Analysis Authorization - creating and direct assignment in productive system - good practice ?

[DanH1]

Hi folks,

We have a requirement upcoming for our retails sites to access our BW prods individual. This will usher in frequent maintenance as we will have to create analysis auth object one for one at site level - each site would hold its own unique analysis auth object. We currently use roles based for all auths , transport any changes.

I notice RSECADMIN has the direct assignment feature. Has anyone created analysis directly in prod and assignment in experience as a common practice for these situations

I see a few tables for views of assignment and history but no SUIM type tcodes/reports ?

[former_member185177]

Hi Dan

You need to create all Analysis authorizations in Dev environment and tested it thouroughly before moving these changes to QA and PROD.

Please go through the link, It will help you for sure.

https://blogs.sap.com/2014/12/11/bulk-creation-of-analysis-authorizations/comment-page-1/#comment-36...

Regards,

Krishna Chaitanya.

[DanH1]

Thanks Gents ...

We are looking at separating the Analysis Auth from the query role so that the query role /objects will be maintained only by test and transport.

The requirement is looking for 1300 AA 's to associate with this one role

Thanks for input !

[jurjen_heeck]

Hi Dan,

I personally prefer to have the 'standard' user management tools as single point of entry for user administration. Both for maximum simplicity in user maintenance and the ease of viewing all change documents for role (and analysis authorization) assignment in one spot.

Besides that I do not know if RSECADMIN authorizations allow for segregation of authorization change rights v.s. assignment rights. In standard role maintenance you can separate those rights. Role and user maintenance separation is often a requirement.

Hope this helps.

Jurjen

[Former Member]

Hi Dan,

It is not a best practice to assign analysis authorizations directly to users from the direct assignment tab. You can use this tab when you are testing an analysis authorization. The best practice is to assign the analysis authorization to a role via auth object S_RS_AUTH. This way users will indirectly be assigned the analysis authorization via security roles.

Chris.

[DanH1]

Thanks Chris ...and yes this has always been our standard as well. This new requirement will expound things greatly to 1000 + analysis auths and they will change weekly. The AA's will be be copied with only site # ? changing.

I am not like the inconsistencies i see in tables RSECUSERAUTH and RSECUSERAUTH_CL. The tables reflect fine for additions and changes while the user SU01 is active. I notice those and other BW tables do not reflect accurate once

the SU01 user is deleted - not sure if any has input on those areas. Nothing shows up in notes (so far) that i see.

[Former Member]

Hi Dan,

You are right about the tables RSECUSERAUTH and RSECUSERAUTH_CL not updating after SU01 user deletion. This appears to be a program bug and probably should raise a message with SAP. A workaround would be of course to remove AA first before deleting user in SU01.

However, from what you are describing to me it sounds like you may consider activating 0TCA_DS01 DSO to dynamically read user authorizations from say ECC system if that's where you have your master retail sites defined and generate values. This will allow you to dynamically read the site details from user in ECC and a dynamically generated AA will be assigned to user in BW based on ECC site role values. When user no longer requires a site from ECC, the next time the generation runs in BW it will automatically remove the generated AA from user profile. Check out this link to get you started. Please note, even though this feature was mainly meant for HR / FI but it can be extended to any functional area.

https://help.sap.com/saphelp_nw73/helpdata/en/4c/65fbce2f841f3ce10000000a42189c/content.htm