Concept of using AMS for security + minimal credentials to launch LN

unknown

Good day everyone!

I work for a big automotive company and we have a lot of warehouses created in LN - around 400 to say the least. We're facing some security issues because of users doing what they're not supposed to do (editing/deleting shipment lines, putaway advice, etc.).

I've created access matrix and it seems that I need 4 roles for each warehouse:

1) Operator (editing/reading shipment lines + editing/reading putaway advice)

2) Shipping Operator (full control of shipping advice and shipments)

3) Receiving operator (full control of receipt lines and putaway advice)

4) Supervisor (all above 3 in 1)

All these roles have a subrole that gives users access to the company they need to work with.

We have around 10k employees, so the idea is to create an Excel spreadsheet using which the user can choose corresponding warehouse and his role to automatically create role requests. 400 x 4 = 1600, so there's like 6 people in each warehouse/role combination on average.

This is the situation. Questions are as follows:

1) Is this concept working anywhere? Choosing from 1600 combinations seems like a tall order.

2) What is the minimum access needed to login into LN? I created table data authorizations limiting access to a single warehouse and table, but I get "Access Denied" message when I try to log in.

Any help would be greatly appreciated! Thanks a lot in advance!

rohit-goel

Hi,



To login to LN minimum AMS Role required for Normal user is "DEFAULT" (a standard Role which comes with installation). Now along with this Role, user's would be in need of DATABASE Authorization i.e. Tables access to insert / update related tables records as per his/her Business Process. Further they would be in need of SESSION Authorization on which they would be working.



So you need to create an AMS Role and gives Database Authorization i.e. access to related company / package/ Tables (for example Warehouse Table is tcmcs003) / Table Data / Table Field Data etc as per your requirement.



Similarly you need to define SESSION Authorizations in same Role or can create another AMS Role with required SESSION Authorizations.If users are PROCESS Browser Users then Session level Authorization will be taken care by DEM Roles / Business Process Modeling (and not by AMS Role). If users are Normal Menu Browser user, then AMS Session level Authorizations will apply.





So in your scenario, either you can create AMS Role like Operator, Shipping Operator, Supervisor etc.. and gives Database / Session Authorizations accordingly to each Role. So user would be having "DEFAULT" and say "OPERATOR" Roles assigned in User Data or another way is to have DATABASE Authorization Roles created seperately and AMS SESSION Authorization Roles (for Normal Menu Browser) created seperately. And assign three Roles i.e." DEFAULT , Database Authorization Role, Session Authoriztion Role to user (in User Data).



This is one time setup needs to be done based on Business Requirement i.e. Roles needs to be created based on end user work profile.



For details on working of AMS Roles, Please refer related session help which is self explanatory. Also can refer Enterprise Server Administration Guide (U8854*) Chapter 7 User Management for details on Authorization Management.





Hope it helps