Question:
Hi all,
I know from SAP 46B, there can pass on the same authorization value (not the org. level) from the single role to its deriving roles.
However, I create one template role and input some generic authorization value in, but if I create the deriving roles, the authorization values I input cannot be passed on to deriving roles, meaning that I still need to input again in the derived.
Any experiences on this? Or any other easy way to reduce the maintenance for the authorization value in the derived roles? Thanks
Steven
Oct. 5, 2006
Answer:
Hi Steven,
After you have defined the master role from where the derived role should be based on, do you then choose the "copy data"? The values are not inherited automatically.
Answer:
Thanks Blaster. I understood this.
However, from Made Easy 4.6 Chapter 6, I found the relevant paragraphs:
"As of Release 4.6B, it is also possible to adjust and generate the profiles for all roles derived from the original role. All the authorization data for the role is passed to the derived roles, except for the organization levels. .........
To execute this action, you need full authorization for the object S_USER_VAL as well as the authorizations to change the derived roles
To access this functionality, Choose Authorization -> Adjust derived roles on the Change Authorization Data screen of the original role."
From the excerpt, it means the authorization value can be inherited. However, i cannot find the "Adjust derived roles" screen, maybe i have no the authorization to do that.
Do you know what authorization object I should have to make me adjust the derived roles to inherit the authorization value?
Thanks a lot.
Regds
Steven
Answer:
Hi Steven,
You wrote earlier "but if I create the deriving roles". If this is so, then you need to copy the data, which you apparently have done.
As I understand you now, you already have created all the derived roles, and want a change in the master role, to also take effect in the derived roles. This is accomplished by the icon just to the right of the normal generate button, when you are in the master role.
I hope we are now talking about the same thing
Answer:
Hi Blaster,
Thanks for your quick response.
I haven't created all the derived roles yet. I just created one derived role for testing to see if I can keep the same authorization values as the master role. after my small testing, seems I cannot. However, the book (I wrote in the earlier message) says yes, there is the way to do it.
So I started wondering if I haven't the enough authorization to do on the derived roles.
That is the exact problem I faced. I want to keep the same authorization values to reduce the workload in doing many derived roles.
Thanks. Hopefully you understood what I am saying.
Regds
Steven
Answer:
Hi Steven,
No I do not understand
If your test scenario has one master role, one derived role, maintained relationship between master and derived, copied initial data from master, and you use the generate button just to the right of the normal generate button...then I do not understand.
As far as enough authorization, I have no idea. If you can do all normal role maintenance and have full access in S_USER_VAL, then you should be fine I think. Try to do a trace and analyze it.
To me it still sounds like you do not choose the right button to generate the master role.
Answer:
Thanks Blaster. I will find out.