Symptom
The following section briefly describes for which purposes the
transaction 'Assigning users to the planning book' is used:
data view was last used by a user in a transaction.
If the entry is initial, this represent the general access to the 'Interactive demand planning' transaction, in which the customer can see and use all user-defined sessions (both demand and supply network planning).
For every entry in the list you have two selection fields available at the end.
'Fixed selection':with this option, the user can limit the access in the transaction to a fixed planning book/data view, irrespective of which selection was made when the transaction was terminated.
You will find additional information on these objects in note 400434.
Usually it cannot therefore be used in the productive environment, since the client is locked here against changes. Other terms
/sapapo/pbdvwsel, /SAPAPO/MSDP_PB016
Solution
Consulting
The following section briefly describes for which purposes the
transaction 'Assigning users to the planning book' is used:
- When you execute the transaction /sapapo/sdpplbk you can
data view was last used by a user in a transaction.
If the entry is initial, this represent the general access to the 'Interactive demand planning' transaction, in which the customer can see and use all user-defined sessions (both demand and supply network planning).
- The entries of the list are created by the application or
For every entry in the list you have two selection fields available at the end.
'Fixed selection':with this option, the user can limit the access in the transaction to a fixed planning book/data view, irrespective of which selection was made when the transaction was terminated.
- Do not use this transaction for administrative purposes.
You will find additional information on these objects in note 400434.
- The transaction 'Assign user to planning book' is a
Usually it cannot therefore be used in the productive environment, since the client is locked here against changes. Other terms
/sapapo/pbdvwsel, /SAPAPO/MSDP_PB016
Solution
Consulting
Header Data
| Release Status: | Released for Customer |
| Released on: | 30.07.2003 13:24:19 |
| Master Language: | German |
| Priority: | Correction with low priority |
| Category: | Consulting |
| Primary Component: | SCM-APO-SNP-BF Basic Functions |
| Secondary Components: | SCM-APO-FCS-BF Basic Functions |
Affected Releases
|
Related Notes
| 1045639 - Consulting notes in SNP/CTM | |||
| 458127 - Start interactive planning with authorization concept | |||
| 400434 - Authorizations in APO demand planning | |||
| Print Selected Notes (PDF) | |||
Attributes
Note 400434 - Authorizations in APO demand planning
This note explains the authorization concept in APO for demand planning.
The following authorization objects are used:
C_APO_MAC: Macro (DP)
ACTVT Activity (16)
APO_VIEW Planning view --- Generated dynamically
APO_PLBK Planning layout --- when a macro is created, can be
APO_MACRO Macro ID --- displayed in the Macro Builder
C_APO_ADV: Macro maintenance (DP)
ACTVT Activity (02, 16)
APO_PLBK Planning layout --- Generated automatically, display in
APO_VIEW Planning view --- Macro Builder
C_APO_TLAN: Transportation lane
ACTVT Activity (02, 03, 16)
APO_LOCFR Start location
APO_LOCTO Target location
APO_TMODMeans of transport
C_APO_FUN: SDP functions
APO_FUNC Function (fixed values of domain /sapapo/functionality)
APO_PAREA Planning area
C_APO_ADVN: Macro names
ACTVT Activity (02,16)
APO_MAKRON Macro identifier (macro names are not unique)
C_APO_PB: SDP planning books
ACTVT Activity (01, 02, 03, 06, 16)
APO_PLBK2 Planning book
APO_DVIEW Data view
C_APO_SEL3: Selection in planning area
ACTVT Activity (01, 02, 03, 06, 16)
APO_SELTXT Description of a selection <--- only 40 characters used
APO_PAREA Planning area
APO_PLBK2 Planning book <--- is not used, maintain*
APO_VERS APO plan version
C_APO_SEL2: Selection in planning area, obsolete
Object should always be maintained with "*"
ACTVT Activity (01, 02, 03, 06, 16)
APO_SELID Selection ID
APO_PAREA Planning area
APO_PLBK2 Planning book
APO_VERS APO plan version
C_APO_MOD: Model
ACTVT Activity (01, 02, 03, 06)
APO_KENN Key figure: Differentiates between active and inactive (A, I)
APO_MOD Model name in the supply chain network
C_APO_VERS: Planning version in APO
ACTVT Activity (01, 02, 03, 06, 16)
APO_MOD Model name in the supply chain network
APO_APKZ Application indicator (in SDP = SNP)
APO_KENN Key figure: Differentiates between active and inactive
APO_VERS APO plan version
C_APO_LOC: Master data, locations
ACTVT Activity (01, 02, 03, 06, 16, 32)
Activity 16 is used in SDP
to change the data
APO_LOC Location
C_APO_PROD: Master data, products
ACTVT Activity (01, 02, 03, 06, 16)
Activity 16 is used in SDP
to change the data
APO_LOC Location (must be maintained with '*' in DP)
APO_PROD Product
C_APO_RES: Master data, resources
ACTVT Activity (01, 02, 03, 06, 16)
Activity 16 is used in SDP
to change the data
APO_LOC Location (must be maintained with "*")
APO_PLNR Resource planner group (must be maintained with "*")
APO_RES Name of resource
C_APO_IOBJ: Key figures (as of SCM 4.0)
ACTVT Activity (02, 03)
If activity 02 and 03 are not permitted for the user,
no data is read for this key figure.
