03/14/2011 Page 1 of 8

SAP Note 400434 - Authorizations in APO demand planning

Note Language: English Version: 23 Validity: Valid Since 01/29/2009
Summary
Symptom
This note explains the authorization concept in APO for demand planning.
The following authorization objects are used:
C_APO_MAC: Macro (DP)
ACTVT Activity (16)
APO_VIEW Planning view --- Generated dynamically
APO_PLBK Planning layout --- when a macro is created, can be
APO_MACRO Macro ID --- displayed in the Macro Builder
C_APO_ADV: Macro maintenance (DP)
ACTVT Activity (02, 16)
APO_PLBK Planning layout --- Generated automatically, display in
APO_VIEW Planning view --- Macro Builder
C_APO_TLAN: Transportation lane
ACTVT Activity (02, 03, 16)
APO_LOCFR Start location
APO_LOCTO Target location
APO_TMODMeans of transport
C_APO_FUN: SDP functions
APO_FUNC Function (fixed values of domain /sapapo/functionality)
APO_PAREA Planning area
C_APO_ADVN: Macro names
ACTVT Activity (02,16)
APO_MAKRON Macro identifier (macro names are not unique)
C_APO_PB: SDP planning books
ACTVT Activity (01, 02, 03, 06, 16)
APO_PLBK2 Planning book
APO_DVIEW Data view
C_APO_SEL3: Selection in planning area
ACTVT Activity (01, 02, 03, 06, 16)
APO_SELTXT Description of a selection <--- only 40 characters used
APO_PAREA Planning area
APO_PLBK2 Planning book <--- is not used, maintain*
APO_VERS APO plan version
C_APO_SEL2: Selection in planning area, obsolete
Object should always be maintained with "*"
ACTVT Activity (01, 02, 03, 06, 16)
APO_SELID Selection ID
APO_PAREA Planning area
APO_PLBK2 Planning book
APO_VERS APO plan version
C_APO_MOD: Model
ACTVT Activity (01, 02, 03, 06)
APO_KENN Key figure: Differentiates between active and inactive (A, I)
APO_MOD Model name in the supply chain network
03/14/2011 Page 2 of 8
SAP Note 400434 - Authorizations in APO demand planning
C_APO_VERS: Planning version in APO
ACTVT Activity (01, 02, 03, 06, 16)
APO_MOD Model name in the supply chain network
APO_APKZ Application indicator (in SDP = SNP)
APO_KENN Key figure: Differentiates between active and inactive
APO_VERS APO plan version
C_APO_LOC: Master data, locations
ACTVT Activity (01, 02, 03, 06, 16, 32)
Activity 16 is used in SDP
to change the data
APO_LOC Location
C_APO_PROD: Master data, products
ACTVT Activity (01, 02, 03, 06, 16)
Activity 16 is used in SDP
to change the data
APO_LOC Location (must be maintained with '*' in DP)
APO_PROD Product
C_APO_RES: Master data, resources
ACTVT Activity (01, 02, 03, 06, 16)
Activity 16 is used in SDP
to change the data
APO_LOC Location (must be maintained with "*")
APO_PLNR Resource planner group (must be maintained with "*")
APO_RES Name of resource
C_APO_IOBJ: Key figures (as of SCM 4.0)
ACTVT Activity (02, 03)
If activity 02 and 03 are not permitted for the user,
no data is read for this key figure.
APO_PAREA Planning area
APO_IOBJNM InfoObjects (key figures)
C_APO_DPPR: Authorization for products in Demand Planning (as of SCM 4.0)
ACTVT Activity (02, 03)
APO_PROD Product
C_APO_RLG: Authorization for realignment (as of SCM 4.0 Support Package 11)
ACTVT Activity (01, 02, 03, 06, 07, 16)
APO_PSTRU Planning object structure
C_APO_CPY: Authorization for copying (as of SCM 4.0 Support Package 11)
ACTVT Activity (01, 02, 03, 06, 07, 16)
APO_PAREA Planning area
C_APO_PROM: Authorization for promotions (as of SCM 4.1)
ACTVT Activity (02, 03)
APO_PROMID Promotion
C_APO_LIKE: Authorization for LIKE profiles (as of SCM 4.1)
ACTVT Activity (02, 03, 22)
APO_PAREA Planning area
APO_LIKENO LIKE profile
C_APO_PRPF: Authorization for forecast profile (as of SCM 4.1)
03/14/2011 Page 3 of 8
SAP Note 400434 - Authorizations in APO demand planning
ACTVT Activity (02, 03, 16)
APO_PRPFL Overall forecast profile
APO_STATPF Univariate forecast profile
APO_MLRPF MLR forecast profile
APO_COMPPF Combined forecast profile
C_APO_TSID: Authorization for time series (for example, weighting profile,
...;
as of SCM 4.1)
ACTVT Activity (02, 22)
APO_TSID Time series
All individual authorization checks are performed in the function module
/SAPAPO/MCP_PERMISSION_CHECK2. A where-used list on the function module
provides the SDP authorization checks. If you want to perform a check for a
quantity (table) of objects such as products, locations, resources or
planning books, use the function module /SAPAPO/MCP_PERMISSION_SELECT.
