Fine tune your SAP MII permissions with UME Actions...

[abesh]

The Scenario

My current project had a scenario wherein, in a particular screen we would need to display all the users with a particular role, say ProductionSupervisor, in a drop-down list so a value can be selected for user input. This can be very easily achieved using the SystemInfo service thus :

server:///XMII/Illuminator?Service=SystemInfo&Mode=UserList&Group=ProductionSupervisor&content-Type=text/xml

Here the filter Group=<RoleName> can be used to filter users with a particular role. The resultant XML can be parsed and displayed as a drop down list of relevant users.

When we tested this in development with our user-ids, this worked fine, however once we deployed it in production the drop down list was not populated at all for the users. We could immediately figure out that this was an authorization issue as all the developers in the team had the SAP_XMII_Administrator role assigned to them and the users in production had only the SAP_XMII_User role assigned. While attaching the administrator role for the users in production would have been a quick fix, it was definitely not the optimal solution as the client was not too comfortable with all the users having administrator rights over the production instance of SAP MII.

The Solution

Having faced similar issues before we knew the solution to the same. Enter, a little known and used SAP Netweaver UME feature : Actions. There are 207 Netweaver actions that let you have fine grained access to the various services, screens and functionality of SAP MII. You can attach an action to either a Role or a User for the relevant authorization needed and in our case we decided to attach the XMII_SystemInfoService action to the ProductionConfirmation role attached to the users in production.

The way to do this is thus :

1. Navigate to the UME and search for the User/Role that you need to modify and click on the Modify button. (Note : you need to have UME administrator rights to modify users)
2. Navigate to the Assigned Actions tab.
   
   
   
3. Search for the required action to assign. In our case we were not too sure of the name of the action so we used the filter *xmii*service* do display the required actions. (Note : Do not use a too generic filter, the Available Actions has a display limitation of 200 actions and if your search returns more than 200 results an error message is displayed at the top of the screen)
   
   
   
   
4. Select the required action (XMII_SystemInfoService in our case) click on Add and then save the user/role.
   
   
   
5. Ask the relevant user to logout and login again and voila !!!

Footnote

There is a comprehensive list of SAP MII Actions in the help document as well : http://help.sap.com/saphelp_mii122sp03/helpdata/en/4c/9768bdc14d60c3e10000000a15822d/frameset.htm