APO_PAREA Planning area
APO_IOBJNM InfoObjects (key figures)
C_APO_DPPR: Authorization for products in Demand Planning (as of SCM 4.0)
ACTVT Activity (02, 03)
APO_PROD Product
C_APO_RLG: Authorization for realignment (as of SCM 4.0 Support Package 11)
ACTVT Activity (01, 02, 03, 06, 07, 16)
APO_PSTRU Planning object structure
C_APO_CPY: Authorization for copying (as of SCM 4.0 Support Package 11)
ACTVT Activity (01, 02, 03, 06, 07, 16)
APO_PAREA Planning area
C_APO_PROM: Authorization for promotions (as of SCM 4.1)
ACTVT Activity (02, 03)
APO_PROMID Promotion
C_APO_LIKE: Authorization for LIKE profiles (as of SCM 4.1)
ACTVT Activity (02, 03, 22)
APO_PAREA Planning area
APO_LIKENO LIKE profile
C_APO_PRPF: Authorization for forecast profile (as of SCM 4.1)
ACTVT Activity (02, 03, 16)
APO_PRPFL Overall forecast profile
APO_STATPF Univariate forecast profile
APO_MLRPF MLR forecast profile
APO_COMPPF Combined forecast profile
C_APO_TSID: Authorization for time series (for example, weighting profile, ...;
as of SCM 4.1)
ACTVT Activity (02, 22)
APO_TSID Time series
All individual authorization checks are performed in the function module /SAPAPO/MCP_PERMISSION_CHECK2. A where-used list on the function module provides the SDP authorization checks. If you want to perform a check for a quantity (table) of objects such as products, locations, resources or planning books, use the function module /SAPAPO/MCP_PERMISSION_SELECT.
In addition, you can program the authorization check for individual customers using the USER EXIT EXIT_/SAPAPO/SAPLMCPR_015 of the function group XDMUSER.
You cannot use delivered authorization objects to perform checks on any characteristic level in interactive planning. Instead, you must use the user exit.
Since Note 436400, you can use the user exit to carry out a check for data views of a planning book. As of SCM 4.1, the authorization object C_APO_PB contains an additional authorization field APO_DVIEW so that the data views for a planning session can also be checked in the standard system.
In APO 3.0/3.1, you can use Demand Planning and Supply Network Planning (/sapapo/sdp94, /sapapo/snp94) with the same user if the location is restricted for the authorization object C_APO_PROD in SNP. This restriction is not allowed in Demand Planning. You cannot avoid the restriction by using the user exit. If you want to restrict the location in SNP, you must create a second user. As of Release SCM 4.0, a separate authorization object for products (C_APO_DPPR) is available in Demand Planning. This way, the user can carry out both planning procedures and restrict the location in SNP.
Generally speaking, the authorization is always granted in the case of the authorization objects specified above if the authorization object is not assigned to a user. This means that you do not have to assign authorization objects with the instance * to every user if you do not want to use them.
Calling interactive planning
-------------------------------
When you start interactive planning, the system checks authorizations for the two functions (C_APO_FUN) C_SELCTION 'Freely combine selections' and C_SELORG 'Maintain selection assignment'. If the authorization C_SELCTION is missing, the 'Selection window' button of the SDP selector is grayed out. Combining selections is therefore not possible. This means that you can restrict the authorization of a user to loading saved selections only. If the authorization C_SELORG is missing, you cannot call the selection organization.
