In the PFCG screen where we input the organization values for role restriction, I suppose the options available are not very flexible. Is there a reason for this? Is there a way in which we could change the layout? Could you suggest an Exit / Enhancement option for the need?
SAP currently provides the option of inserting new rows, which i feel is not very handy. It could be better and more flexible if we had the option to include/exclude single values and range like the laout we have for SE16 (the tabs Selcet Single Values; Select Ranges; Exclude Single values and Exclude ranges)
Any opinions / advice is welcome
regards,
Shekar
6 Answers
-
Best AnswerPosted on Aug 28, 2009 at 10:18 AM
I suspect the functionality of the sub-selection screen on SE16 and other reports is not adaptable to this input screen. I do agree that the subscreen for org values in PFCG is difficult to use when you have to add rows.
Add a comment
-
Posted on Aug 28, 2009 at 10:22 AM
Hi Shekar,
There is no option to change it without very serious modification to PFCG. You would have to find some sort of method of evaluating each range against a predefined table before the field values in the auth tab (which populate the profile) were filled.
Personally I prefer to keep the concept consistent which, in R/3, is additive.
What I would like to see is the option to populate a copied list without having to expand the rows to fit the selection, but I doubt that will be forthcoming.
Cheers
Alex
Add a comment
-
Former MemberPosted on Aug 28, 2009 at 10:27 AMSE16 and PFCG is like comparing apples and bananas.
SE16's selection screen generates a query for which some values can be excluded.
PFCG org levels update a table with the values which will later on be permitted.
So you would not only need to change PFCG, but you would need to change the AUTHORITY-CHECK itself.
Can't see that happening. Being able to range is a pain enough... 😉
Cheers,
Julius
Edited by: Julius Bussche on Aug 28, 2009 12:36 PM
Fruit corrected...
Add a comment
-
Former MemberPosted on Aug 28, 2009 at 12:35 PM
Guys,
Thanks a lot for your replies. But i suppose we still didnt have a definitive answer - so i would prefer to keep this going.
I am pleased for myself that the question has invoked replies from the top guys on this forum.
Coming back to what i asked (with example): If we have a request to have a user get access to all plants from AAAA to ZZZZ but not to AABN and AACK and BFGH and RKML, then the input wouldbe like this:
From To
AAAA AABM
AABO AACJ
AAAL BFGG
BFGI RKMM
RKMN ZZZZ
Imagine if the restriction is on 10 different plants.............
I dont know if i am asking for the moon, but i dont see any reason on why it shouldnt be possible.
Anyway, the idea of giving SE16 options was more to make people understnad on what was on mind and not to compare apples and bananas 😉
Add a comment
-
Former MemberPosted on Oct 20, 2011 at 07:00 AM
Yes, There should be an enhancement in the way we enter values. I am trying to Exclude only one value (RSUSR002) from the auth field "OBJNAME" under S_DEVELOP and I am not sure how this can be achieved. Meaning, for a particular role, I want to give all the values to OBJNAME except RSUSR002. Can some one help?
Add a comment
Add a comment