Assign more then one authorization profile while using structural authorization.

[Former Member]

Hello Experts,

I need to restrict the user access to PPOMA only to specific org units.

I have created authorization profiles for each organizational unit, but when I assign the user to more then one authorization profile in T77UA only the first assignment is taken into consideration, not both or the third.

Can anyone tell me if more then one authorization profile can be assigned to the user?

Thank you.

Your help is much appreciated.

Best regards,

Elena

[Former Member]

Hi Helena.

Let me ask something. Can't you use one eval path to bring all the org units that the manager has to see?

Let me give you one example. We had here a very similar query and we have solved the problem by copying the A/B012 relationship to A/B Z12.

Then a manager can be responsible for completely separated branches on the org structure and you are able to maintain it easily just by setting one eval path.

Hope this helps you.

Júlio Cesar

[Former Member]

Hello Julio Cesar,

Thank you for your reply. I have to recognize that I am a bit confused by it.
Let me describe my current requirement and what I have done so far, maybe I am missing a few steps on this.
Implementation is in CRM so it has missing features then in HCM.
1. Created profiles in T77PR for each org unit as below:

2. added user to table T77UU

3. assigned user to different authorization profiles(a.k.a. sales orgs)

4. Ran report RHBAUS00.

5. Checked PPOMA for the user and I only get three of four assigned profiles.

I am not sure where the mentioned relationships by you feet into this.
Please be so kind and give me some more details.

Thank you.

Best regards,
Elena

[Former Member]

Ok Elena, let's try help each other because i do understand a little bit a org structures and org profiles but i don't understand about CRM.

So i undestood that you have to reach certain branches on the org structure and you are doing this by inserting in your structural profile a fixed organizational unit ID and using eval path ORGEH.

With this, your structural profile starts by the org unit eg. 50009127 and reaches all the subordinated org units.

One of the causes for your problem in this scenario could be the field "Period" on transaction OOSP (table T77PR).

Depending on which value you put there it can reaches or not certain object based on the start and end date of it.

Now, about my suggestion for you:

I am considering that you are giving this profile to a mannager.

So let's consider that you have one manager, and it administrates those org.units you have mentioned above.

You can use then the eval. path O-O-S-P and reach not only the org. units but also all the positions and even employees below this manager.

I have created a document in SCN explaning hou i have created the structural authorizations here where i work.

So I hope this helps you.

[Former Member]

Hi Julio,

Your post is really helpful, thought I cannot figure out how I can configure in CRM the first part as transaction OOAC does not exist and specified entries in table V_T77S0 don't exist either.
I have changed my evaluation path to O-O-S-P and I can now see also the assigned positions and employees to the org unit, but still only three of the assigned org units in T77UA.

The period I used is 'blank' as I didn't wanted it to interfere with any restrictions related to that.


The business scenario for me would be that there are local central key users which take care of administrating the org units in PPOMA.
These LKUs have to be restricted only to a few specified org units. This is why I've build profiles separately for each org unit.
Managers rarely check the backend and the assignment, this is only necessary for the local admins.

If you have any suggestions for the above scenario, please don't hesitate.
Thank you.

Best,

Elena

[FJ]

Hi Elena,

A few things to try ...

In T77UA can you click on the 'i' button next to the assignment of profile 'ORG_29' - just to confirm the profile actually contains any objects, especially an org unit.

If the profile contains the expected org unit, is that org unit related to other org units or is it an unrelated org unit? If it is an unrelated org unit, it should appear under the button 'unrelated objects'.

You can also try to hit the 'refresh' button (structure+roots) to see whether that improves the situation.

All the best,

Frank

[Former Member]

Hi Elena you have a quite interesting problem over there...

You should probably have noticed that your problem only occurs in that specific org unit (29) haven't you?

So let´s take a different approach.

1) Can you post a screen shot of you object? I want specially de begda and endda.

You can take this data on HRP1000 table with the ID of org unit 29.

2) Can you also post a screen shot of HRP1001 where otype is O and objid id 50009127?

3) Can you also post a screen shot of HRP1001 where otype is O and objid id the ID of org unit 29?

Let´s review the object creation and the realationship infotype, there must be a clue about the problem.

Best regards

Júlio.

[Former Member]

Hi Julio,

I think is related only with this org unit 29 myself. I have added for test another org unit and it worked for that. But only the next day I could see it in PPOMA. Do you know if there are some standard jobs running for this each night?

Below you can find the screenshots with the requested info.

ORG 29: - which doesn't work

ORG 17 - which works

One thing is that the org unit doesn't currently have any positions assigned to it. But I think I should still be able to see it, at least to see it is present.

Best,
Elena

[Former Member]

Hi Frank,

Thank you for the input. The org unit doesn't have indeed any positions assigned to it so far.

Please check below screenshot for the current look.

I think though I should still be able to see it as the org unit exists. Don't I?

Best,

Elena

[Former Member]

Hi Elena.

* To your first question: There are some reports that can be executed as background JOB but you have to set them. One example is RHBAUS00 which creates indexes that make transactions and reports run faster.

* About your other test which worked only in the next day: have you created the object and the relationship between him and the org unit used on you structural profile with begda before 07/19/2016.

The relationship is the infotype 1001 (table HRP1001) and it determines when you'll start to see your org unit.

* Observation: I have noticed that in the org unit 29 you are using plan version (PLVAR) like ":." this is a long shot but here in our implementation we were advised to skip this plan version and use 01. If there you have configured your relationships to work in plan version 01, it could be your problem, but like i said it is a long shot. Maybe you should compare the org unit with one of those which is working fine and if it is the case, update this field.

* in my last answer i asked you for a screen shot of 1001 infotype (hrp1001 table) too could you please see that part again and send the SSs? I wanna check the relationship.

Best Regards.

Júlio Cesar

[FJ]

Hi Elena,

Did you check whether you can see the org unit when you click on the 'Unassigned objects' button, i.e. the button to the right of the 'Refresh' button?

Unassigned objects appear there and even though the org unit has a parent org unit, I assume your structural profiles for that user do not contain that parent org unit, so the system may see it as unassigned.

You can also try to assign a subordinate org unit or subordinate position to org unit 29. If the user can see it then, it would confirm that theory.

Cheers,

Frank

[Former Member]

Hello Julio,

My apologies, I missed that the table was in fact HRP1001 and not HRP1000.

Below the requested screenshot:

Best,

Elena

[Former Member]

Hi Elena.

In your screenshot i've seen that you organzational unit 29 isn't directly related with O 50009127.

So you have good chances of your problem be something related with some incorrect data or missing relationship through the path starting on 50009127 and ending on 50000704.

As you can see on you SC the org unit 50000704 is directly related with 50000699.

Is the org unit 50000699 directly or indirectly related with the  org unit 50009127?

By indirectly I mean that O 50000699 can be directly related with any other O which can be related with 50009127.

This check can give you a clue.

Best Regards

Júlio Cesar

[Former Member]

Thank you Julio Cesar, for all the support.

I will put it on the fact that the sales org is inconsistent as for all the other ones I tried the assignment works.

Have a lovely weekend!

Best regards,
Elena