Selections in interactive planning:
---------------------------------------
The authorizations for the functions C_SELE and S_SELE are required to execute a 'free' selection. The authorization for the function S_SELE and the authorization for the selection to be loaded (C_APO_SEL2/C_APO_SEL3) must be available for you to load a saved selection. During the transfer of the selection, the system first checks the authorization for the selected version (C_APO_VERS). Only one authorization check for the object version (C_APO_VERS), products (C_APO_PROD) and locations (C_APO_LOC) can be performed in the DP for selections in the standard system. In the SNP, you can check the object version (C_APO_VERS), products (C_APO_PROD), locations (C_APO_LOC), location products (C_APO_PROD), resources (C_APO_RES) and transportation lanes (C_APO_TLAN). Additional authorization checks, in particular for other characteristics of the selection (for example, sales organizations in the DP) are not provided in the standard system. You can run these using the user exit for authorizations. With this user exit or the BAdI method 'SELECTION_CHECK' (BAdI '/SAPAPO/SDP_SELECTOR'), you can, for example, force a user to make a selection for a certain characteristic. During the authorization check in the DP, make sure that only the objects specified in the selection condition are checked. For performance reasons, characteristic combinations that belong to a selection are not determined and subjected to an authorization check.
During the authorization check for objects, the activity 'Display' (03) is always checked during the selection. For the above-mentioned objects (in DP: Product and location in SNP products, locations, location products, resources and transportation lanes), an authorization check is carried out in the SDP selector for the hit list entries. The hit list contains only the objects that can be displayed by selecting the 'Display' function in the shuffler. Objects for which you have no display authorization do not appear in the hit list. When you select products in Demand Planning, note that the 'location' parameter from the authorization object 'C_APO_PROD' is not allowed to be restricted. This a restriction is only allowed when you select location products in SNP. Up to and including Support Package 13, when you select transportation lanes in SNP, the activity 'Execute' (16) is checked because the activity 'Display' (03) does not yet exist. As of Support Package 14, the activity 'Display' is checked in the same way as the other objects.
Since SCM 4.1, you have option of activating the BW authorization concept for characteristics. In this case, note that for the defined selection, only characteristic value combinations for which you have display or change authorization are selected. If you do not have authorization for at least one characteristic value combination selected, the system cannot display a results list in the shuffler. For detailed information about the BW authorization concept for characteristics, refer to the online documentation.
Loading data in interactive planning:
-------------------------------------------
At this stage, an authorization check is carried out for both the selection condition and the characteristics of the objects that have been loaded, if you are on the lowest level (all characteristics of the planning object structure have been specified). The system checks only the objects of the selection condition that have unique characteristics. For performance reasons, the system does not create an object list from entries containing wildcards, ranges or exclusion conditions, nor does it carry out a check. If you are in change mode, it is the activity 'Execute' (16) that is checked for all authorization objects. Note that before Support Package 12 or Note 399891, it was activity 'Change' (02) that was checked. If there is no change authorization, the respective checks are made on the activity 'Display' (03). The transaction switches to display mode if data may be displayed only. If there is no authorization to display the data either, the system issues a relevant error message. The system does not display any data.
To be more precise, the following authorization checks are made in this sequence:
Planning book, version, products, locations, location products, resources and transportation lanes.
Since SCM 4.1, if the BW authorization concept for characteristics is active, a check is carried out in addition to see whether the user has display or change authorization for the characteristic value combinations selected. If the user has display authorization only, the system switches to display mode automatically.
Affected authorization objects during the selection/loading of data:
C_APO_FUN (with functions: C_SELCTION, C_SELORG, C_SELE, S_SELE), C_APO_SEL2, C_APO_SEL3, C_APO_VERS, C_APO_PROD, C_APO_LOC, C_APO_RES, C_APO_TLAN
Forecast
----------------
The object C_APO_FUN with the function C_PRPFL is checked in the transaction used to maintain the forecast profile /sapapo/mc96b. The same constellation is called up in interactive planning when you save or delete forecast profiles. For life cycle planning, the object C_APO_FUN is used with the function C_LIFECC (as of Support Package 14). The function C_ZUORPR with the object C_APO_FUN is used for to assign forecast profiles to selections (as of Support Package 14). When you run the forecast in interactive planning, the object C_APO_FUN is used with the function C_FCST. In display mode, the function S_FCST is requested. You can use the BAdI /SAPAPO/IF_EX_SDP_INTERACT (see Note 414431) to hide the function keys for specific users in the forecast view and in all user-defined views. Note that you generally require the authorization C_PRPFL with the object C_APO_FUN when you save the data in the forecast, since the forecast profile is also stored.
Since SCM 4.1, the new authorization object C_APO_PRPF is checked when you display or change a forecast profile and when you run a forecast with the corresponding profile. In lifecycle planning, the system also checks the authorization object C_APO_LIKE when a LIKE profile is processed.
Promotion
----------------
The object C_APO_FUN is checked with the functions S_PROMO and C_PROMO. For display mode, the function S_PROMO is requested. For change mode, S_PROMO and C_PROMO are requested. When you assign characteristic values to the promotion or change an existing promotion, only C_APO_PROD and C_APO_LOC are checked as standard.
