On a recent project we needed to develop an information space that enables users to explore the point-of-sale (POS) data. The data needed to be secured using characteristics ZPOSGBU (global business unit) and ZCOUNTRY (country of sales). The authorization settings available in SAP BusinessObjects Explorer maintenance (transaction RSDDTPS) only allow you to secure data using one characteristic. We provide a workaround solution using the personalization feature, which allows you to secure data on any number of characteristics as needed.

To be able to explore the POS data, you need to configure the POS MultiProvider YSD_M17 for data exploration using SAP BusinessObjects Explorer. This MultiProvider has two InfoObjects, ZPOSGBU and ZCOUNTRY, which are authorization relevant.

 Create an SAP BusinessObjects Explorer Index

The first step in enabling a MultiProvider for data exploration using SAP BusinessObjects Explorer is to create the SAP BusinessObjects Explorer index. With SAP BusinessObjects Explorer, accelerated version, creating an SAP BusinessObjects Explorer index creates a supporting metadata structure in the SAP NetWeaver BW Accelerator server. Populating the index extracts the data from an InfoProvider and populates the SAP NetWeaver BW Accelerator data structures. You need to create the SAP BusinessObjects Explorer index on the MultiProvider/InfoCube before you can create the information space.

We walk through the steps to create an SAP BusinessObjects Explorer index on the MultiProvider on which you want to explore data using SAP BusinessObjects Explorer.

Step 1. Log on to SAP NetWeaver BW and start transaction RSDDTPS. Double-click the InfoProvider YSD_M17 to access the SAP BusinessObjects Explorer settings you want to enable. In the pop-up dialog, click the Yes button (Figure 1). This opens the Select MultiProvider Index Type dialog box. Click the Snapshot button (Figure 2).

Figure 1

Enable the object for SAP BusinessObjects Explorer

Figure 2

Create the MultiProvider as a snapshot

A snapshot MultiProvider index is a standalone index that is not connected to the SAP NetWeaver BW Accelerator index of the underlying InfoCubes. You can use either type for this workaround — we just chose a snapshot.

The system then asks if you want to exclude any InfoObjects from a MultiProvider so that it’s not visible in SAP BusinessObjects Explorer. Click the Configure button (Figure 3). When asked if you want to reconfigure the Explorer object, click the Yes button to open the list of InfoObjects (Figure 4).

Figure 3

Select the InfoObjects you want to exclude from SAP BusinessObjects Explorer

Figure 4

Reconfigure the SAP BusinessObjects Explorer object

Select the check box next to the InfoObject ZSOPFAMLY, which needs to be excluded from the SAP BusinessObjects Explorer index in this example (Figure 5). Then click the copy icon  located at the bottom of the dialog box.

Figure 5

Select the InfoObject to exclude

A dialog box appears confirming your choice to delete an InfoObject (Figure 6). Click the Save button to return to the SAP BusinessObjects Explorer maintenance window.

Figure 6

Save the list of InfoObjects to exclude

Step 2. Navigate to the Key Figures/Conversions tab shown in Figure 7 and deselect the Convert check boxes for the key figures with units and currency. For the purpose of this example we are not doing any conversions. If any currency/unit conversion is required for any of the key figures that are part of the SAP BusinessObjects Explorer index, click the Convert check box that corresponds to the key figure and provide the target currency/unit and the exchange rate type for the currencies.

Figure 7

Deselect the Convert check boxes

Step 3. Restrict the access to designated countries and business units. For this scenario, the requirement is to restrict access to SAP BusinessObjects Explorer data so that users only see data for the country and the global business unit for which they are responsible. For example, when user XX02761 is exploring this data, the data belonging to country USA (ZCOUNTRY) and for global business unit 02002(ZPOSGBU) should be displayed. 

To do this, click the Authorizations tab shown in Figure 8. Users who need to have access to this SAP BusinessObjects Explorer index need to be listed in this tab with a corresponding BI authorization enabler. For the purpose of this article, we need to set authorizations for InfoObjects ZPOSGBU (authorization enabler for InfoObject ZPOSGBU is ZGBU_ALL) and ZCOUNTRY (authorization enabler for InfoObject ZCOUNTRY is ZCOUNTRYALL).

