Outlining Organizational Key Authorization Checks

Objectives

After completing this lesson, you will be able to:
  • Outline authorization checks that use the organizational key
  • Update an organizational key authorization

Organizational Key

The organizational key (P0001-VDSK1 field) used to run differentiated authorization checks on the organizational assignment (using the P_ORGIN authorization object). The content of the organizational key is either derived by the system from the fields of the Organizational Assignment infotype (0001) or entered manually by the user.

The organizational key consists of a 14-character field in infotype 0001 that you can structure freely. You can use specific control and rule tables to help you structure the field. Do not confuse the organizational key with the organizational unit.

In the standard system, the organizational key is built up as follows: the first four places contain the personnel area and the following ten places contain the cost center.

You can create your own Organizational Key in configuration. The organizational key can be made up of any collection of field values found on Infotype 0001 and is limited to 14 character spaces.

The corresponding menu path in Customizing is Personnel ManagementPersonnel AdministrationOrganizational DataOrganizational AssignmentSet Up Organizational Key.

Organizational Key

The Organizational Key feature (VDSK1) and the T527 (Organizational Key: Control), T527A (Organizational Key: Rules for Creating Organizational Keys), and T527O (Organizational Key: Validation) tables control the creation and validation of the organizational key.

A variable key (VARKY) is determined for this purpose using the VDSK1 feature. This key is used according to table T527 to determine how the organizational key (VDSK1) should be created or validated.

The organizational key is stored in the Organizational Assignment infotype of the employee. When a user accesses the personnel data of the employee, the system checks whether authorization exists for the concrete value of the organizational key field.

In the example in the graphic, authorization exists for employees in personnel area 1200 who have been assigned cost center 1000.

Organizational Key Authorization

A variable key is determined using the VDSK1 feature.

This key is used according to the Organizational Key: Control table (T527) to determine how the organizational key should be created or validated. The fields Default/Validation and Rule for Creating Organizational Keys are evaluated for this purpose. The Default/Validation field can contain the following values:

1 = optional entry without validation

2 = optional entry with validation

3 = required entry with validation

4 = default that cannot be overwritten without validation

5 = default that can be overwritten without validation

6 = default that can be overwritten with validation

7 = default that cannot be overwritten with validation

If you make an entry for Default/Validation which causes a default value to be created (entries 4, 5, 6 or 7), you must also maintain the Rule for Creating Organizational Key field. This entry is then used to determine the corresponding creation rule for the organizational key Organizational Key: Rule for Creating Organizational Key table (T527A).

If you make an entry for Default/Validation which causes the organizational key to be validated, you must enter the values that should be recognized by the system as permitted in the Organizational Key Validation table (T527O).

Organizational Key: Steps (2)

If you make an entry for Default/Validation which causes the organizational key to be validated, you must enter the values that should be recognized by the system as permitted in the Organizational Key Validation table (T527O).

The Organizational Key: Validation table contains a list of the permitted entries for the Organizational Key field (VDSK1). Only entries with hierarchy = 1 are relevant for validation. All other entries are ignored when validating the organizational key.

The Organizational Key column contains the organizational key that should be permitted during the validation.

In the Short Name and Name columns, you can store a short text or a description for each organizational key. The texts appear when you call input help for the Organizational Key field. The texts are irrelevant for the actual validations.