I am going to explain a simple option provided by SAP which helps to ensure that an initiator could only see the processes which he/she is entitled to start. We will go through an example where restriction is based on user group in the user parameters. (SU01 - Parameters. See picture below)
In the example scenario, we have a process and form for hiring Australian employees, say ZHCM_AU_HIRE which could be initiated by HR admin and MSS roles. We want to ensure that the process is selectable only to an initiator belonging to specific user group which has entitlement to hire employees for Australia.
Steps to achieve this restriction:
1. Process Start Configuration
Assign restrictions when assigning process role. You have options to say Included / Excluded.
Now, you need to specify object groups. Click on the last cell of the configuration, and specify an ID and a meaningful name. Object group is to group initiator employees. The ID you specify here is the key based on which the restriction is applied.
In my example I have provided 'PROCAU01' .
2. Configure Feature PASRG
Setting up this feature links your process role config to the logic for restriction. You could build the logic using any/all the valid fields for decision provided by the feature PASRG. You can directly go ahead and create feature by clicking on the button "Feature" in the window for object group assignment or via PE03.
Design the feature to return value equal to the object group ID you created in process config. In my example (see below) I have provided return value 'PROCAU01', exactly the same ID I set for object group earlier, to user group 13.
After I save and activate this feature, only initiators with their user ID set up with user group parameter value 13 see the process ZHCM_AU_HIRE. With above feature design I could now create another process for New Zealand say ZHCM_NZ_HIRE and configure its process start to ensure that only initiators who are entitled to hire an employee in New Zealand see the process in the start process list.
Note: Feature logic could be build with following fields, but ensure that the portal user always get the parameter value assigned.
Thanks,
Krishnakumar PM
