Skip to Content
avatar image
Former Member

Dynamic Group as direct UI Task access control criterion?

Dear Gurus.

I am trying to make Dynamic Group assignment to become an access control criterion for a specific UI self-serivce task. Only members of that particular dynamic group should be able to access that UI Self Service Task.

I have defined a dynamic group that works (confirmed). MSKEYVALUE - "DYNGROUP:CB:INACTIVE_GRACE_PERIOD:C1_PROD"

Next I created a UI task and in "Access Control" tab I have configured as follows:

This is the result:

Unfortunately this setup does not work for a reason unknown to me. Even though user is a member of that dynamic group, he/she can't see the UI taks. However, when I assign a business role to that dynamic group and then use the business role as access restriction criterion to that UI task, everything works well, but, if possible I'd prefer to avoid this, if it's not needed.

My question therefore is -  is it possible to use the dynamic group directly as Access Restriction criterion for a UI Task? Or do I need to do it through a "dynamic business role" assigment?

Help does not state that it's impossible, it is, however, not very precise as well:

Thank You in advance


Capture.JPG (45.8 kB)
Capture.JPG (40.7 kB)
Capture.JPG (100.8 kB)
Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

1 Answer

  • Best Answer
    Aug 03, 2015 at 02:14 PM

    Hi Darek,

    I cannot really answer the question why it does not work but I have a suggestion for a workaround: You select logged in users and put a filter. In this filter you get the mskeys of the users that are members of the dynamic group via SQL query from idmv_link_ext. I have not tried it but I guess that should work.



    Add comment
    10|10000 characters needed characters exceeded

    • Former Member

      Thank You Norman for this suggestion.

      I was also thinking about the same, but there is one problem - we use "simplified access control" and therefore the "filter" option is disabled in my case.

      We use this option as we were experiencing significant performance issues in past (and still are in some cases, like recalcuation of MX_ASSIGNMENT attribute) and I am very cautious about using functions which SAP claims as "degrading performance" as those are often the first ones they ask to disable, when I report a performance issue 😊

      I will consider turning this off though, if there is no other solution found. I assume that turning it off itself does not degrade performance. It's rather the way You build Your filters that determines if the performance of task access determination is degraded or not.

      Once again - thank You for suggestion. I am still wondering why the "out of the box" solution does not work and should it work at all.


      Capture.JPG (43.7 kB)
      Capture2.JPG (42.1 kB)