SAP Business Objects Analysis For MS Office Authorization .

SAPBusinessObjectsAnalysis for MS OfficeAuthorization StrategyVersion: FinalBikash Mohanty1

Table of Contents1SAP BusinessObjects Analysis Authentication and Authorization31.1User types31.2Broad Category of Tasks in Business Objects Analysis41.3BW Authorization41.4Business Objects Authorization51.4.1Assignment of User Groups & Roles to the Folders in Business Objects in CMC71.4.2Relationship between Access Levels and User Groups in Business Objects CMC82Authorization Strategy103Step-by-Step SAP BusinessObjects Authorization Configuration123.1User and User Group Creation:123.2STEP 1: Creating a User:123.3STEP 2: User Group Creation133.4STEP 3: Importing Roles from the backend SAP BW system143.5STEP 4a: Automating Importing of Roles from SAP BW system into Business Objects163.6STEP 4b: Schedule a SAP Authentication Role update in Business Objects using a java program163.7STEP 5: Standard Access Levels183.8STEP 6: Custom Access Levels193.9STEP 7: Folder level Security204Top Level / Server Level Security:245Application Level Security:266Manage CMC User Security277Advance Rights298Security Query319Appendix (BW Authorization Set up in Detail)332

1 SAP BusinessObjects Analysis Authentication and Authorization Authorization is the process of verifying the user has sufficient rights to perform therequested action upon a given objects. Action means to view, refresh, edit, schedule, etc. Object means: folder, report, instance, universe, etc. Authorization is handled based on how the “access level”, “application security”, and“content security” such as users and groups, universe security, folder access, etc. aredefined using CMC.SAP BusinessObjects Authorization works differently but in conjunction with SAP BW Authorizationmodel.1.1 User typesUser TypeBEX QueryDeveloperBusiness ObjectsAnalysis ReportDevelopersReport UsersTaskAccess Requirement Develop the source queries In order to develop a report in SAPBusinessObjects Analysis for excel ;using SAP BW-BEX. Develop the reports in SAPBusinessObjects Analysis forexcel. Use the reports from SAPBusinessObjects Analysis forexcel A BW-BEX report needs tobe accessed from SAP BWand make it as data sourcefor SAP BusinessObjectsAnalysis report. SAPBusinessObjectsAnalysis report need to becreated, formatted usingexcel add-in and then besaved into a server folder. Copy Report from theapplicationfolderinBusinessObjects into own3

personalfolderandexecute reports for one ormore application areas.Power Users Develop & Execute reports inSAP BusinessObjects Analysisfor excel. Execute reports from oneor more application areasdirectlyfromtheapplication folders inBusiness Objects. Schedule report Create other SAP BusinessObjects Analysis reports.1.2 Broad Category of Tasks in Business Objects AnalysisTasksSAP BW Report Development & Sourcingfrom Business Objects platform.SAP Business Object Analysis for ExcelReport Development, Execution &Scheduling.1.3 BW AuthorizationBW Functional RolesControlled by AuthorizationControlled by SAP BW Authorization/RoleAssignmentControlled by SAP BusinessObjects AuthorizationAssignmentRole Assignment1. Wehavecreateddifferent roles in SAP BWfor different applicationareas (Such as FI, SD,MM etc).2. Chosen BW-BEX reportsfromthespecificapplication areas can besaved to the relevantroles, if we want torestrict the users inBusiness Objects to haverestricted access.3. Depending on the jobprofileandthedepartment they belong,roles are going to beassigned to BW businessusers and developers.4

Note: BW Authorization set up is covered in detailed, in appendix 4. If Business Object usersneed to have differentsection below.reportingaccessinBusinessObjectsAnalysis; in comparisonto SAP BW users; then anew set of roles can bedeveloped in SAP BW forSAPBusinsssObjectsenvironment. Throughthese new set of roles,same users can beallowed different reportaccess in BO systems toBW reports.1.4 Business Objects AuthorizationBusinessObjects AccessUser & GroupsFoldersRole Assignment1. Import “Roles” & “Users” from SAPBW.2. Create various “User groups” inSAP Business Objects CMCplatform such as “Developer” or“Administrator” or “Report Users”or “Power Users – Finance”,“Power Users – Operation”,“Power Users – Procurement”,“Power Users – CS”, “Power Users– SC”, “Power Users – AR” etc.3. Assign the imported “Roles” tovarious “User Groups” created inStep 2. Right click on the importedroles choose “Join Group” Choose the groups listed aboveone by one.4. Create various “Folders” in CMC,for report management ofdifferent application areas; such as“Finance”,Procurement”,“Operations”, “Customer Service”,“Supply Chain” & “AccountsReceivable” etc.5

