Question:
Hi
I know the authorisation object S_RS_IOBJ with values of 23 (activity)
and DEFINITION for sub-object will allow the user to change the
info object, eg, add or remove other info-object in the ATTRIBUTE tab.
Is there any way to control which info-object can be added or removed
based on some naming convention we have got.??
We want the user to be able to add info-object starting with 0*
as ATTRIBUTES.
We has the same issue with cubes. we want the user to be able to
add info object but not remove an existing ones from the cubes.
any help will be much appreciated.
THANKS
GUEST77
Answer:
How many users do you have doing this? This is a development activity and it would seem that you could train developers in how to do this correctly.
Good luck on running your low trust BW system.
Answer:
Hi guest
You got it completly wronge.
We have a new BW box where multiple projects are running.
My query is about authorisations for Developes in DEV box.
There are a group of developers of each project and there is
a name space for each project so not to allow each project member
to work/use objects belongs to other projects.
Coming back to me question: Is there any controls the monent
a developer of project XX to go to info object in a change mode
and to change info on the tabs, e.g, ATTRIBUTES(they are
info objects themselfs) of another name space.
I hope this is clear.
thanks
guest77
Answer:
It is perfectly clear to me. But my question to you is what is so incompetent or untrustworthy about your developers?
The biggest stupidity in the SAP security world is obsessing on developer access in development. If you give a developer enough tools to do their work correctly you will also give them the ability to override controls if they choose to. Tell them what the policy is and ask them to adhere to it. You can alsways check at transport time to see if they are compliant.