How to Generate BW Authorization Profiles from a Flat File

BUSINESS INFORMATION WAREHOUSE

ASAP How to Paper

Applicable Releases: BW 3.0A or above July 15, 2002

SAP (SAP Labs, SAP America, Inc. and SAP AG) assumes no responsibility for errors or omissions in these materials. These materials are provided as is without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. SAP shall not be liable for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. SAP does not warrant the accuracy or completeness of the information, text, graphics, links or other items contained within these materials. SAP has no control over the information that you may access through the use of hot links contained in these materials and does not endorse your use of third party web pages nor provide any warranty whatsoever relating to third party web pages.

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM A FLAT FILE

1 Business Scenario
You are responsible for implementing BW authorizations at BW Incorporated. BW Incorpoated has a non-SAP financial system, which tied to employee information. The company has the authorization requirement to limit the access of employee information based on the cost center responsibility. The responsible managers can view information for his/her organization and the subordinate organizations. Each employee belongs to an organization under a hierarchical Cost Center structure as depicted in the following sample diagram. It illustrates the person responsible for Group 1 who is allowed to view all cost centers belonging to group 1 and employee records under it. Customer also wants to be able to control authorization at hierarchy node level. The organization and cost center assignments changes from time to time. Currently, BW Incorporated maintaines these authorization data in various tables in their non-SAP system. To maintain these ever changing information again in BW environment would be a very time consuming effort. Customer wishes to reuse what has been setup. You have heard about the new BW authorization profile generator function and you want to setup a regularly scheduled refresh process to bring your non-SAP HR authorizations data into the BW environment on a periodic basis. The following diagaram depits the cost center structure and employee relationship at the BW Incorporated for the head of BW Groups with User id BW20-00.

BW Incorporated
ZCOSTCTR Root

BW-01 Group 1

BW-02 Group 2

BW-03 Group 3

CC: 2001IT

CC:2001Market

CC:

CC: 2001FI

CC: 2001HR

20010009 Emp #9 20010004 Emp #4

20010003 Emp #3 20010008 Emp #8

20010001 Emp #1 20010006 Emp #6 20010011 Emp #11 20010013 Emp #13 20010014 Emp #14

20010005 Emp #5 20010010 Emp #10

20010002 Emp #2 20010007 Emp #7 20010012 Emp #12

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

2 The Result
The individual user master records will have a profile automatically generated after the scheduled generation process. The example below displays the generated profile (RSR_0006211) for user BW20-00, the head of Root cost center has follow authorizations: Access to all Key Figures Access to Costcenters from 2001F through 2001SALES Access to Employees 20010001 through 20010014 Hierarchy authorization at summary level and the root level (generated name F4IZ)

3 The Step By Step Solution

3.1 Prepare Input DataSource format for Authorization Profile Generator.

Once you understand the authorization requirements and before you start the actual configuration work, you need to analyze, map and prepare the format of your input datasource that contains authorization data. The first step, you must know what is expected value in the target ODSs. To do so, you need to review the content of two technical ODS templates devliered in BW 3.0.

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

1. Check and verify Authorization Technical ODS Templates have been activated. If not, go to Admin Workbench -> Business Content -> Data Target -> under Technical Content (0BWTCT), Authorization Reporting (0TCA); Drag 0TCA_DS01 and 0TCA_DS02 from the middle pane to the right pane under collected objects for activation -> select grouping necessary objects and Install in background.

2. Determine the Authorization Input Datasourace format for Value ODS. At Admin Workbench, InfoProvider screen -> Highlight Template for Value ODS (0TCA_DS01) -> right mouse click -> select Object Overview

3. Based on the authorization requirement, map the Input Data Source. Prepare to bring the appropriate data elements from nonSAP database tables to two flat CSV files, one for authorized values as depicted on the right. Same process is needed for Hierarchy.

0TCTIOBJNM (from CSV file) 0TCTLOW (from CSV file) 0TCTHIGH (from CSV file) 0TCTOPTION (from CSV file) 0TCTADFROM (from CSV file) 0TCTADTO (from CSV file) 0TCTUSERNM (from CSV file) 0TCTSIGN (I=interval) 0TCTSYSID (null) 0TCTOBJVERS (A=active version)

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

3.2

Configure the InfoSources and Create the Authorization ODSs

4. Create InfoSource for Flat File source system. Admin Workbench -> Modeling -> InfoSource -> Create InfoSource and give a name and description Right mouse click on InfoSource just created -> Assign Data Source -> Select PC_file source system.

5. Define InfoSource Transfer Structure for Value Data Source according to the sequence in CSV file layout. Click the communication structure icon above -> move all objects from right pane to the left by pressing the double left arrow.

