Problem with User Status and Authorizations

[Former Member]

Hello All,

I want to be able to stop certain users from setting the system status 'Released' in a project.

I have created a new status profile with the following items:

SNo -- Status -- Low -- High -- Auth Code

1 -- Init -- 1 -- 2 -- Z0001

2 -- Rel -- 1 -- 2 -- Z0001

For the Init status I have set the Business Transaction 'Release' to forbidden. When trying to Release the project now I get a message saying that I'm not allowed to Release the project, just as I expected. I now change the user status from Init to Rel and I'm allowed to release the project, and this is what I don't understand. I have set a Auth Code against the user status so I didn't expect my user to be able to override this user status manually. Anyone got any idea how to achieve what I want here?

-

Roy

[Former Member · Accepted solution]

You have to give different authorisation code for each user status like for user status Init Auth code will be Zinit and for Rel, Zrel etc. With the help of basis consultant set object and values of these status in authorization roles.

Sudhir

[Former Member · Accepted solution]

Sudhir,

Thanks for the answer. I have tried to set up a new user role in tcode PFCG. I have added a new authorization object 'B_USERSTAT' in the Cross Application Section with the following data:

Activity: 'Create or Generate. Delete'

Authorization key: 'Z0001'

Object Category:'Project Definition, WBS and Network'

Status Profile: 'My User Profile'.

I have saved and generated this profile and added it to a new test user. I have also created another test user without this profile, but they still behave exactly the same.

I thought by doing this the user with the new role would be allowed to change the user status and the user without the role would not be allowed to change the status. Any clue to where I'm going wrong?

-

Roy

[Former Member · Accepted solution]

What is authorisation key for REL user status? it should be different for user status Init - Z0001. Maintain different authorisation key for Rel eg Z0002. and check it?

Regards,

Sudhir

[Former Member · Accepted solution]

Sudhir,

With the help of one our programmers we managed to debug the problem and problem no 1 was that my user role had the SAP_ALL. So we created a new role without SAP_ALL and ran into problem number 2, which was that the B_OBJSTAT for my new role had authorization for everything. First we removed the B_OBJSTAT line from the role and I'm now getting the error message I expected. Then we added the B_OBJSTAT with the parameters I mentioned above and the user has authorization to change the user menu. The fact that I used the same authorization key didn't seem to make any difference.

Thanks for your involvement.

-

Roy