Analysis Authorization Simplified (Part 1)

lakshminarasimhan_n4 · ‎07-13-2016

Applies to:

SAP BW 7.x system, for more information, visit the Business Intelligence, https://help.sap.com/saphelp_nw73ehp1/helpdata/en/b2/e50138fede083de10000009b38f8cf/frameset.htm

Author Bio

Lakshminarasimhan Narasimhamurthy is BW certified and ABAP certified consultant and worked on multiple implementation, development and support project's within India and outside of India. He has worked for fortune 500 clients like Nestle, Warner Bros, GCC, General Electric etc. He is strong in BW, BW related ABAP, HANA modeling, BW-HANA modeling, BODS and BO/BI tools like WEBI, Design Studio, IDT and Lumira.

Summary:

This document shows the steps to be followed while implementing authorization is SAP BW system. The data stored in the InfoProvider and it is made visible to the end user via BEx query. For any organization having global presence likely to have multiple company codes, plants, sale org etc. We need to authorize or restrict the user to look into the data to which they are responsible for.

Ex: When running “Purchase order quantity report” (0PUR_C01_Q0011) the user needs to see only to the plants he is confined to and not others.

Details:

Following are the steps that need to be followed to enable the authorization. To make the explanation simple, I will be explaining using an example. When running “Purchase order quantity report” (0PUR_C01_Q0011) the user needs to see only to the plants he is confined to and not others.

As the first step, make sure that the given below InfoObject’s are “Authorization Relevant”,

* 0PLANT Plant

* 0TCAACTVT Activity in Analysis Authorizations

* 0TCAIPROV Authorizations for InfoProvider

* 0TCAVALID Validity of an Authorization is made authorization relevant

* 0TCTIFAREA InfoArea

If the 0Plant is not “Authorization Relevant”, just click the “Check box” and make it authorization relevant and do the same for all the InfoProvider’s 0TCAACTVT, 0TCAVALID, 0TCAIPROV, 0TCTIFAREA.

0TCAACTVT – This defines the activity of authorization either Display or Change.

0TCAVALID – This defines the validity (Time Period) of the authorization (From date and till date)

0TCAIPROV – This defines the Authorizations for InfoProvider. We can specify the list of InfoProvider’s upon which the report lies.

0TCTIFAREA – This defines the Authorizations for InfoArea.

Then login into the “Analysis Authorization”, t-code RSECADMIN

Select the “Ind. Maint.”(Individual Maintenance).

We have the “0BI_ALL” authorization delivered by SAP. As the name says, this authorization gives access to everything!!!

Now copy the 0BI_ALL to ZBI_PUR

After copying then edit the “ZBI_PUR” to retain only the required objects.

Now click in the “Intervals” of 0PLANT InfoObject

We have the following options,

Single value (This is what we have used in previous screen shot)
Between
Contains Pattern

Now click in the “Intervals” of 0TCAACTVT InfoObject and select the display option(03)

Now click in the “Intervals” of 0TCAIPROV InfoObject and select the InfoProvider 0PUR_C01.

(We are selecting the InfoProvider(s) on which the BEx query is dependent on).

Now click in the “Intervals” of 0TCAVALID InfoObject and select the value *.

(* assures that the validity is valid for ever. If required the time intervals can be specified).

Now click in the “Intervals” of 0TCTIFAREA and specify values of the InfoArea.

Now that all the parameters are filled and activated

Now create a single role in PFCG

Click on “Change Authorization Data”

Select the “Edit” button and add the “Analysis Authorization” we have created before.

Enter the value” ZBI_PUR” and Save

Now add the following authorizations too,

S_RS_COMP
S_RS_COMP1
S_RFC

S_RFC is required to login into the BW system from BEx.

S_RS_COMP & S_RS_COMP1 is required to add the BEx Queries.

Now this role is assigned to my user "TEST_MM"

Now we can have created authorization then assigned it to a role and this role is assigned to the user. Let’s test the user. We can test any user authorization from RSECADMIN.

Go to RSECADMIN and then select the tab “Analysis” and select the button “Execution as”