BW Security: Infoobject security

[Former Member]

Hi all,

I have the following requirement:

1) I built a role Role1 giving access to execute query Q1 and access to cost center's CC1 , CC2 . It is assogned to USER1 and when he executes the query Q1 , the data for only the cost center CC1 and CC2 is displayed

2)I built another role Role2 giving access to execute query Q2 and access to cost center's CC3, CC4 . It is assogned to USER2 and when he executes the query Q2 , the the data for only the cost center CC3 and CC4 is displayed

Now when i assign bothe these roles to a user say USER3 , when he executes the query Q1 he is seeing data for all Cost center CC1, CC2 , CC3 and CC4.

similarly for Query Q2 he is seeing the data for all the cost centers.

Is it possible to restrict the cost centers based on the query the user executes.

Thanks.

Neha

[Former Member]

no this is working as designed, SAP allways looks at the widest value in all the roles given.

[Former Member]

Thanks for your reply Auke. So it is not possible to restrict what cost centers the user can see based on what query he executes.

[Former Member]

Auke is correct in pointing out that it is working as designed but with a little design change it will work for what you need.

Here is what you need to do...

Goal: Execute Query 1, 2, 3, etc for specific cost centers.

Role Design:

Create a role for all the Queries (1, 2, 3, etc).

Example: Z_QUERIES

Create one role per cost center (you can also derived this role from one master to several child roles).

Example: Z_CostCenter_1, Z_CostCenter_2, Z_CostCenter_3, etc.

Each of these role will have access to a pertinent cost centers.

Voila!

Test Access:

For User1 assign Z_QUERIES & Z_CostCenter_1. User1 can execute all the queries but can only access cost center 1.

Got it!