Outlining HCM Authorization Checks

Objectives

After completing this lesson, you will be able to:

Outline HCM authorization objects
Outline the process of checking master data storage on infotypes during authorization checks
Outline the authorization check used when HR infotypes are edited or read
Outline the personnel number check used to control user access to personal information

HCM Authorization Objects

The figure Authorization Objects shows a number of authorization objects that you can use to define authorizations for SAP ERP HCM. Display these authorization objects using transaction SU21 (HR object class) in the SAP system.

Authorization objects enable complex checks of an authorization, which allow a user to carry out an action. An authorization object groups up to 10 authorization fields that are checked in an AND relationship.

For a successful authorization, all field values of the authorization object must be maintained by the individual responsible for the configuration of authorizations. Authorization object fields are not considered input fields on a screen. Instead, they are system elements, such as infotypes, which must be protected.

Note

In the SAP documentation, you can find information about maintaining authorization values.

You can define as many system access authorizations as you need for an object by creating several allowed values for the fields in the object. These value sets are called authorizations. The system checks these authorizations in OR relationships.

Master Data Authorizations

The HR: Master Data authorization object is used during the authorization check on HR infotypes. The authorization check takes place when HR infotypes are edited or read. The system queries the contents of the fields during the check.

Authorization Levels

The Authorization level field specifies the access mode. The following authorization levels exist:

Authorization Levels

Authorization Level	Description	Access Mode
R	Read	Read access
M	Matchcode	Read access using input help (F4)
W	Write	Write access
E and D	Enqueue and Dequeue	Write access using the asymmetrical double-verification principle; E allows the user to create and change locked data records, D allows the user to change lock indicators
S	Symmetrical	Write access using the symmetrical double-verification principle
*	All authorization levels	Always includes all other authorization levels simultaneously

Extended Check Authorization

The system uses the object HR: Master Data – Extended Check during the authorization check on HR infotypes. The checks take place when HR infotypes are edited or read.

The fields SACHA, SACHP, SACHZ, and SBMOD are filled from the Organizational Assignment infotype (0001). This infotype has time-dependent specifications and an authorization may exist only for certain time intervals, depending on the user’s authorization. A user’s period of responsibility is represented by all the time intervals for which the user has P_ORGXX authorizations.

All administrators responsible for an organizational area in Personnel Administration are grouped together in the administrator group.

In an SAP standard system, this extended check is not active. You can use the main authorization switch (transaction OOAC) to determine whether this check is to be carried out in addition to or instead of the HR: Master Data Check.

If the additional check is activated, the system performs an authorization check according to HR: Master Data. If the check result is positive, the system performs a further check according to HR: Master Data – Extended Check.

Personnel Number Check

The authorization object HR: Master Data – Personnel Number Check is used when you want to assign users different authorizations for accessing their own personnel number. If this check is active and the user is assigned a personnel number in the system, this check directly overrides all other checks except for test procedures.

The following values are possible for the PSIGN field:

I = Authorization for the user's own personnel number is included.
E = Authorization for the user's own personnel number is excluded.

You can assign a user a personnel number using infotype 0105, subtype 0001.

The HR: Master Data - Personnel Number Check does not take place for a user that is not assigned to a personnel number, or if the user accesses a personnel number other than his or her own. This check is irrelevant for personnel numbers that are not assigned to a user.

Personnel Number Check – Example 1

The figure Personnel Number Check - Example 1 illustrates an example of a user who is an administrator, responsible for the basic pay (infotype 0008) of a personnel area. The user has the corresponding HR: Master Data authorization for personnel area CABB. The user must be able to display personal data at all times but not be able to change his or her own basic pay, regardless of the personnel area of responsibility.

The authorization for the object HR: Personnel Number Check must be set as indicated in this example.

This authorization enables the following infotype access:

The first authorization grants the user read authorization for all infotypes stored under the user’s personnel number.
The second authorization denies write authorization for all data records of infotype 0008 stored under the user’s personnel number.

Hint

If you use personnel number-based authorizations, you must first set up all the authorizations that are not based on personnel numbers. Then, you must create different access authorizations for the personnel numbers assigned to users using appropriate P_PERNR authorizations. The P_PERNR authorizations override all other authorizations directly (except test procedures).

Personnel Number Check – Example 2

In this example, the user is an administrator responsible for the basic pay (infotype 0008) of a personnel area. The user has the corresponding HR: Master Data authorization for personnel area 3000. The user must be able to display personal data at all times but not be able to change his or her own basic pay, regardless of the personnel area of responsibility.

The authorization for the object HR: Personnel Number Check must be set as in this example.

This authorization enables the following infotype access:

The first authorization grants the user read authorization for all infotypes stored under the user’s personnel number.
The second authorization denies write access to all data records of infotype 0008 for the user’s own personnel number if the user becomes responsible later for the personnel area to which he or she belongs.

Flowchart: Personnel Number Check

Next lesson