Since SCM 4.1, the new authorization object C_APO_PROM is checked. To display or change a promotion, the corresponding authorizations must have been maintained.
Release DP - SNP
------------------
The object C_APO_FUN is checked with the function C_RELEASE.
Creating/changing a batch job (/SAPAPO/MC8D, /SAPAPO/MC8E)
--------------------------------------------------------------
Object C_APO_FUN is checked using the functions C_BATCH and C_ACTIVITY. If one or several selection IDs were selected, a check with the function C_SELE and the authorization objects C_APO_SEL2 and C_APO_SEL3 is also carried out.
Background processing
-------------------------
In background processing, the object C_APO_FUN is checked using the C_BATCH, C_FCST, C_MAKRO, C_RELEASE, and C_APOTOR3 functions. Authorization checks of the individual selections generated dynamically and are not carried out for performance reasons. The specified basis selection is checked using the objects C_APO_SEL2 and C_APO_SEL3.
Since SCM 4.1, the new authorization object C_APO_PRPF is checked to see whether there are sufficient authorizations to run a forecast with the corresponding forecast profile.
If the BW authorization concept for characteristics is active, a check is carried out before background processing to see whether there are sufficient authorizations for the selected characteristic combinations. If there is no authorization for at least one combination, background processing cannot be carried out.
Maintain characteristic combinations (/sapapo/mc62)
---------------------------------------------
A check for the object C_APO_FUN is carried out using the function C_CHARC. No planning area is specified since several planning areas may belong to one planning object structure. If a check is to be carried out specifically for the object structure, the user exit can be used.
The BW authorization concept for characteristics is disabled by default but you can activate it using the method ENABLE_AUTH_CHK_MC62 of the BAdI /SAPAPO/SDP_AUTH_CHK. Then authorization checks at characteristic value level are carried out for the individual activities. Depending on the number of characteristic value combinations concerned, those checks may take a very long time.
Proportion maintenance (/sapapo/mc8v)
-------------------------------
Here, a check for the object C_APO_FUN is carried out using the function C_ANTEIM and the current planning area.
Copy/version management (/SAPAPO/TSCOPY)
-----------------------------------------------
A check is carried out on the object C_APO_FUN with the function C_VRSIOM and the planning areas for source and target. The version is specified for calling the user exit (Note 516898).
Load planning area version (/SAPAPO/TSCUBE)
------------------------------------------------
A check is carried out on the object C_APO_FUN with the function C_LPLV and the current target planning area. The version is specified for calling the user exit (Note 516898).
DataSources for planning areas
--------------------------------
As of SCM 4.1, an authorization check for the authorization object 'C_APO_FUN' with the function C_DS (create/change/delete DataSource) is carried out when generating, repairing, changing, replicating, transporting, deleting DataSources or changing their properties.
Realignment and copy functions (/SAPAPO/RLGCOPY)
----------------------------------------------------------
Since SCM 4.0 Support Package 11 or after you implement Note 704416, the two authorization objects C_APO_RLG and C_APO_CPY are available for detailed authorization maintenance in the area of realignment and copy functions. A check is carried out when you run realignment or copy and when you create and edit the corresponding step tables. For detailed information, refer to Note 704416.
Profile generator/transaction SU22
---------------------------------------
In Demand Planning and in Supply Network Planning, the 'check' indicator was maintained in most cases for the authorization objects used in transaction SU22 (in particular in interactive planning /sapapo/sdp94 and /sapapo/snp94). An exception is the object C_APO_FUN for which useful default values can be given. Here, 'check and maintain' was set as well. This means that when you assign the interactive planning transaction to a role, no authorization objects are proposed in the profile generator. This is not an error, rather something that cannot be avoided. Since the objects used and processed in interactive planning are only generated dynamically in the customer's system, no default values can be given. In this situation, you need to assign the relevant objects manually. You can do this using the information contained in this note and transaction SU22 (here, all objects that are checked are specified).
General information
---------------
The authorization check is available as of Support Package 13 when you go to design mode in interactive planning. The object C_APO_FUN with the function C_DESIGN is used here (see Note 412599).
See also the information in the related notes assigned to this note.
Other terms
Sales planning, authorizations, authorization concept
Reason and Prerequisites
This note provides information about the authorization concept.
Solution
Refer to the consulting note.
Header Data
| Release Status: | Released for Customer |
| Released on: | 29.01.2009 11:42:07 |
| Master Language: | German |
| Priority: | Recommendations/additional info |
| Category: | Consulting |
| Primary Component: | SCM-APO-FCS Demand Planning |
Affected Releases
Release-Independent
Related Notes
