SAP DMS / How to restrict the display of Document with using Authorization group

[Former Member]

Hi Experts

Need your help urgently.

We want to restrict the display of documents in SAP DMS.

i.e Document created by the User A who works on project 123 should not be seen by the User B who works on project 456.

I heard it can be achieved using "Authorization group field" in DIR.

So i have followed the below procedure.

1.  Created X ROLE and assigned to User A.

2.  In that 123 given as BEGRU value in AUTHORIZATION Object C_DRAW_BGR.

3.  Created Y ROLE and assigned to User Person B.

4.  In that 456 give as BEGRU value in AUTHORIZATION Object C_DRAW_BGR.

So User A created a DIR with giving 123 in Authorization group field.

But still User B is able to see the the document created by User A.

I am not getting how resolve this issue.

Could you please help me on this.

I would appreciate your support and reward immediately your work.

Its very urgent.

You can give me your email id, so that i can send an email if my question is not clear.

Regards

KB

[former_member185558 · Accepted solution]

Hey Balaji.

I believe Auth Grp wont work with Random inputs.

You need to decide security Model for whole of your DMS

e.g. two Groups 123 and 456

and use it as additional authorization  over type and status in your PFCG role.

Mind this once you decide the auth groups you need create additional roles and assign them to users.

this should be one time type of exercise.

Hope this is ok

Niketan

[Former Member · Accepted solution]

Hi Niketan

Thanks for your reply.

Could you please explain in detail?

[former_member185558 · Accepted solution]

Hi Balaji,

I think this should work

Go to Transaction

S_BCE_68001396

give authorization object C_DRAW_BGR

Double click on User B

Highlight Own Profile and click Selectively Expand Subtree & Execute

This should look like below

from this you should clearly get what user B is allowed and what user A is allowed and make right changes.

Hope this helps

Regards

[Former Member · Accepted solution]

Hi Niketan

It is working.

Thank you very very much.

Appreciate your time and knowledge.

[Former Member]

Thank you Nayeem and Niketan.

[Former Member]

Hi,

As per the authorization group and auth object maintained is correct, There may be chances that some roles for auth object C_DRAW_BGR will have "*" . test the role individually or check the SUIM t code by giving the auth object.

Revert with the impact.

Rgds,

Nayeem.

[Former Member]

Hi Nayeem

Thank you for your quick reply.

Can i have your email id so  that i can share the screenshot.

Thank you very much in advance.

Regards

KB

[Former Member]

[Former Member]

Thank  you very much.

I have mailed the relevant screenshot.

Hope an early reply.

Regards

KB