## 13.9.3.1.1  Authorizations
Extended Warehouse Management (EWM) uses the authorization concept provided by the AS ABAP or AS Java. Therefore, the recommendations and guidelines for authorizations as described in the Application Server ABAP Security Guide and SAP NetWeaver AS Security Guide Java also apply.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP and the User Management Engine's user administration console on the AS Java.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication .
## Standard Authorization Objects
To gain an overview of the authorization objects for EWM, proceed as follows:
1. Open transaction AUTH\_DISPLAY\_OBJECTS to display active authorization objects.
2. In the overview, expand the following subtree of authorizations related to EWM.
1. Authorizations Extended Warehouse Management (SCWM)
2. Dock Appointment Scheduling (SCDS)
3. Authorizations SCM Basis (SCMB)
4. Master Data Authorization Objects (SCMD)
If you want to display the technical names of the authorization objects, choose Edit Technical Names On .
3. If you want to get a detailed description, choose the Information button next to the authorization object you are interested in.
## Warehouse-Based Authorization
## Warehouse-Specific Field in Authorization Objects
If you have multiple warehouses modelled in EWM, you may need people working in one warehouse to be able to access data from another warehouse. Many authorization objects in EWM contain a specific authorization field for this purpose, for example:
- /SCWM/LGNU ( Warehouse Number/Warehouse Complex ) This is the most commonly used authorization field. It is used, for example, in EWM monitor authorization
object /SCWM/MO .
- /SCWM/ORG ( Location/Organizational Unit )
- /SCMB/LGNU ( Warehouse Number/Warehouse Complex )
## Warehouse in Customizing or Administration
In other cases, such as in administration or Customizing, EWM does not use specific authorization objects. Instead, you can use generic authorization objects to limit the access to tables and views, for example:
- S\_TABU\_NAM ( Table Access by Generic Standard Tools )
- S\_TABU\_LIN ( Authorization for Organizational Unit )
<!-- image -->
##  Example
The Customizing activity Define Storage Bin Types has the assigned Customizing object /SCWM/T303 . The underlying database table /SCWM/T303 contains field LGNUM (warehouse number) with data element /SCWM/ LGNUM ( Warehouse Number/Warehouse Complex ). Y ou can use generic authorization objects to limit the access to tables and views, as follows:
- Use authorization object S\_TABU\_NAM to limit access to Customizing object /SCWM/T303 .
- Use authorization object S\_TABU\_LIN to limit access based on organizational criteria. You can also use authorization field ORG\_CRIT ( Organization Criterion for Key-Specific Authorization ) and use value /SCWM/LGNU ( Warehouse Number/Warehouse Complex ) to be able to enter a warehouse in ORG\_FIELD1 .
For more information, see the documentation of authorization objects S\_TABU\_NAM and S\_TABU\_LIN in transaction SU21 .
## BRFplus
BRFplus is sometimes used in EWM, for example, in Labor Management. However, BRFplus does not recognize organizational units such as the warehouse. Therefore, if BRFplus entities should be separated based on warehouse, you must consider this during the implementation phase so that you can use alternative BRFplus mechanisms.
For information about the authorization concept of BRFplus, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Business Rule Framework plus (BRFplus) Concepts Authorizations
## Critical Combinations
## Appointment Planner for Carrier
##  Note
These authorizations are relevant only if you are using SAP Dock Appointment Scheduling.
SAP Dock Appointment Scheduling offers a collaboration scenario where appointment planners for carriers can log on to the SAP Dock Appointment Scheduling system, and view and maintain appointments for their carrier. Since this potentially means that employees of a different company access SAP Dock Appointment Scheduling from outside the company network, you must put a special focus on authorizations. This kind of user should have very limited authorizations. As well as this, they should be able to access data of their own carrier only, and not be able to access other carriers' data. They should not be able to see internal data, like overall capacities of loading points. Therefore, you must be very careful and restrictive when assigning roles and authorizations to this kind of user.
