Restricted transaction FBL3N by GL Account

[Former Member]

Dear Gurus,

My user wants to restricted in transaction FBL3N by GL Account. for example, user 1234 when execute FBL3N only for GL Account 3245XX5 line item display, even the user input range GL Account from 3245xx1 to 3245x10.

It is possible to do it ? i try to create variant in SHD0 but not work. i need your advices, any one had face and find solution or this configuration ? please give me detail steps.

Thank you,

Iwan Siahaan

[himanshu_gupta13]

Hi Iwan,

Use the BADI FI_ITEMS_CH_DATA.

Here, implement the Z_FI_ITEMS_CH_DATA and write the below code:

IF sy-tcode = 'FBL3N'.

   ENDIF.

In if endif... define your code.

many Thanks/  HImanshu Gupta

[Former Member]

Hi Gupta,

there is a note to implement this BADI.

can you give me detail steps ?

Thank you,

Iwan Siahaan

[himanshu_gupta13]

Hi Iwan,

Just go to SE18 tcode and then  enter the below badi

FI_ITEMS_CH_DATA.

open in display mode, then follow the path,

Implementation->Create-> <name of implementation> ->enter the code in method of CHANGE_ITEMS.

Now, here you can do your code and restrict the user GL account wise. In this method CT_ITEMS internal table contains the data.

Below code is just an example, you have to do coding according to your requirement...

IF sy-tcode = 'FBL1N'.

     TYPES : BEGIN OF ty_yafb1n ,

               uname(12) TYPE c,

             END OF ty_yafb1n.

     DATA : it_yafb1n TYPE STANDARD TABLE OF ty_yafb1n,

            wa_yafb1n TYPE ty_yafb1n.

     DATA wa_ct_items LIKE LINE OF ct_items.

     DATA flag TYPE i VALUE 0.

     SELECT uname

       INTO wa_yafb1n-uname

       FROM yafb1n.

       APPEND wa_yafb1n TO it_yafb1n.

       CLEAR wa_yafb1n.

     ENDSELECT.

     LOOP AT it_yafb1n INTO wa_yafb1n.

       IF sy-uname = wa_yafb1n-uname.

         flag = 1.

       ENDIF.

       CLEAR wa_yafb1n.

     ENDLOOP.

     LOOP AT ct_items INTO wa_ct_items.

       CALL FUNCTION 'CONVERSION_EXIT_ALPHA_OUTPUT'

         EXPORTING

           input  = wa_ct_items-konto

         IMPORTING

           output = wa_ct_items-konto.

     IF wa_ct_items-konto BETWEEN 'P1' AND 'P99999' AND flag = 0.

       MESSAGE 'You Do not have Authorisation to view the required Details' TYPE 'E'.

     ENDIF.

       CLEAR wa_ct_items.

     ENDLOOP.

     CLEAR : it_yafb1n, it_yafb1n[], flag.

     REFRESH : it_yafb1n, it_yafb1n[].

   ENDIF.

Many Thanks / Himanshu Gupta

[former_member211635]

Hi Iwan,

1. Create an authorization group using T Code SE54

2. Maintain the auth grp in in GL Master Level FS00 -> Control data tab > Auth Grp.

3. Go to Roles which have been found in the step as mentioned by me in the step above --> Authorization --> Ctl + F --> Enter Auth Object 'F_SKA1_BES' and enter the auth group(s) which has been entered in the GL Master data

Please create auth. grps for GL as required by you as per auth restrictions which you want to implement

Hope this helps

Thanks

Nishu

[Former Member]

Hi Nishu,

i already done doing your steps, and i execute FBL3N for user 1234 and the result user still open all G/L account line item display.

any idea about this ?

Thank you,

Iwan Siahaan

[former_member211635]

Hi Iwan,

Also maintain auth grp for auth object 'F_BKPF_BES'

Also check whether the user has any other role which has two auth object as mentioned above which might be permitting access to GL accounts

Thanks

Nishu

[former_member211635]

Hi,

You can restrict through auth. object 'F_SKA1_BES'

Please go to transaction su24 -->roles -> By transaction assignment

Enter fbl3n in transaction and it will show all the roles which are assigned rights of such transaction

Go to T.code pfcg -> Enter Role(s) which you want to restrict based on grouping of users --> Authorizations -> Change Auth button -> Find Auth object 'F_SKA1_BES' and restrict the GLs over here as required

Hope this helps

Thanks

Nishu

[suma_mani]

Hi Nishu,

You can able to do the same ,if you use authorization group in GL Master (FS00) > Control data. Like create 1 authorization group and assign in GL master ,where business doesn't interest to shown values to other user's. Restrict same authorization group through authorization objects as mentioned above in roles.

Regards

Mani

[Former Member]

Dear Nishu,

in F_SKA1_BES where i can put the GL account ?

Please need detail step to configure.

Thank you,

Iwan Siahaan

[Former Member]

Hi Kumar,

how about GL where authorization is BLANK ? i've try where some GL are blank in authorization gruop doesn't work. is it all GL should have authorization group ?

Please your advise.

Best regards,

Iwan Siahaan

[suma_mani]

Hi Iwan,

You just go to FS00 > Enter one GL account > Control data > Enter BZ00 as authorization group and save.

Go to SU24 enter FBL3N as transaction code > Execute > select this F_BKPF_BES object and check proposal should be Yes,if not Yes ,go to change mode and change as Yes.

Discuss with basis team add above object in authorization object to one user and check FBL3N ,which will excute. Check rest of all user's FBL3N with respect to same GL ,it

gives error.

Regards

Mani

[sanilbhandari]

Hi

Check for the GL Account Authorization Object in SU24 for Transaction code FBL3N.

Regards

Sanil Bhandari