Problem when adapting SAP BO user's authorization with SAP BW

[former_member603757]

Hello community,

We are trying to restrict a user's access to some specific data. We have started by defining the authorization and role for that user in BW and Added some modification in the query designer and now in the transaction RSRT it's OK the user can only find the data we want him to see. I guess in SAP BW and BEx everything is alright so no need to describe here exactly what we've done.

Our problem started in SAP CMC (SAP BO 4.2), we imported the role from BW, scheduled the roles&alias update. create a new group and make it a member of the BW imported group, create a user having the BW Alias and affect it to that group. when connecting to Webi the user can find all the data with no restriction. I can't see what we're missing here. Did anyone have a tutorial or some steps to follow or an idea about what can cause this problem.

PS: the steps we did are little bit similar to what you can find in this tutorial:

http://www.pieterverstraeten.com/blog/?download=Adapt-your-SAP-BW-and-SAP-BO-authorizations.pdf

Thank you for your help,

[BasicTek · Accepted solution]

Is your connection to BW (check IDT or CMC) setup with predefined SAP username/password or SSO? Typically the SSO connection will display data based on the BW security, the predefined will display the same data to everyone unless you have multiple predefined connections that are allocated based on BI security.

-Tim

[former_member603757 · Accepted solution]

Thanks for your interesting reply,

Yes actually we're using a predefined SAP username/password. I'll try again with the SSO connection and get back to you.

Thanks again

[former_member603757 · Accepted solution]

Hello Tim,

SSO connection solved the problem.

Thanks for your help

[BasicTek]

ok here's the KBA on setting up the SSO https://apps.support.sap.com/sap/support/knowledge/preview/en/1670073 I'm assuming you are using 4.2 reports and not legacy, if the reports were migrated form 3.1 (classic crystal or webi .unv) then you need to look for SNC to perform SSO.

-Tim