In addition, you can program the authorization check for individual
customers using the USER EXIT EXIT_/SAPAPO/SAPLMCPR_015 of the function
group XDMUSER.
You cannot use delivered authorization objects to perform checks on any
characteristic level in interactive planning. Instead, you must use the
user exit.
Since Note 436400, you can use the user exit to carry out a check for data
views of a planning book. As of SCM 4.1, the authorization object C_APO_PB
contains an additional authorization field APO_DVIEW so that the data views
for a planning session can also be checked in the standard system.
In APO 3.0/3.1, you can use Demand Planning and Supply Network Planning
(/sapapo/sdp94, /sapapo/snp94) with the same user if the location is
restricted for the authorization object C_APO_PROD in SNP. This restriction
is not allowed in Demand Planning. You cannot avoid the restriction by
using the user exit. If you want to restrict the location in SNP, you must
create a second user. As of Release SCM 4.0, a separate authorization
object for products (C_APO_DPPR) is available in Demand Planning. This way,
the user can carry out both planning procedures and restrict the location
in SNP.
Generally speaking, the authorization is always granted in the case of the
authorization objects specified above if the authorization object is not
assigned to a user. This means that you do not have to assign authorization
objects with the instance * to every user if you do not want to use them.
Calling interactive planning
-------------------------------
When you start interactive planning, the system checks authorizations for
the two functions (C_APO_FUN) C_SELCTION 'Freely combine selections' and
C_SELORG 'Maintain selection assignment'. If the authorization C_SELCTION
is missing, the 'Selection window' button of the SDP selector is grayed
out. Combining selections is therefore not possible. This means that you
can restrict the authorization of a user to loading saved selections only.
If the authorization C_SELORG is missing, you cannot call the selection
organization.
Selections in interactive planning:
03/14/2011 Page 4 of 8
SAP Note 400434 - Authorizations in APO demand planning
---------------------------------------
The authorizations for the functions C_SELE and S_SELE are required to
execute a 'free' selection. The authorization for the function S_SELE and
the authorization for the selection to be loaded (C_APO_SEL2/C_APO_SEL3)
must be available for you to load a saved selection. During the transfer of
the selection, the system first checks the authorization for the selected
version (C_APO_VERS). Only one authorization check for the object version
(C_APO_VERS), products (C_APO_PROD) and locations (C_APO_LOC) can be
performed in the DP for selections in the standard system. In the SNP, you
can check the object version (C_APO_VERS), products (C_APO_PROD), locations
(C_APO_LOC), location products (C_APO_PROD), resources (C_APO_RES) and
transportation lanes (C_APO_TLAN). Additional authorization checks, in
particular for other characteristics of the selection (for example, sales
organizations in the DP) are not provided in the standard system. You can
run these using the user exit for authorizations. With this user exit or
the BAdI method 'SELECTION_CHECK' (BAdI '/SAPAPO/SDP_SELECTOR'), you can,
for example, force a user to make a selection for a certain characteristic.
During the authorization check in the DP, make sure that only the objects
specified in the selection condition are checked. For performance reasons,
characteristic combinations that belong to a selection are not determined
and subjected to an authorization check.
During the authorization check for objects, the activity 'Display' (03) is
always checked during the selection. For the above-mentioned objects (in
DP: Product and location in SNP products, locations, location products,
resources and transportation lanes), an authorization check is carried out
in the SDP selector for the hit list entries. The hit list contains only
the objects that can be displayed by selecting the 'Display' function in
the shuffler. Objects for which you have no display authorization do not
appear in the hit list. When you select products in Demand Planning, note
that the 'location' parameter from the authorization object 'C_APO_PROD' is
not allowed to be restricted. This a restriction is only allowed when you
select location products in SNP. Up to and including Support Package 13,
when you select transportation lanes in SNP, the activity 'Execute' (16) is
checked because the activity 'Display' (03) does not yet exist. As of
Support Package 14, the activity 'Display' is checked in the same way as
the other objects.