Access Level5. When we create any new “Folder”,three sets of permissions areautomaticallyassigned:Administrator, Developer andEveryone. “Administrators” aregiven the access level “FullControl”. “Everyone” is given theaccesslevel“NoAccess”.“Developers” are given the accesslevel “Full Control”.6. Select each Folder Right click User Security Add Principles Select Groups. Each folder �Everyone”mandatorily. In addition, theyshould have the applicationspecific groups. For example: theFINANCE Folder should havefollowing groups; “Power user –Finance” & “Report user –Finance”,inadditionto“Administrator”, “Developer” &“Everyone”. Once a Principal /Group are assigned to a folder, wecan choose “Add/AssignSecurity”.7. At this stage, we will be required tochoose either “Generic Accesslevels” such as “Full control”,“Schedule”, “View” or “View ondemand” or we can create customaccess level or we can evenmaintain “ADVANCED accesslevel” analysing complex scenariowith set of very detailedparameters from “Advance” tab. Access Levels need to bedefined for each of the User orUser Groups assigned to thefolders. “Grant” radio button can beselected for providing variousaccesses such as to schedule areport, view, Pause and6

resume its Scheduled instancesetc.“Deny” radio button can beselected to deny access toother activities such asaccessing any folder or report,and to view, delete a report.We can also allow the rights tobe applied to a “Sub object”,by checking the Object and SubObject check boxes, next to theRights column.Only after we click grant ordeny radio button, “Object”and “Sub-object” check boxesare enabled. Now we canmaintain the scope of rights.If we want to apply a right onlyfor a “Folder” and “not for its“Sub folders”, then we canuncheck sub-object check box.Note: Unlike SAP systems, Business Object Enterprise do not comprise of Roles, Profiles andAuthorization objects. Security in Business Objects is different than SAP and it consists of: Folderlevel security, Application Security, Object Level Security and inheritance concepts.1.4.1 Assignment of User Groups & Roles to the Folders in Business Objects in CMCBusiness ObjectUser Group Assignment to the FoldersBW Role Assignment to the GroupServer FoldersFinance & Controlling DeveloperRole from SAP BW Containing allthe Finance specific reports we Administratorwant to be accessible in BO EveryoneAnalysis for excel. Power user – Finance Report user – FinanceProcurementRole from SAP BW Containing all Developerthe Procurement specific reports Administratorwe want to be accessible in BO EveryoneAnalysis for excel. Power user – Procurement Report user – ProcurementFinancial Supply Chain DeveloperRole from SAP BW Containing allManagementthe FSCM specific reports we want Administratorto be accessible in BO Analysis for Everyoneexcel. Power user – Operations Report user – OperationsCustomer ServicesRole from SAP BW Containing all Developerthe Customer Services specific Administratorreports we want to be accessible7

SupplyChain Management Accounts Receivable Plant Maintenance Sales & Distribution Materials Management 1.4.2EveryonePower user – Customer ServicesReport user – Customer ServicesDeveloperAdministratorEveryonePower user – Supply ChainReport user – Supply ChainDeveloperAdministratorEveryonePower user – Accounts ReceivableReport user – Accounts ReceivableDeveloperAdministratorEveryonePower user – Plant MaintenanceReport user – Plant MaintenanceDeveloperAdministratorEveryonePower user – Sales & DistributionReport user – Sales & DistributionDeveloperAdministratorEveryonePower user – Materials ManagementReport user – Materials Managementin BO Analysis for excel.Role from SAP BW Containing allthe Supply Chain specific reportswe want to be accessible in BOAnalysis for excel.Role from SAP BW Containing allthe Accounts Receivable specificreports we want to be accessiblein BO Analysis for excel.Role from SAP BW Containing allthe Plant Maintenance specificreports we want to be accessiblein BO Analysis for excel.Role from SAP BW Containing allthe Sales & Distribution specificreports we want to be accessiblein BO Analysis for excel.Role from SAP BW Containing alltheMaterialsManagementspecific reports we want to beaccessible in BO Analysis for excel.Relationship between Access Levels and User Groups in Business Objects CMCAccess LevelRightsUser GroupsNo AccessThe no access level may be misleading. The no accesslevel does not explicitly deny access, but rather, sets allpermissions to “Not Specified.” This can be overriddenthrough inheritance.EveryoneViewWhen set at the folder level, the user can view the folder, Occasional Users /the objects contained in the folder, and all generatedReport Usersinstances of each object.At object level, the user can view the object, history ofthe object, and all generated instances of the object.The user cannot schedule or refresh the report, howeverby default; the user can edit the report and save to apersonal folder to refresh there. We can deny users fromcopying the object by going to advanced and denying8

“Copy Objects to another folder”ScheduleA user can generate instances by scheduling the object torun against a specified data source once or on a recurringbasis. The user has full access to the scheduled instancesthat they own. They can also schedule to differentformats and destinations, set parameters, pick servers toprocess jobs, add contents to the folder, and copy theobject or folder.DevelopersAdministratorsPower-UsersView On DemandA user can refresh a report in real time. Note that if areport is a WEBI document, the user will also need ViewOn Demand access to the universe and universeconnection to perform the refresh.Power UsersFull ControlAllows users to modify all of the object’s properties. Thisis the only access level that allows users to delete objects.DevelopersAdministrators9