SAP Dock Appointment Scheduling delivers a special authorization field for this.
##  Note
We recommend that you define, in the roles, the loading points for which a user may view or create appointments. You can do this in the Loading Point authorization field ( /SCWM/DSLP ) in the authorization objects Loading Appointment ( /SCWM/DSAP ) and Slot ( /SCWM/DSSL ).
In addition, the authorization field User Process Scope for Dock Appointment Scheduling ( /SCWM/DSPS ) is very important. It is available on the Loading Appointment and Slot authorization objects. For appointment planners for carriers, set this field to Scope for an Appointment Planner for Carrier . This ensures that this user can create and view appointments only for the carrier that is assigned to him or her. Otherwise such a user could create appointments for any carrier.
## Warehouse Management Monitor: General
In the warehouse management monitor ( /SCWM/MON ), you can monitor and access a wide area of application content and also trigger actions. Due to the high amount of different data that can be accessed, this may be critical and you may want to restrict the access to the monitor and to the data and actions which can be used. Therefore, the warehouse management monitor provides a concept to restrict which persons can access which monitor nodes and which actions can be triggered. The corresponding authorization object is /SCWM/MO .
## Warehouse Management Monitor: Authorization to Display Batch Execution Data
In the warehouse management monitor ( /SCWM/MON ), you can execute selections using batch jobs. You can view the results in the warehouse management monitor. During the selection, the system performs the normal authorization checks and selects and stores only data for which the user has authorization in the data containers for the warehouse management monitor. But if these data containers are then displayed by other users, the system does not perform these authorization checks. Therefore, you should only grant the authorization to display batch execution data for monitor nodes or users where these checks are not critical.
The authorization object used for the authorization to display batch execution data in the warehouse management monitor is /SCWM/DATC . For more information about this authorization object and the warehouse management monitor, see SAP Library for SAP S/4HANA at https:/ /help.sap.com/s4hana . In SAP Library, choose SAP S/4HANA Enterprise Business Applications Supply Chain Extended Warehouse Management Monitoring Warehouse Management Monitor .
## Maintaining Authorizations for Integration with SAP Components
## Maintaining Authorizations for Integration of EWM Within Supply Chain
##  Note
This is not relevant for standalone SAP Dock Appointment Scheduling.
For the integration of EWM within Supply Chain, that is, with Logistics Execution (LE) and Logistics General (LO), use the authorization roles for the remote function call (RFC) destination users. For more information about these roles, see SAP Library for SAP S/4HANA at https:/ /help.sap.com/s4hana . In SAP Library, choose SAP S/4HANA Enterprise Business Applications Supply Chain Extended Warehouse
Management Roles for Extended Warehouse Management (EWM) .
For the integration from Supply Chain to EWM, for example, the role /SCWM/ERP\_EWM\_INTEGRATION exists. For the integration from EWM to Supply Chain, the corresponding RFC users also require the proper authorizations. For more information, see SAP Note 2081387 .
In some cases, for example, for migration functions like transaction /SCWM/MIG\_PRODUCT , the RFC enabled function module RFC\_READ\_TABLE is called on the Supply Chain side from EWM. For such scenarios, the corresponding RFC user requires this authorization. To avoid misuse, you should restrict the tables to be accessed to a minimum. You can therefore use the authorization objects S\_TABU\_NAM or S\_TABU\_DIS .
If you grant the usage of RFC function RFC\_READ\_TABLE to an RFC user, it is very important that you restrict the tables that can be accessed to a minimum to avoid misuse.
## Maintaining Authorizations for Data Transfer to SAP Business Warehouse
##  Note
This is not relevant for standalone SAP Dock Appointment Scheduling.
You can exclude DataSources from the extraction to SAP Business Warehouse (SAP BW).
Data that is stored in the extraction structure of this DataSource cannot be transferred to SAP BW.
1. In Customizing for Extended Warehouse Management , choose Integration with Other SAP Components Data Transfer to Business Warehouse General Settings Limit Authorizations for Extraction .
