Restricting Display/Change Capabilitiy on opportunities

[Former Member]

Hi,

I am trying to find out if there is any standard way to restrict the ability to change/display opportunities. Let me first give a scenario:

<b>Objective:</b> We have sales offices tied to the territory hierarchy but no employees in the territory hierarchy. We want to restrict the ability for an employee to only view/manage opportunities associated with his sales office.

<b>Background:</b> Every sales office is created as a Business Partner, every employee is created as a business partner. The employee and sales offices are associated with an opportunity via the following tabs:

1. When viewing an opportunity (CRMD_BUS2000111), the BP of the employee appears in the “Sales Team” tab.

2. When viewing an opportunity (CRMD_BUS2000111),, the BP of the sales office appears in the “Partner” tab.

<b>Issue:</b> The issue is, I cannot find any standard authorization object that will help restrict display/change of an opportunity by BP number of the sales office or by the employee?

I am trying to implement the BADI CRM_ORDER_AUTH_CHECK [Authorization Check: CRM Business Transaction] to see if it helps.

Do you have any suggestions? Customer exit perhaps or is there an easier way?

[Former Member]

Hi Varun,

Dont know if the reply is too late and you have implemented the requirement already.

But, BADI CRM_ORDER_AUTH_CHECK is the right place to implement your requirement. There are few limitations with this Badi:

1. CRM_ORDER_ADD_AUTH_CHECK & CRM_ORDER_ALTERN_AUTH_CHECK does not work during search result. they work only on individual transactions.

2. CRM_RFW_CALL_AUTHORITY works over the list of guids furnished by the user search parameters. so if user has made a blank search with max hits as 100, it works on 100 guids and you can delete all guids which do not meet auth criteria. but finally you will end up having less than 100 transactions in search results (even if the user has authorisation to see more transactions)

3. CRM_RFW_MODIFY_QUERY is what SAP suggests to use if earlier method does not suit. You can change the search query itsel in this method.

Please let me know if you have already implemented any of these methods I have some queries too.

Saurabh Agarwal

[Former Member]

Manuel,

I am not concerned with the display vs. change capability, I can restrict that with standard sap authorization object.

My issues is restricting what opportunities a person can display or change, if employees are not in the territory hierarchy. Actually even the standard display opportunity. transaction does not even look at the hierarchy, so its not possible to limit change capability or display capability to only opportunities that are related to you sales office (via the BP link described in my initial post)

[P000636]

Hi Varun,

Standard authorization objects has one parameter called activity. This parameter should be configurated with 2 if you want authorization to change and only with 3 if you want only authorization to diplay opp.

See every standard object.

Regards.

Manuel