Role & activities

[Former Member]

Hello !

I am creating a role. I want it to be authorized on the activities 03 and 10, with a restriction on the fund centers (F_FICA_FSG).

Therefore, for the object F_FICA_FSG, I have to enter 03 and 10 for the activities.

However what should I do with the other authorization objects? Can I turn them to green ? (for example, if i put "*" in F_FMMD_MES, will the role be authoized to the activity 01 and 02 ?)

Thank you in advance for your help !

[Former Member]

As a general rule do not give wider access to any object in the role then stricktly neccesary, as it might open backdoors not forseen now.

So for display set all activity fields to 03 only.

[Former Member]

Thank you for your answer.

If I put 03 for the other objects, maybe 10 will not work even if it is put on the only object I want to control (fund center).

You don't think so ?

[Former Member]

You have a few options here.

1. If you want a display only role give 03 for all the objects. 10 will work for only that object that you mentioned and not the others. So ,if you give 03 to all the objects and it needs an activity 10 for some other objects, it will complain.

2. Coming back to your question of what you should do about the other objects, that you need to maintain.

If you have other Tcodes in the role that allow change access, giving 03 will cause them to not work the way they should. So if the activity is already populated, I would keep it and allow access to the other fields in it.

If the activity is not populated, disable the object. Follow this for all the objects and all of them should be green.

Hope this helps.

Kunal

[Former Member]

This anwer gives some possible errors. It sometimes is not possible to give change in combination to display even while it is meant to be for different TRX.

So when ever the user has been given other actvivitys than 03 and 10 in any other role to similar objects one should always perform a negative authorisation test.

This is actually the reason why enduser role combinations should always be negative tested!

Testing of stand alone roles is only the first step in testing roles.

Edited by: Auke Visser on Mar 4, 2008 8:33 AM

[former_member795356]

Hi Hatem

I want to implement authorization in my FV60 and Fb60 tranactions, my Funds managment is active and i want to restric user in Funds Center and as well as some commitment item. I have some idea of Authorization group and after defining a Authorization group in customizing, i assigned Authorization group in fund center.and give its name in Authorization object in User roles. but still i am unable to achive correct control. by this way the system restrict every fund center.

Please help me if you can....Thanks in Advance

MAZ

[Former Member]

HI MAZ,

You should enter a value in the field Authorisation Group (Field FM_AUTHGRC) in the Funds Center Masterdata. With authorization object F_FICA_FSG you should then be able to restrict on funds center.

The only prerequisite is that SAP performs an authorisation check on this object.

Hope this helps you.

[Former Member]

Hi Maz,

How do we define auth group in customizing in Fund management?

Can you provide some steps and tcodes to do it?

I am looking for this to achieve fund center level restriction.

Thanks

Siri