Skip to Content
author's profile photo Former Member
Former Member

Restricting Display/Change Capabilitiy on opportunities


I am trying to find out if there is any standard way to restrict the ability to change/display opportunities. Let me first give a scenario:

<b>Objective:</b> We have sales offices tied to the territory hierarchy but no employees in the territory hierarchy. We want to restrict the ability for an employee to only view/manage opportunities associated with his sales office.

<b>Background:</b> Every sales office is created as a Business Partner, every employee is created as a business partner. The employee and sales offices are associated with an opportunity via the following tabs:

1. When viewing an opportunity (CRMD_BUS2000111), the BP of the employee appears in the “Sales Team” tab.

2. When viewing an opportunity (CRMD_BUS2000111),, the BP of the sales office appears in the “Partner” tab.

<b>Issue:</b> The issue is, I cannot find any standard authorization object that will help restrict display/change of an opportunity by BP number of the sales office or by the employee?

I am trying to implement the BADI CRM_ORDER_AUTH_CHECK [Authorization Check: CRM Business Transaction] to see if it helps.

Do you have any suggestions? Customer exit perhaps or is there an easier way?

Add a comment
10|10000 characters needed characters exceeded

Assigned Tags

Related questions

3 Answers

  • Posted on Jul 14, 2006 at 05:49 PM

    Hi Varun,

    Standard authorization objects has one parameter called activity. This parameter should be configurated with 2 if you want authorization to change and only with 3 if you want only authorization to diplay opp.

    See every standard object.



    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Jul 14, 2006 at 06:15 PM


    I am not concerned with the display vs. change capability, I can restrict that with standard sap authorization object.

    My issues is restricting what opportunities a person can display or change, if employees are not in the territory hierarchy. Actually even the standard display opportunity. transaction does not even look at the hierarchy, so its not possible to limit change capability or display capability to only opportunities that are related to you sales office (via the BP link described in my initial post)

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Jan 15, 2009 at 11:36 AM

    Hi Varun,

    Dont know if the reply is too late and you have implemented the requirement already.

    But, BADI CRM_ORDER_AUTH_CHECK is the right place to implement your requirement. There are few limitations with this Badi:

    1. CRM_ORDER_ADD_AUTH_CHECK & CRM_ORDER_ALTERN_AUTH_CHECK does not work during search result. they work only on individual transactions.

    2. CRM_RFW_CALL_AUTHORITY works over the list of guids furnished by the user search parameters. so if user has made a blank search with max hits as 100, it works on 100 guids and you can delete all guids which do not meet auth criteria. but finally you will end up having less than 100 transactions in search results (even if the user has authorisation to see more transactions)

    3. CRM_RFW_MODIFY_QUERY is what SAP suggests to use if earlier method does not suit. You can change the search query itsel in this method.

    Please let me know if you have already implemented any of these methods I have some queries too.

    Saurabh Agarwal

    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.