Authorization to access Web Client UI - CRM 2007 (v6)

[rohitlokray]

When I create a user in the system, I have to assign it a business role.

Apart from assigning it work centers etc., I also need to assign a PFCG role.

What authorization objects should I include in that PFCG role that will allow the user to access (login and view the homepage) of the Web Client UI?

I assigned the user to a position in the Organization model, to the position I have assigned a business role.

I have tried giving it the authorization object for BSP, but it doesn't help.

After the login screen, I get the message saying "Sorry, Logon is not possible because you have not been assigned to a business role. Contact your system administrator. "

If I force the Business Role as a parameter thru SU3/SU01 and assign it SAP_CRM_UIU_FRAMEWORK & SAP_CRM_UIU* (for sales professional in my case). I recieve a shortdump screen.

The problem mentioned above does not happen if I assign the SAP_ALL profile to the user (which is of course, not feasible).

Anybody facing the same problem? Is there any standard Role that I can assign to the user which will give it access to the Web UI?

[DPELSSERS]

Hi there,

when I visited the DeepDive CRM security workshop at walldorf, I was told that it's best not to use that particular parameter CRM_UI_PROFILE, as it was not always consistant....

So first thing as Employee to that particular position, so you will inherit the business role.

(make sure to remove the user Parameter when testing).

Second remark: you probably started creating your own business role by making a copy of a standard delivered business role.
In customizing for your NEW Z* business role, fill out a NEW-non existing PFCG ROLE NAME.

Than run the program CRMD_UI_ROLE prepare and select as input parameter your Z*business Role.
When running the program, the system will write a TXT-file containing all relevant authorisation objects that you probably need, by reading out the customizing of business role/nav bar profile and other stuff.
That file will be stored in C:\Documents and settings\<user>\SapWorkDir
The txt file will have the name of the PFCG role that is entered in your Business Role Customizing.

Next, you should really create a new authorsation role via the profile generator (PFCG) and on the tabpage MENU, choose the button "IMPORT from File", where you select that generated txt-file.
Than make sure to activate the necessary authorisation objects (maintain the values) and generate the authorisation profile.
Next step is to assign two roles via SU01 to your TEST USER ID, being:
* the role you just created usign the procedure I just explained AND the basic role (SAP_CRM_UIU_FRAMEWORK)

[DPELSSERS]

Hi,

there is a good explanation http://www.sapcrmsecurity.com/SAP%20CRM%20Business%20Role.html

[sapcrmbelgium]

Hi,
this is well explained in some articles on http://sapuniversity.eu/how-to-quickly- ... ness-role/
cheers