User Roles

Reporting User and Developer

I've notice that often it is helpful, during project realization, to generate sample user roles for testing purpose. In this post I will show how to generate query developer and query user role with access to the menu role.

Reporting User (query user with menu role)

Our general reporting user will be executing queries in the BEx and Web Analyzer. He will have an access to menu folder role, from where he will be able to see and execute assigned queries and workbooks.


You need to perform the following steps:
1. Create menu folder role:

• To create the new role using TCode PFCG, enter a name of the role (e.g., ZBW_RU_MENU) and press Single Role button.
• In the Menu tab create additional menu folders.
• Add queries/workbooks to the menu: click Report button, choose BW Report or SAP Query and enter the report ID or the query name.

TIP: You can save queries to the role from the BEx Query Designer -> Query -> Save as; workbooks from the BEx Analyzer -> Save -> Save Workbook As.

• Add users using User tab. Direct user assignment will work OK, but more flexible solution is to assign user indirectly using user's organizational unit. To assign organization unit to the role use:
• a) PFCG -> Goto -> Settings -> Complete view.
• b) Modify created role, choosing User tab -> Organization Mgmt -> Create assignment -> Organizational unit.
• Compare user master record - click User comparison.
• Save the Role. Authorizations tab's light will be red - it is OK because we will define Authorizations in separate role.

2. Create authorization role:

• Use transaction code PFCG, enter a name of the Role (e.g., ZBW_RU_ALL) and press Single Role button.
• Add initial authorizations from the template: chose Authorizations tab -> Change Authorization Data -> S_RS_RREPU (BI Role: reporting user) -> Adopt reference. You may modify adopted authorization according to your needs. Remember that, in the analysis authorization, objects: S_RS_HIER, S_RS_ICUBE, S_RS_ISET, S_RS_MPRO, and S_RS_ODSO are not checked during authorization verification.
• Add menu authorization: Click Manually button, enter S_USER_ARG object and press Continue. Edit node: Authorizations: Role check, add Activities: 03 (Display), Role Name: name of the role created previously (point 1.)
• Remove InfoArea button from Select Query screen: Click Manually button, enter S_RS_FOLD object and press Continue button. Edit node: Business Explorer - Folder On/Off, Activities: X (True).
• Generate Authorization (Shift+F5).
• Add users using User tab (see my comment in previous point).
• Compare user master record: User tab -> User comparison.
• Save the Role.
• . Verify authorization
• Use transaction RSECADMIN, Analysis tab to execute query as query user.

Query Developer

Our query developer will be designing queries, workbooks and web applications. He will be scheduling broadcasts setting, maintaining analysis authorizations and their assignments to roles. To create authorization for query developer, perform the following steps: 1. Create authorization role

• Using PFCG transaction create single role and add initial authorization from template S_RS_RREDE (BI role: Reporting Developer).
• Generate Authorization (Shift+F5).
• Add users using User tab.
• Compare user master record: User tab -> User comparison.
• Save the Role.

2. Verify authorization
Verify authorization using BEx Query Designer and Analyzer.

In similar way you can create authorization for other users. The templates for BI user roles start with S_RS except roles for Business Planing which start with S_RS_PL.

Summary

Using authorization template you can accelerate process of authorization assignment, but in most cases you should use it as a basis of further work, not a target solution.