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

6. Define Transfer rules and activate the InfoSource. In Transfer structure and transfer rules screen -> click on Transfer rules tab -> click the Propose transfer rules icon in the middle of the pane to move all infoobjects plus the compounded characteristics.
Define transfer rules as follows: 0TCTOBJVERS = A & 0TCTSIGN = I by double click red X for these infoobjects and choose Constant on the pop up screen and enter A & I respectively. Leave 0TCTSYSID be null. Then click the activate icon to activate the transfer rules.

7. Repeat a similar process and create the InfoSource for Hierarchy Data Source.

8. Create Target Value ODS using 0TCA_DS01 as template. It is mandatory to have the name with suffix of DS01 for value ODS.

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

9. Create Target Hierarchy ODS using 0TCA_DS02 as template. It is mandatory to have the name with suffix of DS02 for value ODS

10. Create Update Rule for Value ODS. Admin Workbench -> Modeling -> InfoProvider -> highlight your value ODS (ALO_DS01) -> right mouse and select create update rule -> all key fields except authorized fields (blank) should have a corresponding source field -> activate update rule. Note: the warning that InfoObject 0RECORDMODE is missing can be ignored by click enter. 11. Create Update rules for Hierarchy ODS. Please note the constant settings.

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

12. Continuation and activate the update rule.

13. Data Load into ODSs: Create Infopackages in Admin Workbench -> Modeling -> InfoSource -> highlight Flat file InfoSources your created (BW20value) -> right mouse click and select create Infopackage -> schedule & monitor for a successful load. Repeat same for BW20HIER.
Note: please refer to online doc, if you are unfamiliar with infopackage definition from flat file.

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

3.3

Define Reporting Authorization Objects

14. Mark the InfoObjects as Authorization Relevant. Execute transaction RSD1 -> enter InfoObject name -> click on Maintenance -> select 2nd tab Business Explorer and check mark Authorization Relevant -> Activate the InfoObject. Repeat for each InfoObjects to be authorization checked. (Zcostctr, Zemployee and any key figure to be checked). 15. Create Authorization Object: Execute transaction RSSM -> enter authorization object name (ZBW20) -> click Create -> Give a description -> highlight InfoObjects on the right pane of the screen -> use left arrow to move to the left.
Note: 0TCTAUTHH is mandatory for hierarchy authorizations

16. Switch the Reporting Authorization Object (ZBW20) on for the InfoCube (Zcomp_C01).

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

3.4

Generate Authorization Profiles

17. To generate authorization profile: Execute transaction RSSM -> go to the section 3 Authorization -> click push button Generating Authorizations -> click Change Icon to access the generation screen as shown -> check your ODSs (ALO_DS01, ALO_DS02) and cross section of your Authorization Object (ZBW20) -> push Generate Icon on the top left of the screen -> upon successful generation a log with green button will appear.
Note: you may want to generate profiles in batch mode by execute report RSSB_GENERATE_AUTHORIZATIONS

18.

Verify the result: a. Execute transaction SLG1 or SE38 program name = RSSB_BW_SHOW_LOG_AUTH_M

lights indicate successful generation.in user master record.

b. You can also validate the result by checking one of the user master record via transaction SU01 -> Profiles > the generated profile will have a prefix of RSR_nnnnnnnnn and typ of profile is left blank.

ODIFY -> Green

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

HOW TO GENERATE BW AUTHORIZATION PROFILES FROM FLAT FILE

3.5

Create Authorization Variables in query definition

19. Create Authorization Variable to automatic loading of authorized object values for the user when executing the query. Create variable for each of the involved Infoobject. I.e. ZCostctr and ZEmpolyee. Be sure to choose Selection option as variable represents parameter.

20. Include the authorization variables in your query.

3.6
3.6.1

Appendix
Sample CSV file for Value ODS for user BW20-00 and LOA
2001FI 2001SALES BT * EQ 20010001 20010014 BT 19500101 19500101 19500101 9 9 9 9 1 2 3 1 B W 2 0 -0 0 99991231 LO A 9 9 9 9 1 2 3 1 B W 2 0 -0 0

ZCOSTCTR ZCOSTCTR ZEM PLO YEE

3.6.2

Sample CSV file for Hierachy ODS for user BW20-00 and LOA
B W 2 0 -0 0 B W 2 0 H IE R 0 H IE R _ N O B W 2 0 G 0 1 LO A B W 2 0 H IE R 0 H IE R _ N O R O O T B W 2 0 - 0 0 A B W 2 0 H IE R 0 H IE R _ N O R O O T 3 3 3

ZC O S TC TR ZC O S TC TR ZC O S TC TR

2002 SAP LABS, INC., SAP AMERICA, INC. AND SAP AG

10