Problems with authorizations

[Former Member]

hello i should first say i have no experience at all with authorizations, as until now i have had user access department doing all this

I am trying to create a role for financial department- in the simpliest way

i create in PFCG composite role called Z_SAP_FI_ALL and then i add to it all SAP_FI_*

i saved it

i create user in Su01 and assign to him the custom role,

when i log in i can not execute transactions like FB60 so on

Any idea how to solve this one?

when i click on comapre users i get message that SAP_FI... doesn't contain profile or authorzations for all roles

Edited by: Yavor Markov on Feb 2, 2009 11:15 AM

[Former Member · Accepted solution]

when you get the authorization error, go to transaction SU53 and it will give you the details of the missing authorization object and the required value.

Then check in the role what the value of the object has and adjust accordingly.

Regards,

Jazz

[Former Member · Accepted solution]

Authorization check failed

Object Class AAAB Cross-application Authorization Objects

Authorization Obj. S_TCODE Transaction Code Check at Transaction Start

Authorization Field TCD Transaction Code

FB60

how do i fix this one, sorry for the stupid one, but i am a newbie

[Former Member · Accepted solution]

This means, none of the single roles which you have included in the composite role have the transaction FB60.

If you dont want to create an additional role, find the role which contain the transaction FB60. You can do that from SUIM transaction. SUIM >> Roles >> with transaction assignment. (enter FB60 and see whcih role has it and include it in the composite role).

You can either create a new role from PFCG and add the transaction FB60 in the menu tab and then fo the the authorization tab and adjust the authorizations.

Read :

http://help.sap.com/saphelp_banking463/helpdata/en/12/cb33688c4c11d396cb0000e82de14a/frameset.htm

Regards,

Jazz

[Former Member · Accepted solution]

Hi,

It seems like you have not generated profile after adding the T-codes.Please check.

Thanks and Regards

Deepu

[Former Member · Accepted solution]

how do i generate the profile?

i mean i see no option for this in composite role

if it was a single role i know how to do it

[Former Member · Accepted solution]

No Profile generation for composite role. Did you try the suggestions in my above followup?

Regards,

Jazz

[Former Member · Accepted solution]

hmm, Jazz i can not do it your way as i need to add like 30-40 tcodes at least

so doing it one by one is not good

here is what i have though of, i need someone to tell me if it is acceptable

i created one new single role and build up the menu from all SAP_FI_* roles, then i clicked on authorizations and generated the profile

Anyway i saved without entering values for organizational elements and now when i click on display authorizations it is all red and yellow. IS this big problem?

P.S now FB60 works, but i am worried about those red and yellow stuff

PS2 i was able to go from red to yellow by clicking full authorizations, however when i click on save there is warning that there are open authorizations (i still click generate and if seems to work)

Edited by: Yavor Markov on Feb 2, 2009 1:17 PM

[Former Member · Accepted solution]

 Anyway i saved without entering values for organizational elements and now when i click on display authorizations it is all red and yellow. IS this big problem?
P.S now FB60 works, but i am worried about those red and yellow stuff 

You have left the organizational Levels unasigned. thats the reason why its showing Red. If you dont want to restrict the organizational levels, leave it as "*" . Otherwise, you will get error some point or the other during the transaction.

About the yellow trafic light, its becuase Authorization fields not completely maintained. Ideally, you should make everyting green for the transaction to work fine. To make things easy, You can select the parent node in the role in the authorization edit tab and click on the yellow traffic light and assign full authorization.

Read the following document if you are not sure about these. It will help you.

http://help.sap.com/saphelp_banking463/helpdata/en/12/cb33688c4c11d396cb0000e82de14a/frameset.htm

Regards,

Jazz