Maintaining Standard Authorizations

Remember: In SAP BW/4HANA, Authorizations based on the Application Server (AS) for ABAP Authorization concept dictate permissions for users' actions within the SAP BW/4HANA system.

In SAP BW/4HANA, these authorizations are called Standard Authorizations to distinguish them from Analysis Authorizations.

Users need standard authorizations to perform tasks such as:

• Model data by creating, changing, or delete metadata objects, such as InfoObjects, InfoProviders, and data flow elements.

• Load and administer data.

• Define and execute queries.

• Work in the planning workbench.

Each authorization refers to an authorization object and defines one or more values for each field that is contained in the authorization object. Authorization objects are delivered for the various areas.

Individual authorizations are grouped into roles by system administration. You can copy the roles delivered by SAP and adjust them as necessary. The system administrator creates these authorizations and enters them into individual users' master records in the form of profiles.

Modelers and Administrators must have access to the numerous SAP BW/4HANA metadata objects, such as InfoObjects, InfoProviders, data transfer processes, process chains, open hub destinations, and DataSources.

Administrators must also create and maintain many other data warehousing objects. Authorization object S_RS_ADMWB protects these objects.

Templates enable you to easily insert a set of authorizations into a role. Templates are maintained in the role maintenance transaction PFCG (in former releases under the transaction SU24) under Utilities → Templatesand are used in the authorizations section of the role.

You can choose or change the templates provided by SAP or create your own templates.

Once you are in the authorization section of the roles, the Choose Template window appears automatically if the menu is empty. Otherwise, to integrate a template into a role, choose Edit → Insert Authorizations → From template. After inserting the template, you can update, insert, and delete authorizations as needed.

As shown here, you can define how authorization assignments and checks take place, either by characteristic or characteristic value.

The following authorization objects exist:

• S_RS_IOMAD

  With this authorization object you can grant authorization for the maintenance of master data of one or more InfoObjects within one or more InfoAreas.

  Activities:

  • 03 = Display

  • 23 = Maintain

  • 06 = Delete

• S_TABU_LIN

  S_TABU_LIN controls access to individual table rows, that means an authorization check takes place by characteristic value.

  Activities:

  • 02 = Add, change or delete table entries

  • 03 = Display table entries

  The object complements the authorization objects S_TABU_DIS, S_TABU_NAM, and S_TABU_CLI.

With authorization checks by characteristic value, the system generates an organization criterion for the characteristic. The organization criterion generates a connection between table key fields and the authorization fields for the S_TABU_LIN authorization object.

You can use the S_TABU_LIN authorization object to enter characteristic values in each key field of the master data table for which the user requires authorization. This is performed in the profile generator in role maintenance. In this way, you are able to use authorizations to protect the maintenance and display of master data/texts for this characteristic at single record level.

Characteristic values that don't have user authorization are not displayed in the input help.