Master role-derive role concept and FICO role in dev system!!!

[Former Member]

Hi all,

I have created a master role with t-codes

AWUW

BAPI

BD10

BD100

BD101

BD102

BD103

BD104

BD105

BD11

BD12

BD13

BD14

BD15

also included object PLOG where maintained org data

and created a derived role from that master role and generated from the master role.

After that I wanted to change the org level but the system is not allowing me to change, although I selected the values from the F4 screen.

Now I want to maintain seperate org value of each of the derived role...and when adjusted from the master role..these maitained value should not vanished.

How should I proceed???

I have another issue....I am now in Dev system....I need to create a role with FICO module with SPRO....

Should I go ahead and cread a role and assign FICO block and assign SPRO...will that be sufficient??

Thanks in Advance

Regards,

Souren

[Bernhard_SAP]

Hi Souren,

it seems, that you have maintained the values directly (means not in the org.level-popup). That will lead to the effect, that the special 'org.level-field'-status is lost. Therefore delete the maintained values (there is a dustbin icon next to the field value) and maintain the values only in the popup (button 'org.levels'). Then maintaine dvalues in the derived roles will not get overwritten.

b.rgds, Bernhard

[former_member1061482]

Yes, It seems that you have broken the org level by directly making changes in the org level field inside pfcg.

One way to correct this is to regenerate the role in expert mode by selecting the option 'Delete and recreate profile and authorizations' (in case you want to correct it for all the org level fields.).

If you want only for PLOG, then delete this object and add again. Then go to organization level tab at the top and give the required value. Do this in the master role and generate and push the changes to derived role. Now, goto derived role and make the org level change the same way you did for parent role..

For your second question, you will have to see what all auth objects are being checked by SPRO for a FICO module assosciate. You can create a test role with SPRO in it and then do authorization trace through ST01 to see what all objects are checked when they work.

[Former Member]

Thanks for the reply...When I select plant values in org level tab in derived role and saving it.....the values are not reflecting when I click on PLOG objects. It is only showing the values that have been selected in master role....Please help me out to select different plant value for the derived role...and after adjusted from the master role..this value in derived role should not go out.

[Former Member]

and one more thing...when I created the master role..org level pop up did not come...should I maintain the org level value by clicking the tab in master role..before generating it...??

[Former Member]

If the Org Level popup didn't occur in the master role when you created it then that is because there are no org levels

I have just checked those tcodes and in my system at least there are no object proposal values which have org levels

Edited by: Alex Ayers on May 14, 2008 12:23 PM

[Former Member]

>

> Thanks for the reply...When I select plant values in org level tab in derived role and saving it.....the values are not reflecting when I click on PLOG objects. It is only showing the values that have been selected in master role....Please help me out to select different plant value for the derived role...and after adjusted from the master role..this value in derived role should not go out.

Object PLOG does not have Plant as a field. As standard all fields in PLOG are non-org levels which will be inherited from the master role

I suggest you track down a copy of Authorizations Made Easy or go on course ADM940 as this will clarify how this works

[Bernhard_SAP]

hello,

pls check the last 2 replies once more and try to initialize the content of the 'plan version'-field first! (just to make sure: the field is 'plan version' not 'plant number'!!!!)

Or create a testrole from scratch only containing plog for your tests and then derive some roles from it.

the documentation for deriving roles is quite good.

See also SAP note #314513.

Maybe there is a general data corruption, so pls test with a complete new set of roles....

b.rgds, Bernhard

[former_member1061482]

Hi Souren,

As per I can see, there is no plant ($WERKS) field for PLOG object. Yes, Plan Version field is there , which is an org level field.

If you are talking about Plan Version, thenI still feel that the object is broken in master role. Did you give values for the PLOG in master role through org level tab (without breaking PLOG).

[former_member1061482]

And yes, as Alex pointed out, the org level tab is populated with org level fields only if the objects present in the role have org level fields.

[Former Member]

Bernhard,

You are right Plan Version is usually an org level - my mistake! missed that one.

[Bernhard_SAP]

)

see timestamps of our replies....

we had the same idea on the problem...

[Former Member]

Thanks friend for all your answer I will consult with my functional consultant to give me some objects where org level is maintained...then I will try your suggestions..thanks again to all of u..

[Former Member]

>

> Thanks friend for all your answer I will consult with my functional consultant to give me some objects where org level is maintained...then I will try your suggestions..thanks again to all of u..

Try creating a test role with some functional transactions like XD03, FB03 - these will have plenty of org levels to play with.

Objects like F_BKPF_BUK, M_MSEG_WWA are examples of objects with org levels in