Making Key figures auths relevant in Analysis Authorisations

[Former Member]

Hello,

Here is a problem I am having. I have a key figure SALAMOUNT (Salary amount) which is used to fill my 0EMPLOYEE master data attribute Salary amount. I would like to hide this attribute from view for all my BW users, except for a couple of people in HR. How do I go about this? In 0TCAKYFNM object I am only allowed to give access to a specific key figure, not to take access away. I can't use SALAMOUNT as a standalone object and use ":" as it's a key figure, not a characteristic, like all other attributes.

What do I need to do?

Many thank,

Aga

[krysta_osborn]

Hi Aga,

The only solution I can think of stinks. You'd have to list all of the key figures that the non-HR guys can access in their analysis auths and include the one you want only HR to have in their analysis auths. You might be able to get around listing all of the key figures for all other BW users if they don't have access to the HR infoproviders. The assumption would be that they would only see key figures for the infoproviders in their analysis auths. Of course, you'll have to test that.

Krysta

[Former Member]

Hi Krysta,

I was kinda hoping to avoid this solution

Let's be honest. It's not your solution that stinks - it's the analysis authorisations that do! Having to list all hundred or so key figures in one analysis auths (and keeping track of all the new ones) only to restrict access to just one key figure - that's beyond me...

Problem is that the characteristic itself is used in hundreds of reports and many InfoProviders, but I am unable to lock access to this attribute, as, unlike other attributes, this one is based on a key figure...

Thanks though!

Aga

[Former Member]

I am not sure this works or not or can make atry.

As 0ANSALARY key figure is attribute of 0EMPLOYEE, make 0EMPLOYEE authorization relevant, create custom auth object with RSECADMIN and assign that custom object to the users (need salary display access) directly or through pfcg role

[Former Member]

Venkat,

I will give it a thought. I worry it might not work, as 0EMPLOYEE is too widely used in our reports to make it auths relevant. We only want to restrict access to some attributes.

Thanks though.

[Former Member]

Hi Aga,

I am not an expert in SAP BI so I might be wrong.

But anyway here is what I can think of ...I see 0ANSALARY as a Display attribute of 0EMPLOYEE in RSD1. Can't you check the Authorization Relevant Check box for 0ANSALARY in Attribute tab for 0EMPLOYEE ?. This will make SALARY AMOUNT as Auth relevant. I understand for a Display attribute that are auth relevant, full authorization * is required. Otherwise the attribute will be hidden from Query design and execution.

[Former Member]

Hello Nishant,

Unfortunately we use 0ANSALARY for something else. And it's also a key figure not a characteristic. As such, I am not able to tick it as auths relevant either in it's infoobject screen, nor in 0EMPLOYEE attributes tab (tick box is greyed out).

A.

[Former Member]

Hi Aga.

Here's the answer to your issue, from the SAP online help: http://help.sap.com/saphelp_nw04/helpdata/en/6b/ebb3ac244f11d5b2e30050da4c74dc/content.htm

André

[shivraj_singh2]

Aglukas,

You will have to make 0TCAKYFNM authorization relevant and use to restrict Salary Amount.

Ideally you will have to insert it in every analysis authorization you create, You do not have to list all the Key figures one by one in the analysis authorizations, you can use the Ranges & skip the key figure you want to restrict, table RSDKYF, if I am right, can give you a very good idea about how to construct the range.

Of course, maintaining 0TCAKYFNM in every AA, will require lot of effort, given that in future if you want to restrict another key figure, you will have to go back and update each AA and change the range again.

A shortcut I think of is to create two AAs just for key figures (it heavily depends upon what your security requirement is)

AA#1 - call it unrestricted key figures

0TCAACTVT - 03

0TCAIPROV - *

0TCAVALID - *

0TCAKYFNM - Range [0 - SALAMOUNR, SALAMOUNU - ZZZZZZZZZ ]

AA#2 - call it restricted key figures - Salary

0TCAACTVT - 03

0TCAIPROV - *

0TCAVALID - *

0TCAKYFNM - [SALAMOUNT]

Assign AA#1 to every role (depending upon design) or one role which is assigned to every user (again, this assignment will depend upon you design), and keep AA#2 in a separate role & assign the role to user whenever needed.

This way you will not have to maintain 0TCAKYFNM in each AA. And in case you want restrict another key figure in future, all you have to do is edit AA#1 and create AA#3 for that key figure.

Hope it helps.

[former_member483612]

Hi Aga,

Could you please share the solution for this problem as I'm in the same boat now? I've got salary data loaded into 0ANSALARY attribute of 0EMPLOYEE infoobject. And this 0EMPLOYEE infoobject is widely used in the reports. So, I would like to hide the 0ANSALARY from display from the BEx Queries.

Thanks a lot.

Regards,

Sri.