Performance issues with structural authorizations

Purpose
The purpose of this page is to clarify the reason why performance issues may have arisen from Structural
Authorizations implementation and how the user can solve them.

Overview
Structural authorizations are used to grant access to view information for personnel where HR has been implemented.
Access is granted to a user implicitly by the users position on the organizational plan. Structural authorizations are not
integrated into the standard authorization concept and structural authorization profiles are not the same as standard
authorization profiles.
The flexibility of this concept ensures that the maintenance of structural authorizations is minimal, even if a change is
made within the structure, and at the same time ensures that users still have access only to objects they are responsible
for.
However, the creation of the set of objects for the structural authorization check can be very time-intensive at runtime if
the evaluation paths are extensive and the organizational structures large. This is due to the fact that the set of objects
must be newly created each time a user starts or changes transaction so that the system can evaluate organizational
changes as soon as possible. Performance problems often occur when structural authorizations are used.
Common performance issues and their solutions are described on the following sections.

Slowness in accessing employee data
This is usually caused by big structural profiles/evaluation paths that have to be generated/red at runtime.
This can be avoided by pre-generating profiles. To do so, you should use the report RHBAUS00, which generates
indexes for structural authorization profiles for selected users.
You can use this report only for users who are entered in the T77UU table (Save User Data in SAP Memory) as a user.
When you use the T77UU table, users profiles are not updated online, but via this report so that the changes in the
structure are updated in the structural profiles.
SAP recommends that you run RHBAUS00 at night using a batch job in order to update the users profiles.
You may also execute it manually for a direct regeneration if you have made changes to the organizational structure
since the last automatic regeneration.
You can find more information regarding the report on SE38 > documentation.


Slowness and/or Time-out when running report RHBAUS00 and
accessing Employee data
Unnecessary performance losses can occur if there are redundancies after the structural authorizations have been
defined, that is if the entries in the T77PR table (Definition of Authorization Profiles) overlap for a user.
In order to find out whether there is any recursion with an Evaluation Path you can run report RHSTRU00 according to
the instructions in Note 450078.
Be aware that you should start the report twice: The first time with parameter 'Recursion check' activated, the second
time with this parameter deactivated. If a TIME_OUT only occurs in the second case, you can be certain that there is a
recursion.


Slowness in Structural Authorization implementation even after
indexing profiles
Normally you should always take care that there are no duplicate entries in the structural profile of a user by defining
smart profiles.
However it might happen that a user has multiple (similar) entries in his structural authorization profile from several
sources. That leads to a larger VIEW table with redundant entries.
To avoid this issue you have the option to implement BAdI HRBAS00_RHBAUS00
This BAdI will eliminate double entries or merge adjacents, leading to a smaller number of objects in the Profile. (Please
refer to SAP Note 742638)









Mapping the Evaluation Path of your Structural Profile
Purpose
The purpose of this page is to help the user find the Evaluation Path included on the Users Structural Profiles.
Overview
When you implement Structural Authorizations, you assign Structural Profiles to the users. The Structural Profiles will
have an Evaluation Path, which will map the user to the object it is trying to access.
What is an Evaluation Path?
Evaluation Path is a chain of relationships that exists between organizational objects in a hierarchical structure.
The evaluation path O-S-P, for example, describes the relationship chain organizational
unit position person.
In Structural Authorization, the evaluation paths are used, for instance, to select objects during authorization
evaluations.
You choose an evaluation path and the system evaluates the structure along this evaluation path. The user will have
access only to the objects that lie along the specified evaluation path.
Where can I see the users evaluation path?
The easiest and most complete way to do check a specific users evaluation path is on transaction code HRAUTH.
There you can find all the Structural Profiles assigned to this user, and the evaluation paths mapped to those profiles.
Transaction HRAUTH > tab User Specific > enter username > button Structural Profiles:


Where can I find all the Evaluation Paths created already?
You can find all Evaluation Paths on the system on transaction code OOAW (or table T77AW).
Select a specific evaluation path and click on Evaluation path (individual maintenance) for further details on each
evaluation path.

Where can I assign an Evaluation Path to a Structural Profile?
This can be done on transaction code OOSP.
This transaction is responsible for Structural Profiles maintenance.
Select a specific structural profile and click on Evaluation path (individual maintenance) for further details on each
structural profile, including its evaluation path.