Figure 8

SAP BusinessObjects index authorizations

Follow menu path Explorer Object > Check to check the validity of Explorer Index Settings. This returns an error message saying that the user has been entered more than once (Figure 8). This would be fine if you had given only one authorization object per user. However, we have two authorization objects per user, so we need to apply a workaround.

Because the authorizations setting in the index settings (transaction RSDDTPS) does not work for multiple authorization objects, you simply give all the users who need access to the SAP BusinessObjects Explorer index the 0BI_ALL authorization as shown in Figure 9.

Figure 9

Assign authorization to 0BI_ALL

Step 4. Activate the SAP BusinessObjects Explorer settings. At this point we have achieved the goal of securing the data using two InfoObjects, ZCOUTNRY and ZPOSGBU, at the information space level. Go to Explorer Object > Activate. In the Start Time dialog box, click the Immediate button and then click the save icon. This schedules the job to populate immediately in the SAP BusinessObjects Explorer index. Figure 10 shows the background job BW_TR_RSDDTPS_SETTINGS_ACTIVATE that is created.

Figure 10

BW_TR_RSDDTPS_SETTINGS_ACTIVATE background job

A green light next to the MultiProvider in transaction RSDDTPS indicates the successful creation and population of the SAP BusinessObjects Explorer index (Figure 11).

Figure 11

Successful creation/population

Using the above steps, we created the SAP BusinessObjects Explorer index and completed the initial population of the index. You can sync the data from the MultiProvider YSD_M17 by scheduling a process variant in the process chain. This automates the syncing of the data between the MultiProvider data with the SAP BusinessObjects Explorer index.

A process chain variant is available in the process chain maintenance transaction RSPC (Figure 12). Using the process chain variant Update Explorer Properties of BW Objects, you can sync the data in the SAP BusinessObjects Explorer index with the MultiProvider data.

Figure 12

Sync SAP BusinessObjects Explorer index with data in the InfoProvider

Now that we have created the SAP BusinessObjects Explorer index, we have met the prerequisite to create the information space. 

Overcome a Single Authorization Object Limitation

You can filter the content of an information space that a single user can explore by personalizing the information space. For example, a global business unit manager only needs to see the data of his global business unit. You can reuse a personalized information space for several users.

Use the personalization feature in SAP BusinessObjects Explorer to overcome the single authorization object limitation. To do this, you need to create an authorization InfoCube with a list of users and corresponding countries and global business units they need to access. The information space on an authorization InfoCube should be referenced in the Personalization tab of the information space for YSD_M17 where POS data exists.

Create an Authorization Information Space

Step 1. Create InfoCubes and MultiProviders with the following characteristics:

• ZCOUNTRY: POS country
• ZPOSGBU: Global business unit (Code 002002)
• ZPOSUID: POS USer ID Including System

Step 2. Identify the list of users and the countries and global business units to which they need access. Using transaction LISTCUBE, populate InfoCube ZMP_AUT with the list of users with global business unit (GBU) and country assignment (Figure 13).

Figure 13

Populate InfoCube ZMP_AUT with the list of selected users

Step 3. Create and populate a snapshot SAP BusinessObjects Explorer index on MultiProvider ZMP_AUT using transaction RSDDTPS. This enables you to create an information space on ZMP_AUTH. Use the same steps explained in the previous section of this article.   

Create an Information Space

In this part of the process, you create an information space for the authorization MultiProviders. Log on to SAP BusinessObjects Explorer and follow these steps:

Step 1. In the SAP BusinessObjects Explorer maintenance portal, navigate to the Manage Spaces tab, and click the SAP BusinessObjects Explorer index Explorer Demo – Authorization (bd1_zmp_aut_ps), which is the SAP BusinessObjects Explorer index for MultiProvider ZMP_AUT (Figure 14).

