Roles Cancelling Each Other

[Former Member]

I have 2 roles that allows a user to create certain order types using tcode IW31:

- Role1 can create order type Z1, Z2, Z3.

- Role2 can only create order type ZT.

Used to be that these roles go to different group people, never together. We now want to give both roles to the same people. But during testing we are finding out that both roles are cancelling the other's authorizations.

If we assign both roles to the same user, the expected outcome is that he should be able to create all 4 order types( Z1, Z2, Z3, ZT). Unfortunately, this is not the case... When the user is creating any of the Z1, Z2, or Z3 order types, he is getting the error message "No authorization for ordertype Z1 in planning plant 1000". Then when he creates a ZT order type, he is also getting the same error "No authorization for order type ZT in planning plant 1000".

Have any of you encountered this problem? How did you resolve it? Any suggestions are highly appreciated.

Thanks in advance!

[Former Member]

Trick question: If you remove Role2, can the user with Role1 then successfully post an order type Z1 to planning plant 1000? If not, then planning plant 1000 is not a value in Role1 and is (or until now, was) not intended for this.

Also, are you sure it is an authorization error? It might only be a warning (or infact an error) that the order type used by the system (not the user) is not intended in customizing to post to that plant, but only the other plants of type ZT in Role2.

Cheers,

Julius

[Former Member]

Hi Julius, thanks for the quick response.

If I only assign Role1, every works fine. And the same if I only assign Role2. But if both roles are assign then that's where the error occurs. And yes, it is an error and not a warning.

[Former Member]

Roles don't normally cancel each other. You were not meant to give a trick answer back

I had my bets on customizing completeness for the plants but am not so sure now. Actually, I don't know. But I will think about it.

Perhaps try drop an SU53 into the error to see exactly what was requested in the last failed authority-check before the error, and what the user has in the authorizations when Role1 and Role2 are assigned?

Then trace the Role1-only user and compare what is checked. There is a usefull feature in the trace to jump to the source code location of the check. The answer is most likely there (also check whether the source code location is the same location as the both-roles-assigned user. It might, for some reason, be finding that the user is authorized for all possible values of the order type field, and therefore sharpening the checks on the planning plant field at some other location.

It might even be in an EXIT which has been activated for some reason coding of the role with an authority-check in it which does not like the other role at all and throws this message to say "bugger off, you should not be here if you have any other authority, or too much authority". Checking for EXITs would be my second bet then.

But that is just "not-logged-on-guessing" from me.

Cheers,

Julius

Edited by: Julius Bussche on May 25, 2008 9:44 PM

[Former Member]

I did a ST01 trace with both roles assigned to the userid and it's showing that everything is good. RC=0.

I'm stuck... Help!

Edited by: Bliss IM on May 26, 2008 2:32 AM

[Former Member]

I would then contact the functional consultant of this application area and explain the symtom to them.

It might "ring a bell", particularly the planning plant in an EXIT would be my guess.

Cheers and sorry that I could not really help, other than some ideas which are imaginable without seeing it,

Julius

[Former Member]

Have you thought about creating a role 3, with all types. That will work.