Skip to Content

Business Objects Security Authorizations based on SAP Roles - Promotion?


I imported serveral BW roles to the development BIP system and assigned security rights to them (view, full access, ....)

Now I want to promote the whole security settings to the BIP productive system.

How can I do this? Is there a way how to assign the security through promotion management based on the SAP BW roles?

I imported the BW roles in both systems - development and production. I guess the CUID is different then. So I deleted the role in the productive system and promoted it directly from the development. So the CUID should be the same but when promoting all the assignments regarding security gets ignored.

Of course I´m using the security promotion also and checked the checkbox "user security".

Any ideas how to do this or is there no way to achieve this while using BW roles?

Thank you!

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • Best Answer
    Jan 11, 2018 at 06:23 PM

    What product are you using ?

    Promotion management cannot assign security, it can only promote it.
    Security should always be assigned to enterprise groups and any third party groups, like SAP, LDAP, Ad should be made subgroups of those groups. This ensures that your security will not get erased if something on SAP/AD/LDAP side get changed.
    This also helps with promotion.

    Promotion manager should be able to promote SAP Based group from one env to another, including all the associated security, provided the SAP systems are same in both and the group in question hasn't been mapped in destination prior to first promotion.
    If that doesn't work - open a Support Incident with SAP to investigate.

    Add comment
    10|10000 characters needed characters exceeded

  • Jan 11, 2018 at 06:30 PM


    we are using Business Objects 4.2 SP5 - the latest release.

    I guess it was a misunderstanding - I want to promote the already assigned security in dev (using the promotion management) to prod environment.

    So if I get it right I should assign the security based on enterprise groups. Additionally I should assign the sap bw role to the enterprise group so I can handle all the authorization requests within the sap bw system - right?

    Promotion manager should be able to promote SAP Based group from one env to another, including all the associated security

    What exactly do you mean with "SAP based group"? Is it the combination of enterprise group and sap bw role / group?


    Add comment
    10|10000 characters needed characters exceeded

    • I understood what you're trying to do.
      You make SAP BW group/role a subgroup to enterprise group. Then you assign object security using enterprise group.
      Not sure what you mean by authorization requests.

      SAP based group is SAP BW role/group you map into BOE.

      What specific things were ignored after promotion and what exact objects have you promoted ?

  • Jan 12, 2018 at 07:44 AM

    First I want to describe what I did to do:

    I imported a BW role to Business Objects: ZBI_BO_ALLG

    After this I defined the User security for one of the default folder "SAP":

    Users who are assigned to this role can now see the folder (without subfolders).

    This assignment (role to folder) should be promoted to the production system. So I created a new promotion job and attached the folder, the authorization object and also the role. But this is the point: the role gets also imported directly from the BW backend system.

    This means that the CUID is different, right? So I tried to promote the role so that the CUID is the same but I guess this isn´t the way how it should be done:

    Role on dev:

    Role on prod:

    Promotion Job with Role and Folder:

    Promotion Job History / protocol:

    So this was isn´t working at all.

    I will now try to

    1) create new enterprise groups (almost same name like the imported bw roles)

    2) assign the enterprise groups to the imported bw roles

    3) assign the enterprise groups to the folders and define the user security

    4) promote the enterprise groups (and also the security) to the prod system

    5) check it the assigned user security is available

    Feedback much appreciated.



    Add comment
    10|10000 characters needed characters exceeded