Assigning Analysis Authorization 0BI_ALL for All Data

This lesson covers a common scenario where a client integrates analysis authorizations but needs a straightforward method for granting users access to all data, such as for testing purposes.

When a query is initially executed, the check by the authorization objects S_RS_COMP and S_RS_COMP1 must be successful.

If the InfoProvider on which the query is based contains characteristics flagged as authorization-relevant, the user needs analysis authorizations for the related authorization-relevant data.

For simple analysis authorization requirements, or when a user needs analysis authorizations for all data, for example for test purposes, there is the Special Analysis Authorization: 0BI_ALL.

In the figure shown, we can see the details of the analysis authorization of 0BI_ALL.

• The analysis authorization 0BI_ALL consists of all characteristics and navigation attributes flagged as authorization relevant and authorized for all values (*), grants access to all authorization-relevant data.
• 0BI_ALL is a generated analysis authorization that cannot be edited manually. It is automatically updated whenever a characteristic or navigation attribute is set to authorization relevant.

As shown here, analysis authorizations, and thus also special analysis authorization 0BI_ALL, can be assigned to the users in one the following ways:

1. Directly with the user assignment in transaction RSECADMIN
2. Recommended Method: Indirectly by using the authorization object, S_RS_AUTH and assigning it to a profile and then the profile to a role.

As shown in this figure the authorization object S_RS_AUTH can include analysis authorizations in roles. It consists of only one field BIAUTH where previously defined analysis authorizations are to be entered. The generated special analysis authorization 0BI_ALL can also be entered here. The following are the steps to assign an analysis authorization to a role:

1. Use the transaction PFCG (Role Maintenance), create a new role or enhance an existing one, and add the authorization object S_RS_AUTH into the profile of the role.
2. In the field BIAUTH of this newly created authorization object, you can use the input help button to select the relevant previously defined or generated analysis authorizations.
3. The role must be assigned to users using the PFCG transaction (Role Maintenance) on the User tab or the SU01 transaction (User Maintenance) on the Roles tab.