Authorization by Funds Center - Report Painter Review

[Former Member]

I am providing authorization for report painter review. There is the requirement to limit Funds Center for each user to review.

I input Authorization Group in the Funds Center Master Data (FMSA). The Authorization Group coding is same as Funds Center Coding. Then I create authroization role for report painter reivew.

The authorization object "F_FMBU_ACC" has "FM: Funds CenterAuthorization (FM_AUTHGRC)" to scope. I tried input the mentioned coding in this authotization object but the report painter still show the other funds center when execute.

FYI: I created the authorization role and input the role to the new user id to test this authorization setup.

How could I scope Funds Center for the authorization role?

Regards

Ton

[former_member184992 · Accepted solution]

Hi Ton,

First of all you have to check if you have not activated "Check Old Activities" in the customizing. Please check the following menu path in your IMG:

PSM -> Funds Management Government -> Basic Setting -> Authorization

check -> Activate Old authorization check.

If you activate the old authorization objects, the following objects are used for the authorization check:

F_FICB_FPS Cash budget management/Funds Management commitment item

F_FICA_FTR Funds Management FM account assignment

F_FICA_CTR Funds Management funds center

F_FICA_WCT Funds Management funds center internal

F_FICA_CCT Funds Management cross-funds center

F_FICA_FCD Funds Management fund

These objects were referred to for the authorization check in Funds Management (FI-FM) up until release 46C.

Regarding the way that you have used authorization group field, I believe you should consider the following:

1) Use of Authorization Groups for Funds Center and/or Commitment Item.

==========================================================

In case of Funds Center, within transaction code FMSC (fund center master data) is available the field 'Authorization Group', the same used in the authorization rules.

It is not the 'fund center' field itself, is the group that you are grouping the fund centers only for authorization purpose.

If in the table FMFCTR for your FM Area you have the same content for all records to this field, this means that all your funds center will be part of the SAME authorization group.

So, you should consider within your company to divide the authorization groups according your needs and adjust your roles in transaction PFCG accordingly.

You should either specify a list of authorized funds center in the role, or assign a specific authority group to the funds center for which you do not want to allow posting.

2) Authorization objects

====================

The authorization object related to the funds center master data is the following:

- F_FICA_FSG Funds Management: authorization group for the funds center

In fact, in BCS you have to use also the authorization object 'F_FMBU_ACC'.

There is a short documentation in SU03 for this authorization object.

Assigning only the authorization object F_FICA_FSG could be not enough sometimes.

Use transaction SU53, SU56, SU01 and SU24 to trace authorizations.

I hope this helps.

Best Regards,

Vanessa.

[Former Member]

Dear Vanessa

Thank you for your solution.

I've activate

"Check Old Activities" in SPRO below path, then create the role for report painter only. It's work for this solution.

I tried to include FMAVCR01 to the same role, there is anohter Authorization Object "F_FMBU_ACC" appeared. This object make the authorization cannot be scope by Funds Center, eventhough I input the specific Funds Center in Field "FM_AUTHGRC-FM: Funds center authorization"

The soluion is activate "Check Old Activities" and provide the role by exclude Authorization Object "F_FMBU_ACC"

Ton

[Former Member]

Hi Ton and Vanessa,

Nice to read your conversations, now in my company has a same case,,

Can you tell me what's the effect if i choose "Check Old Authorization Objects" or "Check Old Activities"?

i tried input the specific funds center in field "FM_AUTHGRC" too, and the result is nothing affect.

if you have any solution without have to config the Authorization Check, please tell me...

Thank You

Hae