Since SCM 4.1, you have option of activating the BW authorization concept
for characteristics. In this case, note that for the defined selection,
only characteristic value combinations for which you have display or change
authorization are selected. If you do not have authorization for at least
one characteristic value combination selected, the system cannot display a
results list in the shuffler. For detailed information about the BW
authorization concept for characteristics, refer to the online
documentation.
Loading data in interactive planning:
-------------------------------------------
At this stage, an authorization check is carried out for both the selection
condition and the characteristics of the objects that have been loaded, if
you are on the lowest level (all characteristics of the planning object
structure have been specified). The system checks only the objects of the
selection condition that have unique characteristics. For performance
reasons, the system does not create an object list from entries containing
wildcards, ranges or exclusion conditions, nor does it carry out a check.
If you are in change mode, it is the activity 'Execute' (16) that is
checked for all authorization objects. Note that before Support Package 12
or Note 399891, it was activity 'Change' (02) that was checked. If there is
no change authorization, the respective checks are made on the activity
03/14/2011 Page 5 of 8
SAP Note 400434 - Authorizations in APO demand planning
'Display' (03). The transaction switches to display mode if data may be
displayed only. If there is no authorization to display the data either,
the system issues a relevant error message. The system does not display any
data.
To be more precise, the following authorization checks are made in this
sequence:
Planning book, version, products, locations, location products, resources
and transportation lanes.
Since SCM 4.1, if the BW authorization concept for characteristics is
active, a check is carried out in addition to see whether the user has
display or change authorization for the characteristic value combinations
selected. If the user has display authorization only, the system switches
to display mode automatically.
Affected authorization objects during the selection/loading of data:
C_APO_FUN (with functions: C_SELCTION, C_SELORG, C_SELE, S_SELE),
C_APO_SEL2, C_APO_SEL3, C_APO_VERS, C_APO_PROD, C_APO_LOC, C_APO_RES,
C_APO_TLAN
Forecast
----------------
The object C_APO_FUN with the function C_PRPFL is checked in the
transaction used to maintain the forecast profile /sapapo/mc96b. The same
constellation is called up in interactive planning when you save or delete
forecast profiles. For life cycle planning, the object C_APO_FUN is used
with the function C_LIFECC (as of Support Package 14). The function
C_ZUORPR with the object C_APO_FUN is used for to assign forecast profiles
to selections (as of Support Package 14). When you run the forecast in
interactive planning, the object C_APO_FUN is used with the function
C_FCST. In display mode, the function S_FCST is requested. You can use the
BAdI /SAPAPO/IF_EX_SDP_INTERACT (see Note 414431) to hide the function keys
for specific users in the forecast view and in all user-defined views. Note
that you generally require the authorization C_PRPFL with the object
C_APO_FUN when you save the data in the forecast, since the forecast
profile is also stored.
Since SCM 4.1, the new authorization object C_APO_PRPF is checked when you
display or change a forecast profile and when you run a forecast with the
corresponding profile. In lifecycle planning, the system also checks the
authorization object C_APO_LIKE when a LIKE profile is processed.
Promotion
----------------
The object C_APO_FUN is checked with the functions S_PROMO and C_PROMO. For
display mode, the function S_PROMO is requested. For change mode, S_PROMO
and C_PROMO are requested. When you assign characteristic values to the
promotion or change an existing promotion, only C_APO_PROD and C_APO_LOC
are checked as standard.
Since SCM 4.1, the new authorization object C_APO_PROM is checked. To
display or change a promotion, the corresponding authorizations must have
been maintained.
Release DP - SNP
------------------
The object C_APO_FUN is checked with the function C_RELEASE.
Creating/changing a batch job (/SAPAPO/MC8D, /SAPAPO/MC8E)
03/14/2011 Page 6 of 8
SAP Note 400434 - Authorizations in APO demand planning
--------------------------------------------------------------
Object C_APO_FUN is checked using the functions C_BATCH and C_ACTIVITY. If
one or several selection IDs were selected, a check with the function
C_SELE and the authorization objects C_APO_SEL2 and C_APO_SEL3 is also
carried out.
Background processing
-------------------------
In background processing, the object C_APO_FUN is checked using the
C_BATCH, C_FCST, C_MAKRO, C_RELEASE, and C_APOTOR3 functions. Authorization
checks of the individual selections generated dynamically and are not
carried out for performance reasons. The specified basis selection is
checked using the objects C_APO_SEL2 and C_APO_SEL3.
Since SCM 4.1, the new authorization object C_APO_PRPF is checked to see
whether there are sufficient authorizations to run a forecast with the
corresponding forecast profile.
If the BW authorization concept for characteristics is active, a check is
carried out before background processing to see whether there are
sufficient authorizations for the selected characteristic combinations. If
there is no authorization for at least one combination, background
processing cannot be carried out.