2. Choose New Entries and choose a DataSource that you want to exclude from the extraction.
3. Choose the SAP BW system for which you want no more data for this DataSource to be extracted.
4. In the Ex. Extr. field, enter whether or not you want to exclude the DataSource from the extraction.
5. Save your entries and specify a transport request.
## Maintaining Authorizations for Data Transfer Between Shipping and Receiving (EWM) and SAP Dock Appointment Scheduling
##  Note
This is not relevant for standalone SAP Dock Appointment Scheduling.
SAP Dock Appointment Scheduling and Shipping and Receiving (S&amp;R) are two independent components. But it is also possible to integrate the components, for example, so that the system communicates appointment status changes in SAP Dock Appointment Scheduling to S&amp;R and appointment status changes in S&amp;R to
SAP Dock Appointment Scheduling. For more information, see SAP Library for SAP S/4HANA at https:/ / help.sap.com/s4hana . In SAP Library, choose SAP S/4HANA Enterprise Business Applications Supply Chain Extended Warehouse Management SAP Dock Appointment Scheduling Integration with SAP EWM .
For integration between SAP Dock Appointment Scheduling and S&amp;R, the system uses queued RFC (qRFC) technology.
## Using Standard Roles for SAP Dock Appointment Scheduling to EWM Integration
For the integration from SAP Dock Appointment Scheduling to S&amp;R, the technical role /SCWM/ DAS\_TO\_EWM\_INTEGRATION is available. It contains the necessary authorizations to update the relevant S&amp;R objects. The role does not contain any menu entries or transactions, as it is only a technical role for RFC communication. You must assign this role to the SAP Dock Appointment Scheduling user or RFC user, depending on if you use RFC communication, with which the integration is done.
## Maintaining RFC Authorizations for Internal Communication in EWM
For RFC communication, users usually require the authorizations for authorization object S\_RFC . As RFCs are potential security risks, you should be very restrictive in granting them. In certain cases, EWM also uses RFCs for internal purposes, for example for parallel processing or for asynchronous communication. For these purposes, no RFC authorizations have to be granted as these calls are within the SAP S/4HANA system.
EWM also uses specific RFC-enabled function modules, which are used to extract content from qRFCs. For example, these function modules are used to extract the warehouse number or delivery number from qRFCs.
These function modules do not perform data changes in EWM and also do not return data to a caller. They are required for delivery processing and for displaying of message queue entries in the warehouse management monitor.
The function modules are in the following special function groups:
- /SCWM/CORE\_MQ\_REPLAY ( Message Queue Moni: Replay Functions )
- /SCWM/CORE\_RF\_MQ\_REPLAY ( Replay Function Modules for RF )
- /SCWM/DELIVERY\_MQ\_REPLAY ( Replay Function Modules for Deliveries )
- /SCWM/ERP\_MQ\_REPLAY ( Replay Function Modules - ERP Interface )
- /SCWM/SR\_MQ\_REPLAY ( Replay Function Modules - S&amp;R )
- /SCWM/VAS\_MQ\_REPLAY ( Replay Function Modules for VAS )
- /SCWM/WC\_SERVICE\_MQ\_REPLAY ( Replay Function Modules for Workcenter )
- /SCWM/WAVE\_MGMT\_MQ\_REPLAY ( Replay Function Modules for Wave )
- /SCWM/GTS\_INT\_MQ\_REPLAY ( Replay Function Modules for GTS Interface )
If you use the message queue monitor node in the warehouse management monitor, you must add these function groups to authorization S\_RFC . Use the activity Execute (16) and the Function Group (FUGR) type of RFC object.
For delivery and warehouse task processing, for example, confirming and creation of warehouse tasks, you must add the function group /SCWM/DELIVERY\_MQ\_REPLAY ( Replay Function Modules for Deliveries ) to authorization S\_RFC .
These authorizations are already in the standard roles in EWM, so they are only relevant if you create your own roles.