This website is not affiliated with, sponsored by, or approved by SAP AG.

Maintaining Field Values - is it possible to exclude a range

SAP Security

Moderators: Snowy, thx4allthefish, jurjen

Maintaining Field Values - is it possible to exclude a range

Postby AussieBob » Thu Jul 12, 2012 12:00 am

Hi All!



I've tried searching the forums but havn't come up with anything.. I'm convinced SAP should have a way to do this, but I can't figure out how.

I have an auditing requirement to remove blanket access ("*") whenever possible. In this example, Asset Class (ANLKL), copied from PFCG:

Code: Select all
Activity                       01                                                                          ACTVT
Asset class                    AUCPPE, BUADMCOM, BUADMGEH, BUADMRES, CEADM, CEADMEXP, CEADMRED, CEAUC<...> ANLKL
Company Code                   PWCI                                                                        BUKRS


Suppose I want to only include asset classes that start with BU. It's not hard: I just set the class to "BU*". BUADMCOM, BUADMGEH, and BUADMRES would be accessible, everything else would not.

But does anyone know a way to do an inverse? for example, to set up a wildcard that selects everything *except* those beginning with BU?

My reasoning: If I set up roles using enumeration like this, every time we create a new object, we'll have to go fix up all the related roles to include it. But if I use wildcards, and then adhere to naming conventions for the objects, they will be automatically included...


Any input (even: "Sorry, but that's not possible") would be great.. :)

Thanks
Rob
AussieBob
 
Posts: 4
Joined: Wed Sep 12, 2007 12:12 am

Re: Maintaining Field Values - is it possible to exclude a range

Postby jurjen » Thu Jul 12, 2012 8:33 am

Have you tried:
A* - BT*
BV* - Z*
?

And the numbers of course ;-) You can practice with ranges and study SAP sort order in the table browser, SE16(N)
jurjen
 
Posts: 298
Joined: Wed May 17, 2006 8:17 am
Location: The Netherlands

Re: Maintaining Field Values - is it possible to exclude a range

Postby Al. » Thu Jul 12, 2012 4:41 pm

Hi Rob,

You can't set up any "exclude" rules.

An exception to that is in BW using analysis auths.
http://www.turnkeyconsulting.com/
Al.
 
Posts: 3050
Joined: Tue Feb 25, 2003 5:35 am
Location: London

Re: Maintaining Field Values - is it possible to exclude a range

Postby AussieBob » Fri Jul 13, 2012 1:04 am

Thanks guys. It's good not to waste time trying to do the impossible :)

But a series of inclusive masks that tiptoe round the bit I don't want is a great idea! Thanks Jur.
I'll use a couple of ranges for objects starting with letters, and a 0*-9* range for any objects starting with a number.

Perhaps also a few special characters - _, ?, and the like, as individuals. I don't suppose anyone knows how SAP defines its special character ranges? If it's the same as some unicode standard, I should be able to create a range for every nonstandard as well.. without worrying that such a range would start "before" the alphabet and end "after", thus including the very subset I'm trying to avoid....


Cheers!
Rob
AussieBob
 
Posts: 4
Joined: Wed Sep 12, 2007 12:12 am

Re: Maintaining Field Values - is it possible to exclude a range

Postby Sharpshooter » Fri Jul 13, 2012 10:10 am

The sort order of special characters will match the codepage of your operating system - if you are unicode, then the sort order will be the unicode sequence.
Good luck!
Sharpshooter
 
Posts: 1171
Joined: Wed Mar 17, 2010 12:01 pm
Location: In the dark


Return to SAP Security

Who is online

Users browsing this forum: No registered users and 6 guests





loading...


This website is not affiliated with, sponsored by, or approved by SAP AG.