Welcome to the session Operational Analytics with ODP- Modeling Authorizations

Transcription

1 Welcome to the session Operational Analytics with ODP- Modeling Authorizations 1

2 At the end of this module, you will be able to restrict access to the data of a TransientProvider derived from an Operational Data Provider

3 In order to ensure that Operational Analytics scenarios map the structure of a company and meet the company s requirements access to data of Operational Data Providers (ODPs) can be restricted for analysis purposes. The authorization checks for Operational Analytics are based on the authorization concept of the affected application and defined in search and analytics models which contains the ODP for which you want to restrict data access. Models delivered by SAP may partly deliver authorization checks. If these checks are not sufficient in a customer scenario you can extend the models and add the needed authorization checks. Depending of the authorization concept of the application the checks are defined either using Authorization objects or Access Control Lists (ACLs). 3

4 After having included the software component of the model you want to extend into your customer-specific software component, you can add authorization checks to your model in the Node Response step. (click animation) On the following slides we go through the steps for authorization checks that are based on ABAP authorization objects. First, we select the node and thereby the ODP for which we want to restrict data access. (click animation) On tab page Authorizations we go to ABAP Auth. Objects. (click animation) 4

5 If the relevant authorization object is not available in the system yet, we first have to import it. Now, we can create authorization checks by adding a new row to the list, entering a Check-ID, and choosing the authorization object in the ABAP Auth. Obj. Name field. 5

6 The values for the fields of each authorization object are defined in the Details section of the ABAP Auth. Objects tab page. Let s have a closer look at the details for authorization object F_KNA1_BUK. The values for the authorization fields are defined in the following ways: Fixed value We enter 03 (display) for the ACTVT (activity) field of the authorization object. This step is necessary to ensure that only users who have display authorizations can access data during runtime. Target Attribute Via Select Path we select the ODP field BUKRS from the node as Target Attribut. This step is necessary in order to define the InfoObject for ODP field BUKRS as authorization relevant and to ensure that users during runtime can only access data from company codes for which they are authorized. 6

7 After having defined the authorization checks, we need to define a Logical Conjunction of the defined checks. The logical conjunction for Analytics determines which authorizations will be checked during runtime for a TransientProvider that is derived from the ODP of this model. All characteristics of a TransientProvider are authorization relevant for which the following applies: the corresponding ODP field is part of an authorization check and this authorization check is part of the logical conjunction for Analytics 7

8 For our example, in the TransientProvider preview (transaction RSRTS_ODP_DIS) we now can see, that the characteristic 2O0COMP_CODE for ODP field BUKRS is authorization relevant 8

9 You have to work on two models in order to define authorization checks that are based on Access Control Lists (ACLs). As a prerequisite, for the ACL a DataSource is needed which contains a field for the user. This field is needed to provide information on user assignments. Create a new search and analytics model. Import the ACL DataSource into the model and choose the semantic SAP User ID for the user field. Create an ODP for it. In the model which contains the ODP for which you want to restrict data access define the authorization checks. Here, you first have to define an association to the model with the ACL node. In order to define an authorization check, choose Authorization -> Auth. Paths in the Node Response step. Here, by defining an authorization path you specify the attribute that the system checks for at runtime for a user. After having created all authorization checks in your model, you need to define the logical conjunction as shown on the previous slides. 9

10 When executing an analytic query all characteristics of a TransientProvider that are authorization relevant will be checked before data access. The query always selects a set of data from the database. If authorization-relevant characteristics are part of this data, you have to make sure that the user who is executing the query has sufficient authorization for the complete selection. Otherwise, the query results won t be displayed due to insufficient authorization. 10

11 In summary You should now be able to restrict access to the data of a TransientProvider derived from an operational data provider

12 You can find further information on Modeling Authorizations in the SAP Library for SAP NetWeaver 7.0 including Enhancement Package 3 under 12

13 13