Access Control Management (ACM) function with classical CDESK/DMS

[Former Member]

Hi,

Wanted to know if the Access Control Management (ACM)function can be
used in classical DMS and CDESK with EHP7 systems without the need for
implementing full PLM7.02 or PLMWEB UI?

From some of the SAP PLM presentation it looks like there is some
customizing avalaible with DC10 transcation (see the attachment)
The requirement is to provide one of our Business Unit exclusive access
to the DIR/CDESK documents while other BU/Users cannot.
Any idea or suggestions?

Thanks,
Pradeep

[Former Member · Accepted solution]

Ok made some progress on the PLMWEBUI topic.  To use ACC, you need the PLMWEBUI to be active.

-Configured CDESK for the ACC field to show up..

-Completed the required PLMWEBUI role assignment and authorization objects to the cad admin id.

- Run the report to create the initial Root Access Context using the report

/PLMB/R_AUTH_ADD_ROOT_CONTEXT.

Further questions if anyone can help here...

1) After the root context is created, how can I create additional contexts per site and how does it help in control the display and edit function of the documents. (ex: users assigned to context ACC1 for plant A should not be able to view or edit documents from connect ACC2 which is Plant B).

2) Is there a mass method to assign multiple DIR's to a Access context id?

Thanks in advance!

[Former Member · Accepted solution]

Hi,

The standard SAP user interface for ACC is via PLM Web UI. You can get a consulting package from SAP that enables it in SAP GUI.

To answer:

1. You need to create it using the web UI applications for ACC and creating contexts.

2. Mass update: I dont think there is anythign standard, but you can get a consulting solution from SAP, you can probably use the loader from Seal systems or program yourself.

Regards,

Espen Leknes

[Former Member · Accepted solution]

Thanks Espen for your reply. It was helpful. I saw some PPT from SAP consulting on getting the ACM function in the standard GUI of CVxxN transactions. I tried to contact the email id on the presentation, but no reply.

If you have any contact information can you please share with me.

-BR

Pradeep

[Former Member · Accepted solution]

We contacted SAP directly and got the details regarding the add-on.

In reply to your original question. We have separated one BU in exactly the same way as your requirement, without the add-on from SAP.

One administrator has created a ACC for the BA. In table /PLMB/WEN_PRM we added all the users in the BA with entries like the one below. First column is username, last column is the ID of the ACC.

The table is the work environment for the user, and among other things you can set the default ACC there.

155534	ACCID_EXT	50518195

For that BA, a role without the authorisation objects PLM_TRUSR and PLM_SPUSR is assigned. This forces all documents to be created with an ACC, and this is automatically taken from the work environment.

For users outside the BA, they have the objet PLM_TRUSR, but never PLM_SPUSR.

Regards,

Espen Leknes

[Former Member · Accepted solution]

Thanks again for getting the information. Few questions 1-5

1) How much the ACM add on cost? Is it a transport to import?

2) When you say "We have separated one BU in exactly the same way as your requirement, without the add-on from SAP" are you pointing that we do not need the custom add on ACM function?

I was more inclined to use the ACM function from CDESK window ( see attachment). This way the users can be assigned to their sites Access Context from here and the admins have an opportunity to reassign the context to multiple DIR's from this single window.

3) But the challenge I have here is that I cannot create new additional Access context from here. I need to have the PLM Work Environment (WEBUI) for that?

4) With my test so far I have seen that once you mark the doctype with the ACM flag, you need the authorization objects PLM_TRUSR and PLM_SPUSR to be added to the user roles even for them to display and edit the DIR's. How will not adding the authorization objects PLM_TRUSR and PLM_SPUSR force them to add ACC when they cannot even create the DIR?

5) So for blocking the display or edit DIR access to the users outside BA, they just need PLM_TRUSR?

BR-

Pradeep

[Former Member · Accepted solution]

1. ACM is part of the Collaborative Product Development license. Talk to your SAP account manager for costs. You need to activate the business functions for PLMWUI in tcode SFW5.

2. You do not need the add-on from SAP consulting. Standard SAP works nicely.

3. Yes, you need the web UI for creating and managing ACCs. So some administrator needs it.

4. You need PLM_SPUSR and PLM_TRUSR unless you have an ACC set in your work environment, ie the table.

5.  Your other users needs TRUSR to create without an ACC. As long as they are not members of the context, they cannot see what the BA needs to hide.

Espen

[Former Member · Accepted solution]

Thanks Espen !! Points awarded

My closing comments

1) We already have the license to activate the PLMWEBUI/ACC.

2) That's a good news that we do not need the extra add on and the out of the box ACC solution works fine.

3)  If the out of the box ACC solution works, then I am planning to run the PLM Work Center on the NWBC for the administrators from each site to create their ACC from there..

4) Are you referring to the table  /PLMB/WEN_PRM? I could not find it in or system even though I have PLMWEBUI/PLMWEBUI2/PLMWEBUI3 business functions.

5) This information was very useful.

Thanks,

Pradeep

[Former Member · Accepted solution]

Hi Espen

I'm facing an ACM on SAP GUI problem.

I run tests on ACCs and the roles with or without auth-object 'PLM_TRSUR'.

If my testing user is not a PLM_DIR trust user he can not create/change/display a document even when he is assigned in ACC which is tied to the document.

If my testing user is a PLM_DIR trust user, the documents are controlled under ACC on WebUI. But it's not controlled in SAP GUI.

This is the details:

Does ACM work with SAP GUI and should Auth-object 'PLM_TRUSR' assigned ?

Can you help with my issues. Looking forward for your reply.

Regards

Jimmy