SAP BW Security (Authorizations)

 This guide outlines key SAP BW security transaction codes, steps to activate authorizations, hierarchical authorizations, and structural authorizations in SAP BW.

SAP BW Security Transaction Codes

Transaction Code	Description
RSA1	Main transaction for administrative functions in SAP BW (Administrator Workbench)
RSD1	Used to mark objects as relevant for authorization (InfoObject Maintenance)
RSSM	Used to create and modify authorization objects in SAP BW
RSZV	Used to create or modify variables for authorization checks (Variable Maintenance)
RRMX	Business Explorer reporting tool in SAP BW for data analysis
GLOBAL_TEMPLATES	Templates for modeling and evaluating data

---

How to Activate Authorizations in SAP BW

Follow these steps to activate authorizations in SAP BW:

1. Mark InfoObject as authorization-relevant → Transaction RSD1
2. Create a report authorization object → Transaction RSSM
3. Select InfoCubes for authorization → Transaction RSSM
4. Manually integrate the authorization object into a role → Transaction PFCG
5. Change/Maintain authorization values → Transaction PFCG
6. Assign the role to a user → Transaction PFCG or via Central User Administration (CUA)

---

Hierarchical Authorizations in SAP BW

To control authorizations for hierarchies, follow these steps:

1. Transfer and activate InfoObject 0TCTAUTHH → Transaction RSD1
2. Mark InfoObject 0TCTAUTHH as authorization-relevant → Transaction RSD1
3. Mark Leaf InfoObject as authorization-relevant → Transaction RSD1
4. Create authorization objects with 0TCTAUTHH and Leaf InfoObject → Transaction RSSM
5. Define hierarchical authorizations → Transaction RSSM
6. Manually integrate the authorization object into a role → Transaction PFCG
7. Maintain authorization values → Transaction PFCG
8. Assign the role to a user → Transaction PFCG or via Central User Administration (CUA)

---

Structural Authorizations in SAP BW

Structural authorizations from mySAP ERP HCM can be extracted and mapped in SAP BW to maintain system consistency. The relevant tables include:

• T77PR – Structural authorization profiles
• T77UA – User assignments
• T77UU – Users (used to select users for extraction)

Enforcing Structural Authorizations in SAP BW

Steps in mySAP ERP HCM System:

1. Run Program RHBAUS02 → Upload Table T77UU and enter users.
2. Run Program RHBAUUS00 → Generate an index for the structural authorization profile.
3. Activate Data Source 0HR_PA_2.

Steps in SAP BW System:

1. Replicate Data Source 0HR_PA_2.
2. Activate ODS InfoProvider 0HR_PA_2.
3. Create an InfoPackage to extract data for 0HR_PA_2.
4. Load ODS data from mySAP ERP HCM.
5. Mark InfoObjects as authorization-relevant (e.g., position, employee) to ensure proper reporting.
6. Create reporting authorization objects.
7. Link authorization objects to InfoCubes.
8. Run Program RSSB_GENERATE_AUTHORIZATIONS.