Other partners than Change Manager allowed to change Approval Procedure

[vervinckt_joyca]

Dear experts,

I have activated the enhanced approval procedure and granted the authorizations as mentioned in the blog post.

I have a user, TEST_ANALYST, who has authorizations that give him CRM_APPRVL with activities 01, 02 and 03; plus SM_APP_AP with activity 02, which should grant him the possibility to change the approval procedure on request for changes.

However this user was not able to change the approval procesure.

I meanwhile found the reaction of on one of the questions of his blog post that helped me understand the issue:

My user TEST_ANALYST should be the "change manager" (renamed to Business Responsible Lead in my screenshot) to be able to change the approval procedure.

So I want to know: is there a way to change this behavior? I want my Analyst to be able to change the Approval Procedure too, without having to assign him as change manager. And I don't want to give him admin rights because I don't want him to approve the approval steps.

Thanks,

Joyca

[vervinckt_joyca]

I went into debug and found out that apparently, there is nothing to be done about this behavior (without changing the code ofcourse).

When checking if the approval procedure should be locked, it is checked if your user is assigned as "change manager". If you are NOT assigned as change manager, then the authorization check is skipped and the approval procedure field is just locked. If you ARE the change manager, then approval object SM_APP_AP is checked fir value "02".

So I checked if I could add my "Approver" partner function as change manager.

But unfortunately, that didn't work either. When checking which partnerfunction classifies as "change manager", table AIC_PARTNER_FCT is checked. But even if I set my Analyst partnerfunction as "CHNG_MANGR" in that table, afterwards the table is sorted an ONLY the first entry is taken out, which is again the standard SDCR0002 change manager partnerfunction. And I do still want that one to be able to change the approval procedure, so I won't switch the two around.

So conclusion: what I want is not possible without adjusting code.

It's too bad that this check on Change Manager is added in there... I haven't really seen this documented in approval procedure documents, nor on the SM_APP_AP authorization object documentation.

[Former Member]

Joyca,

I could see it from the level of depth you tried to analyze the issue to find a solution.

We will keep looking on options and i still feel we might have missed something.

Thanks for explanation of the code part.

Regards

Anand

[Former Member]

Hello Joyca,

If you are trying in dev or sandbox..i would suggest you to try this step,

Create a dummy role and assign authorization object CRM_APPRVL with ACTIVITY and give full permission.

assign this Role to TEST_ANALYST.(apart from already existing roles)

check whether you are getting desired results.

Regards

Anand

[vervinckt_joyca]

Hi Anand,

Thank you for your quick reaction.

I set CRM_APPRVL to * instead of 01, 02 and 03, but the behavior is still the same; TEST_ANALYST can only change the approval procedure if he gets assigned as change manager, otherwise not.

Kr,

Joyca

[Former Member]

Joyca,

Try adding authorization object SM_FIELD and then assign ZMCR(whatever u have defined if it customized)

[vervinckt_joyca]

That's already there.

[Former Member]

Joyca,

Best option would be to put a trace using ST01 on Change manager and perform approval procedure.

Stop trace and view logs...where by we can check which ever authorization objects and activities have been touched during approval procedure.

Regards

Anand

[vervinckt_joyca]

I think the authorizations are OK, and it's more related to the partner function of Change Manager.

This is what is seen in the authorization trace:

When I open the ticket where I am not the change manager, then the trace shows that CRM_APPRVL with 01 is checked, which is OK. Then SM_APP_AP with value 70 (administer) is checked. I don't have that so not ok. But then he just goes further to other things, and decides that I cannot edit the approval procedure field.

But if I fill in TEST_APPROVE as the Change Manager, then an extra check is seen in the trace: THEN it checks for SM_APP_AP with value 02 (change appr procedure). And then I can aso edit the field.

So it's as if my authorization is OK, but this authorization is not checked as long as I am not the change manager.

So I'm looking for a way to get rid of the check of being change manager. I want all users who have SM_APP_AP with value 02 to be able to change the approval procedure, regardles if they are in the box of change manager or not...

[Former Member]

Joyca,

Michael who's wiki you have referred talks about new authorization object called AIC_PROC.

Please check.

[vervinckt_joyca]

Hi Anand,

AIC_PROC is one of the authorization fields of the authorization object SM_APP_AP. I did assign SM_APP_AP with ACTVT value 02 for changing the approval procedure and AIC_PROC my custom transaction types. But it's not checked as long as my user is not the change manager.