security, you can have these reports added to the single role and assign to the composite role, make sure you are not having other transaction under other roles.

In one of our project we have moved all reports into couple of roles for PS, and we provide the roles to respective users.

This is simple, get in touch with a Security Consultant.

Thanks

Terence

[Former Member]

Hi,

Why dont you put a customer object for PS (like WERKS Plant) in tcode PFCG, then give only one role for all your 5 senior executives assigned in a project.?

Regards,

Amit