SQ10 - Assigning user groups to roles for Queries

[Former Member]

I have created a user group in SQ03, assigned infosets to that group in SQ02, assigned the user group to a role in SQ10.  Now when the user tries to access the query using SQ01, they get error message "User XXXXXX is not assigned to any user group".  I have added parameter AQB to the user as suggested and have tried everything else I can think of.  Help!

[Former Member]

Hi Kelly

Did you add the parameter AQW(ABAP Query: Query area) to the user profile as well? That is the query area for client specific queries which you created?

That should do it. The AQB is only the Default query group.

Hope that helps.

Thanks

Abhi

[Former Member]

Yes, both AQW and AQB parameters are assigned and user is still getting the error.

[Former Member]

HI kelly

I have seen sometimes that these parameters do ot take effect.

Can you remotely naviate to the user PC and see what query area he/she is assigned to?

Try changing the query area manually and see if they start see thw query group in SQ01.

Hope that helps

Thanks

Abhi

[Former Member]

I am testing with a test ID myself and even when trying to switch the query area manually it still says the user is not assigned to any query areas.

[Puneet_Gupta]

Hi Kelly,

I don't think you can get around manually assigning the users to the user group, even though the user group is assigned to a role.

The Role only concept comes in for Infoset queries. When you assign the user group and infoset to a role via SQ10, it generates a new Tcode to access the infoset query and the authorization for this new Tcode is automatically added to the role..

For standard SQ01 queries, the users have to be added to the User Group manually in SQ03.

Hope this helps.

-Puneet

[Puneet_Gupta]

Hi Kelly,

I don't think you can get around manually assigning the users to the user group, even though the user group is assigned to a role.

The Role only concept comes in for Infoset queries. When you assign the user group and infoset to a role via SQ10, it generates a new Tcode to access the infoset query and the authorization for this new Tcode is automatically added to the role..

For standard SQ01 queries, the users have to be added to the User Group manually in SQ03.

Hope this helps.

-Puneet

[Former Member]

Thank you Puneet.  I guess we will have to continue with manual user assignment.  It would be nice if the user could inherit through the role!

[Puneet_Gupta]

Hi,

I could not get this part from your message :

1. From SQ03 -> Create New User Group

2. Assign User ID to User group with the check box to indicate if they have change auth for queries

3. Assign Infoset to User group

You can perform a simple test in SQ03

Ensure you are in the right query area

Enter the user id of the user in the 2nd input box on the screen and click change.

In the next screen you should see a check mark next to the user group that the person is assigned to.

[Former Member]

Hi.  Thanks for the suggestion however the whole point is to not have to maintain users by user group.  The user group is assigned to a role in SQ10 and the role is assigned to the user, therefore assigning user access to the user group.  That is not working.

[Former Member]

Hi Kelly,

To get rid of maintainig users by user group for ABAP queries, I've found that the best practice is to assign the AQ to a custom transaction and assign that transaction to a role, and finally the role to the user.

This way your users will simply execute a transaction (without having to be assigned to the query group) and will get to the report screen instead of having to go to SQ01, selecting the group, area and then the query.

How do you assign the query to a transaction? your dev team should know, anyway it's this way

SE93, create transaction (Z or customer space), transaction type sholud be "transactoin with parameters".

Put START_REPORT in the transaction, then at the last section add:

D_SREPOVARI-REPORTTYPE = AQ

D_SREPOVARI-REPORT = User group and Area

D_SREPOVARI-EXTDREPORT = Query name

something like this:

Cheers,

[Former Member]

Perhaps you can verify which if these tasks you are doing in DEV system and transporting and which you are doing directly in PROD?

As long as your goal is to have a (generated) tcode based user access from the menu of a role, then you have a chance to tie (optional) access control and import paramaters to it.

If you allow generic access and build roles in DEV for things which only exist in PROD then you will always have either a huge maintenance effort and / or error margin (e.g. no search helps).

No search help option almost always means no testing and a '*' value sooner or later in the backend PROD system.

Cheers, Julius