Track-Specific Authorizations 

When you allocate authorizations for groups and users in the User Management Environment (UME), these authorizations apply globally to their work in Change Management Service (CMS). This means, for example, that every user with an import authorization can run imports in all tracks.

To improve security in CMS, you can restrict access to certain tracks for specific groups and users. You do this with track-specific authorizations.

Activation of the track-specific authorizations

To launch the application for editing track-specific authorizations, enter the following URL:

http://<host>:<port>/devinf. Choose the CMS Track Authority link.

Activation of track-specific authorizations is split into two steps:

...

●      Assignment of UME groups and users to a track

When you make this assignment, you give selected UME groups and users authorization to work in a track.

●      Activation of the track-specific authorizations

When you do this, you enable the authorization check for a track. When track-specific authorizations are activated, only groups and users that are assigned to this track can access it.

Assigning track-specific authorizations restricts the permitted UME actions. If a UME group or user cannot perform the corresponding UME actions, you cannot add these actions by editing the track-specific authorizations.

Groups and users have authorizations at the same level. This means that restrictions on authorizations for users can be overridden by the authorizations of a group, and the other way around. If settings contradict each other, the authorization is assigned.

Functions

The following functions are available:

●      Track Authority State On/Off

This activates or deactivates the track-specific authorization check.

You can see the state of a track’s authorization check in the State column of the track list.

 On – There is restricted access to the track. Only entered users or user groups can work in this track in accordance with their authorizations.

 Off – All users or user groups can work in this track in accordance with their authorizations.

●      Save

Saves your data.

●      New Entry

This creates a new entry for the authorization list.

●      Delete

Deletes the selected entries from the authorization list.

●      Select All Entries

Selects all entries in the authorization list.

●      Deselect All Entries

Removes all existing selections in the authorization list.

●      Checks whether the Users/Groups are defined within UME

You use this function to check whether the group or user exists in the UME. You can see the result of the check in the UME column. The following results are possible:

○        User/group exists in the UME

○        User/group does not yet exist in the UME

You can also launch the check directly when you enter a user or group by pressing the return key. The check also runs when you change the authorization type.

●      Authorization list filter

For each column, you can enter filter values to filter the table.

●      Sort the list columns

You can sort the columns of the authorization list in ascending or descending order.

Track Authorizations

Icon	UME Action	Description
	All Actions (generic)	Selects all authorizations in the row automatically
	“Display” (CMS.Display)	Basic authorization for working with CMS Web UI. If you disable this authorization, the user or group can only access CMS through programming interfaces (in accordance with the existing authorizations).
	“Export Own” (CMS.ExportOwn)	Release your own activities in SAP NetWeaver Developer Studio
	“Export Foreign” (CMS.ExportForeign)	Release other users’ activities in SAP NetWeaver Developer Studio
	“Modify Track” (CMS.ModifyTrack)	User or group can modify the selected track and edit track connections.
	“Transport” (CMS.Transport)	User or group can perform all regular import actions.
	“Critical Functions” (CMS.CriticalFunctions)	User or group can perform all critical functions in the import queues.
	“Approve” (CMS.Approve)	User or group can perform the actions on the Approval tab page.

For more information, see Editing Track-Specific Authorizations.

For recommendations about how to combine UME actions effectively in UME roles, see Roles in Change Management Service.