Question: Hi,
a customer has added a new company code. Is there a way to add massively (without changing manually EVERY single role) the new company code to the organizational levels in the roles?
Thanks for every suggestion.
Answer:
You could record a CATT script (tx SCAT) or use a 3rd party tool such as Quicktest to update them.
Alternatively you could get an ABAPer to knock up something to perform the insertion.
Answer:
Please try thru the ABAP program pfcg_orgfield_create
Answer:
Manual is the best answer, A CATT assumes the Company code record in the org field entry screen in PFCG is alway in the same spot. It is not, nor are you guaranteeded that all roles have the same number of entries for company code. So getting a CATT to work would be more time consuming than just updating the roles.
The ABAP program pfcg_orgfield_create is for just that CREATING org levels not mass updating.
Since PFCG really has no meaning to the real security whatever you do you have to generate all the roles. I find using SUPC as a "list to work from" the fastest way to do tedious updates as you can skip alot of the screens and go directly to the authorizations. You can ask SUPC to list only those roles you want to work on and use AGR_1251 and enter BUKRS in the "field" field. you will then get a list you can use in SUPC.
Answer:
Thanks for the tip John! Using SUPC did make this task a little easier. I wish there were some way to automate this however!
Manual is the best answer, A CATT assumes the Company code record in the org field entry screen in PFCG is alway in the same spot. It is not, nor are you guaranteeded that all roles have the same number of entries for company code. So getting a CATT to work would be more time consuming than just updating the roles.
The ABAP program pfcg_orgfield_create is for just that CREATING org levels not mass updating.
Since PFCG really has no meaning to the real security whatever you do you have to generate all the roles. I find using SUPC as a "list to work from" the fastest way to do tedious updates as you can skip alot of the screens and go directly to the authorizations. You can ask SUPC to list only those roles you want to work on and use AGR_1251 and enter BUKRS in the "field" field. you will then get a list you can use in SUPC.
Organizational levels
Org. level in PFCG
Question: Hello,
I want to assign roles for users in PFCG. However, when I restrict the plant in org. level, it doesn't work for those ABAP reports (Z reports) which created by users. It only work for standard SAP functions. What I have missed in PFCG or created reports? Please help!
Many thanks.
Answer:
The developers have probably failed to put authorisation checks into the custom reports.
Nothing you do in PFCG will change this. PFCG merely attempts to recreate the checks made in the programs.
Answer:
Thanks Al.
What can I do on the next development of custom made reports to get such result?
Answer:
How to put the authorisation checks in the reports such as plant?
Answer:
Thanks Al.
What can I do on the next development of custom made reports to get such result?
Your developers should know how to do this. If not, they should be sacked.
They need to incorporate AUTHORITY-CHECK statements in their code to check an authorisation object related to plant. Depending on the requirements it could return specific line items for certain plants or it could not return any values at all depending on your requirements
Answer:
Many of the "z" reports are versions of already existing SAP reports that are based on a Logical Data Base which for many has authority checking build in. Your ABAPer can also reference the LDB and have the checking done for them, then tailor the output.
Org Levels
The following progs are used to create and delete existing org field:
PFCG_ORGFIELD_CREATE and PFCG_ORGFIELD_DELETE.
Does a prog exist to VIEW all org levels created? I am encountering inconsistancy with ORG fields in DEV, QAS, TRN and PRD. How can one view the org field created in these clients?
Anyone?
Answer:
Table USVAR, USVART, USORG are the orglevel tables. To correct your problem enter a manual record in a transport for the following:
R3TR TABU USVAR
R3TR TABU USVART
R3TR TABU USORG
THen on the "Keyed field screen" for the tables enter an asterisk.
Make usre you get the USVART table entries this is the one PFCG uses in the code not the USVAR table.
Org level fields
Question: Do any of you know of a way for us to read the organization level fields in our roles and write the values to a file? Is there a standard program within R/3 and/or BW that will do this?
Thanks,
Greg
Answer:
Hi there Greg,
Did you check AGR_1252 table?
You can use tcode SE16 to generate a list of existing Org labels for each role.
The list can be downloaded or printed.
Hope this helps.
_________________
by finding out what the problem is, you got 50% of the solution.
( sentence is not mine, but trust me, it's true! ).
full time member of 'tuly idiot club'.
Answer:
All things being the same... maybe...
It depends of your release, Sp and buffering method as to whether at all and which form you could get a usable answer.
If 4.6/7, UPD and 3 or 4, then see RSPFPAR documentation for the applicable table(s) to get the applicable answer for the fields which are org related which you want to know the answer to.
Only you can know that, not us.
read the organization level fields in our roles and write the values to a file?
Org levels for roles...?
If you achieve this at role level (without composite roles and profiles), then well done. If not, then trust not what your eyes are telling you because there is not enough connectivity between the question and any possible answer.
Roles are just a potentialy indirect and incomplete reference to the profiles (for generation and association purposes) which give a potentialy indirect and incomplete reference to the org level access you are looking for.
