HCM Security - Cost Center

[Former Member]

Hello All,

Since we are providing some HR master data accss to Finance users, we would like to restrict the access based on Cost Centers. We would like to create roles and assign to finance users who will then be able to access data of employees who belong to a certain Cost Center. We have already configured Org Key and it does not have Cost Center (this can not be changed).

Is there any other standard way of including Cost Centers as authorizaton without using Org Key in P_ORGIN?

Thanks,

Nakul

[Former Member · Accepted solution]

Hi,

Have you considered standard auth. object K_CSKS? From SAP help:

The fields of the authorization object are:

Controlling area

Cost center

Activity

01 = Create

02 = Change

03 = Display

06 = Delete (not used at present)

08 = Display change documents

63 = Activate inactive cost centers

Source: SAP F1 help

Hope this helps.

Donnie

[Former Member]

Thanks Saku, Donnie...

[Former Member]

Hi Nakul,

If org. key can't be used I would go with customer-specific object. It is very easy to implement: I've done it few times based on [help.sap.com|http://help.sap.com/saphelp_470/helpdata/en/9e/74ba3bd14a6a6ae10000000a114084/frameset.htm] instructions.

Regards,

Saku

[Former Member]

Saku,

I went through the SAP Help pages and it does look like a good solution. I will give it a shot in our sandbox today and see if it works for us. I will update this thread again soon.

I do see however that there is a standard report to be run after the custom auth object is implemented. Have you had any issues running these reports; any collateral damage chances?

We do use al the standard HCM auth objects currently, and they will continue to work... this modification wont affect that, correct? I will go through this myself this week, but wanted to check with you since you have implemented this often.

Thanks a lot for your time and advice

Thanks,

Nakul

[Former Member]

Hi Nakul,

I haven't had any issues with the custom object or running the report. The report will create ABAP code to include MPPAUTZZ where the authority-check is done for your new object. All existing HR Master Data objects will still work as before. To update the roles it is best to use SUIM to find out all roles which have standard HR Master Data objects (P_ORGIN, P_ORGXX etc) maintained and add your new object to those roles also since the new object will be checked every time when these standard objects are checked.

If only all customer-specific things would be this simple in SAP

Saku