Maintain characteristic combinations (/sapapo/mc62)
---------------------------------------------
A check for the object C_APO_FUN is carried out using the function C_CHARC.
No planning area is specified since several planning areas may belong to
one planning object structure. If a check is to be carried out specifically
for the object structure, the user exit can be used.
The BW authorization concept for characteristics is disabled by default but
you can activate it using the method ENABLE_AUTH_CHK_MC62 of the BAdI
/SAPAPO/SDP_AUTH_CHK. Then authorization checks at characteristic value
level are carried out for the individual activities. Depending on the
number of characteristic value combinations concerned, those checks may
take a very long time.
Proportion maintenance (/sapapo/mc8v)
-------------------------------
Here, a check for the object C_APO_FUN is carried out using the function
C_ANTEIM and the current planning area.
Copy/version management (/SAPAPO/TSCOPY)
-----------------------------------------------
A check is carried out on the object C_APO_FUN with the function C_VRSIOM
and the planning areas for source and target. The version is specified for
calling the user exit (Note 516898).
Load planning area version (/SAPAPO/TSCUBE)
------------------------------------------------
A check is carried out on the object C_APO_FUN with the function C_LPLV and
the current target planning area. The version is specified for calling the
user exit (Note 516898).
DataSources for planning areas
--------------------------------
As of SCM 4.1, an authorization check for the authorization object
'C_APO_FUN' with the function C_DS (create/change/delete DataSource) is
03/14/2011 Page 7 of 8
SAP Note 400434 - Authorizations in APO demand planning
carried out when generating, repairing, changing, replicating,
transporting, deleting DataSources or changing their properties.
Realignment and copy functions (/SAPAPO/RLGCOPY)
----------------------------------------------------------
Since SCM 4.0 Support Package 11 or after you implement Note 704416, the
two authorization objects C_APO_RLG and C_APO_CPY are available for
detailed authorization maintenance in the area of realignment and copy
functions. A check is carried out when you run realignment or copy and when
you create and edit the corresponding step tables. For detailed
information, refer to Note 704416.
Profile generator/transaction SU22
---------------------------------------
In Demand Planning and in Supply Network Planning, the 'check' indicator
was maintained in most cases for the authorization objects used in
transaction SU22 (in particular in interactive planning /sapapo/sdp94 and
/sapapo/snp94). An exception is the object C_APO_FUN for which useful
default values can be given. Here, 'check and maintain' was set as well.
This means that when you assign the interactive planning transaction to a
role, no authorization objects are proposed in the profile generator. This
is not an error, rather something that cannot be avoided. Since the objects
used and processed in interactive planning are only generated dynamically
in the customer's system, no default values can be given. In this
situation, you need to assign the relevant objects manually. You can do
this using the information contained in this note and transaction SU22
(here, all objects that are checked are specified).
General information
---------------
The authorization check is available as of Support Package 13 when you go
to design mode in interactive planning. The object C_APO_FUN with the
function C_DESIGN is used here (see Note 412599).
See also the information in the related notes assigned to this note.
Other terms
Sales planning, authorizations, authorization concept
Reason and Prerequisites
This note provides information about the authorization concept.
Solution
Refer to the consulting note.
Header Data
Release Status: Released for Customer
Released on: 01/29/2009 11:42:07
Master Language: German
Priority: Recommendations/additional info
Category: Consulting
Primary Component: SCM-APO-FCS Demand Planning
03/14/2011 Page 8 of 8
SAP Note 400434 - Authorizations in APO demand planning
The Note is release-independent
Related Notes
Number Short Text
1464451 Authorisations in APO Master Data
941415 Capacity view: authority check over location.
786732 Authorization check for the object C_APO_TLAN
724095 SDP Selector: Authorization check for location products
704416 Realignment: Authorization objects C_APO_RLG and C_APO_CPY
700659 Security Guide: mySAP Supply Chain Management
669496 SCM 4.1 upgrade: Additional authorization checks
627983 Addition BAdI /SAPAPO/SDP_FCSTAUTH
600882 CLPSDP: the user can change the data without authorization
541703 Collective consulting note on technical subjects in DP
445837 Assignment of users to planning books/data views
437293 Enhancing user exit authorizations with an object structure
436400 Enhancement user exit authorizations for data view
420294 Authorization check for the object C_APO_TLAN (Part 2)
415468 Errors in authorization check for APO version (C_APO_VERS)
414431 APO 3.0: Hiding function keys in the forecast view
413623 Authorization check for the C_APO_TLAN object
399891 SDP selector: Authorization for location products
387493 Missing authorization check for planning book
321503 Auth. check with drill-down/ dependent objects