SAP Security Online!
 
Web SAPSecurityOnline.com
 
   
 
 
 
 
 

 
 

BW Security

Using Workbooks model.

Generally power user create query to suit their teams needs and  save the results in a workbook. They may want to save the workbooks to their Favorites folder for easy retrieval later, or they may want to save the workbooks to a location where other users can execute the same workbook.

 Difference between workbooks and queries

An SAP BW user spends more time on the results. They perform activities such as drilling down to various levels in the data, rearranging the results to highlight certain relationships in the data, and eventually saving the results to a workbook. Now that the user has spent that time to format the results in a meaningful way, they would like the results to be in the same format each time they retrieve the results. To accomplish this, the user does not execute a query, but instead executes a workbook. The workbook contains the results of the query in the formatted look and feel that the user requires. Data in a workbook can either be static, refreshed manually, or refreshed automatically when the workbook is retrieved.

Queries are actually inserted into workbooks so you can display them. A
workbook could contain several queries that are related in nature.

Thus, a query is more the technical definition of what the results should look like. Workbooks are actual results that have been formatted and can be refreshed each time the workbook is executed.

 

How the reporting user accesses workbooks, and security related to workbooks.

You must set up security to control who can save workbooks, where they can be saved, and which workbooks appear in the BEx Browser for a specific user.

Workbooks can also be created in the BEx Analyzer. After executing a query, choose Save Save as new workbook.

Securing Workbooks

In order to save a workbook, a user needs two authorization objects. The two objects listed below are the minimum authorizations a user needs to save workbooks.

  • S_GUI: Authorization for GUI activities
  • S_BDS_DS: Authorizations for document set

Using both S_GUI and S_BDS_DS will enable a user to save workbooks to their Favorites folder.

The authorization object S_GUI has one field, Activity. The activity field must be set to 60. For S_BDS_DS, the user needs activities 03 and 30. The Class Type field should be set to OT.

 

Saving Workbooks to Roles
If a user wants to save aworkbook to a location where it can be easily accessed by others, they need to save to a Role rather than saving the workbook in their own Favorites folder. Saving to a Role means saving to a security role.

You may want to set up roles specifically for saving workbooks. You can then assign the role to all parties who need to share workbooks.

Another option is to not allow users to save workbooks, but rather only allow power users to save workbooks. This is done to maintain the roles and to ensure that the workbooks are manageable. This also prevents users from changing workbooks saved by other users.

In order to save workbooks to roles, a user needs:

  • S_USER_AGR: Authorizations: Role check
  • S_USER_TCD: Transactions in roles

The authorization object S_USER_AGR has two fields:
Activity and Role Name.
Activity field -Must have at least values 01, 02 and If the user can delete workbooks, they will also need value 06.

Role Name, you should enter the specific roles you have created for saving
workbooks. Use proper naming convention for roles so that the roles can be restricted pretty easily.  The role name is the name of a role that will be used to hold workbooks. Saving a workbook to a role actually updates the Menu portion of a role, so object S_USER_AGR is a required object.

Authorization object S_USER_TCD has one field
Transaction Code. The user needs value RRMX in this field.

Once a workbooks is saved, the data and the layout is saved in the workbook. For security reasons, we recommend that users save workbooks without the data. To save the workbook without the data, the users selects from following menu path from the BEx Analyzer: Tools > All queries in Workbooks > Delete results.

 

 

 



 
Copyright © 2005 - 2007 SAP Security Online.com All Rights Reserved.