Figure 14

Manage Spaces tab

Step 2. Click the New button next to Information Spaces. Figure 15 shows the Properties tab of the Create Information Space window. This is where you name the information space.

Figure 15

Name the information space

Step 3. Navigate to the Objects tab and create a new facet group by clicking the create a new group icon . Add POS Country text, global business unit text, and POS User ID to the new group (Figure 16).

Figure 16

Create and populate a new group

Step 4. Click the OK button to create the information space. Under the Action column, click the index now icon highlighted in Figure 17. This creates an index that supports the information space for authorizations.

Figure 17

Click the index now icon to create the index

Once the index population completes successfully, the Status column shows a green check mark.

You are done creating the information space for authorizations. Next you need to create an information space for POS data.

POS Data Information Space

Navigate to the Manage Spaces tab and click the SAP BusinessObjects Explorer index for YSD_M17. Using the same steps shown previously, create an information space YSD_M17. Create the necessary groups and add characteristics (facets) to them (Figure 18).

Figure 18

Create and populate the new information space for the POS data

Use Personalization to Set Up Authorizations

To secure the data by country and POS GBU, use the authorization information space in the Personalization tab of the POS information space. Here are the steps to use the authorization information space:

Step 1. Navigate to the Personalization tab and select Personalization Using a Reference Information Space. Click the Reference Information Space drop-down box to choose the reference information space Explorer Demo – Auth for authorization.

Step 2. Click the User Object drop-down box and choose the InfoObject ZPOSUID, which contains the User ID. Choose the user InfoObject from the reference information space; in this case it is POS User ID. When finished, click OK.

Step 3. In the Personalization tab, click the facet filter creation icon  to add the join criteria between the POS information space and the authorization information space — in this case, Country and GBU. The joins in Figures 19 and 20 are what limits users’ access to the data, depending on their responsibility.

Figure 19

POS Country join

Figure 20

The global business unit information space and the authorization information space

Step 4. Click OK to save the information space settings. Under Manager Spaces, click the index now icon located in the Action column. This populates the index with facets and measures selected in the information space settings. Now the POS information space is ready to be explored according to the authorizations defined in the authorizations information space.

Explore the Data

Navigate to the Home tab and click the Refresh List button to see the newly created information space. Click the Explorer POS Demo information space. As a result of the authorization setup, the POS MultiProvider YSD_M17 contains data for the countries US and UK, as well as GBUs 2002 and 2003 (Figure 21). 

Figure 21

POS MultiProvider YSD_M17

As a result of the authorization setup you created in the authorization InfoProvider ZMP_AUT, the user XX02761 now only has access to US and GBU 2002 data in SAP BusinessObjects Explorer (Figure 22).

Figure 22

Authorization InfoProvider ZMP_AUT

The additional advantage of this solution is that it is flexible and scalable. You can enforce authorizations on any number of characteristics.

YatKwai Kee

YatKwai Kee is a highly successful BI/data warehousing architect with a proven track record in implementing large-scale BI and data warehousing projects. He is currently working as the lead architect in the business analytics/BI area at Newell Rubbermaid. He is responsible for the end-to-end SAP BusinessObjects implementation — including SAP BusinessObjects Web Intelligence, Xcelsius, and SAP BusinessObjects Explorer — on SAP NetWeaver BW. In addition, he is responsible for the SAP NetWeaver BW Accelerator implementation as well as performance tuning. Kee is a regular presenter at TechEd, ASUG, and SAPPHIRE on SAP NetWeaver BW Accelerator and SAP BusinessObjects topics. He is currently acting as a program chair in data management SIG for ASUG.

You may contact the author at ykee@yahoo.com.

If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.

Vasu Sattenapalli

Vasu Sattenapalli is a senior SAP BI solution architect with extensive knowledge and experience in implementation of business intelligence solutions for Fortune 100 companies with global and complex business process. He is currently working as a consultant architect at Newell Rubbermaid. He was also a BI specialist in the implementation of SAP BusinessObjects Explorer for Newell Rubbermaid.

You may contact the author at sattenapalli@gmail.com.

If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.