Question:
HI,
for the org elements in org levels, e.g. plant and company code, is there a relationship like a tree where company is root and plant is all the plants under this company code?
So if we have company code 1234, plant as * in a role, then the user can only access all the plants under only 1234, not in any other company codes?
The reason I ask is that some tcodes such as as02/03 requires a ' ' in A_S_WERK, although we have explicitly listed all the plants in the company code. In this case it would be easier for us just give a * since we have specified the company code anyway.
Answer:
Yes there is a relationship but SAP security does not care. It is only applicable if the authorization object has BOTH fields in the authoriazation object. If th eobject only has plant then that is the only thing being checked and it could not care about co code.