Authorization Concept in Business Context Viewer (BCV)

This function provides for an easily manageable way of granting complex authorization to users accessing Business Context Viewer (BCV) for different purposes. Authorization can be granted and denied at different levels, which makes the authorization concept flexible, while ensuring that data is not misused. The authorization concept of BCV is based on the following components:

• Roles

• Authorization objects

• NetWeaver access control lists (ACLs)

Role Maintenance (PFCG) roles contain authorization profiles, which in turn, are made up of authorization objects, and filled with authorization data.

The authorization concept of BCV offers the following three ways to use authorization objects along with the roles they are assigned to, and NetWeaver access control lists (ACLs):

• Use of authorization objects only

  Authorization objects are commonly used in SAP applications to administer the authorization of users. In this scenario, system administrators assign roles to users, and the authorization objects and authorization data contained in the roles determine the range of activities a user can perform, as well as the kinds of objects they can access and change. An advantage of using authorization objects only is that system administrators are familiar with authorization objects, and thus can manage complex authorizations. A disadvantage is that changing a user's authorization is time-consuming, because in such a case the system administrator might need to change the user's role and transport the role settings to the productive system.

• Use of NetWeaver ACLs only

  Users that do not necessarily have administrator rights can create, change, display, and delete NetWeaver ACLs. This means that users can grant or withdraw authorizations for BCV objects without asking a central system administrator to do this for them. An advantage of using NW ACLs only is that it is a flexible and decentralized way to deal with authorizations. If authorizations for a BCV object are changed frequently, the use of NW ACLs simplifies the assignment of authorizations.

• Use of authorization objects and NW ACLs

  You can choose using authorization objects together with NW ACLs when you have on one hand, BCV objects as, for example query view hierarchies that do not require detailed authorizations, and on the other hand BCV objects for which you must maintain detailed authorizations. In this case, you use authorization objects for BCV objects for which detailed authorizations are not required, for example, query views that display production quantities. You use NW ACLs for BCV objects that require detailed authorizations, for example query views that display financial data. You can also use an authorization object and NW ACLs for the same BCV object. In this case, you use the Business Add-In (BAdI) BAdI: Definition of the Priority of Authorization Checks to specify the sequence of the two types of authorization checks.