## 13.2.11.4.2.1  Qualifying Authorizations
## Use
With qualifying authorizations, the screen structure of individual transactions controls whether a user (depending on the role defined) can only select certain menu options (such as Create , Change , Display , and so on), and/or whether the user may only carry out certain activities within these menu options.
## Integration
The qualifying authorization controls which actions each user is allowed to execute in Incentive and Sales Force Management .
A commission manager generally needs a more complex authorization profile than, for example, a commission contract partner , who normally executes fewer activities in the system than a commission clerk.
You must check that the commission manager actually does have authorization to change and display data. Commission clerks can also initiate the calculation of commission rates. They require additional authorizations for this activity.
## Features
At the start of each transaction, the system checks the qualifying authorization for various authorization objects.
If the user does not have authorized access, the system issues a warning and the transaction is terminated.
Qualifying authorizations are used in ISF in the processes and activities described below.
## SAP EP
The following reference roles are available in SAP EP:
## ICM Analyst
The authorization object &lt;E\_CACS\_STD&gt; checks if the ICM analyst is authorized to edit standard commission contracts.
You can restrict these authorizations depending on the way tasks are assigned in your company.
In addition, the authorization object &lt;E\_CACS\_BR&gt; checks if the ICM Analyst is authorized to maintain business rules.
## ICM Participant
The only authorization query that the system makes is the role assignment of the user management and authentication mechanisms of the SAP NetWeaver platform.
## Credentials Manager
The authorization object &lt;E\_CRD\_PRNT&gt; checks if the credentials manager is authorized to print correspondence.
The authorization object &lt;E\_CRD\_AS&gt; checks if the credentials manager is authorized to make credential assignments.
## SAP Easy Access Menu
The following authorizations are available for the SAP Easy Access menu:
## Commission Case
The commission case is divided up into the activities Create, Change, Display, Undo and Reactivate . These activities have an activity indicator that is queried in the authorization check (1 = Create, 2 = Change, 3 = Display, 85 = Undo). Authorization object &lt;E\_CACS\_BK&gt; checks these activities.
You can include processing modes (0 - Simulation, 1 - Buffering, 4 - Parking, 6 - To Be Checked, 7 - Reserved for Update (CALC\_DATE) and 9 - Final Entry (Post) in the authorization check within the individual processes.
## Commission Case Create
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Post commission case: &lt;E\_CACS\_BK&gt;
## Commission Case Change
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Post commission case:
&lt;E\_CACS\_BK&gt;
## Commission Case Display
The system checks the following authorization object:
Authorization object &lt;E\_CACS\_SFC&gt; only permits the Display activity.
## Commission Case Undo
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Post commission case:
&lt;E\_CACS\_BK&gt;
Release and reverse:
&lt;E\_CACS\_REV&gt;
See Change menu option
## Commission Case Reactivate
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Post commission case: &lt;E\_CACS\_BK&gt;
## Pending Cases (General)
A commission manager who has editing authorization also has display authorization.
The same authorizations are required to edit commission cases and pending cases.
## Pending Cases Display
The system checks the following authorization object:
Authorization object &lt;E\_CACS\_SFC&gt; only permits the Display activity.
## Pending Cases Edit
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Post commission case:
&lt;E\_CACS\_BK&gt;
## Document Posting (General)
A user who should have authorization to post documents must have profile &lt;E\_CACS\_DOCP&gt;.
This profile contains authorization object &lt;E\_CACS\_DOC&gt;.
If the data for the FI document is to be checked in the target system, the system calls function module CACS00\_TRANSFER\_FI\_PREPARE . A user needs the following authorization to execute this function module in the target system:
CALL FUNCTION ,AUTHORITHY\_CHECK\_RFC'
EXPORTING USERID = sy-uname FUNCTIONGROUP = ,ACC4' EXCEPTIONS RFC\_NO\_AUTHORITY = 1
## Master Data (General)
You maintain master data with the Business Data Toolset (BDT). This includes predefined authorization checks.
The checks are called up between the initial screen and the first data screen, or before the user saves data for the first time. Different authorization types and fields have been defined. Within this authorization, you can define which user may process which fields. Authorization types and related fields are grouped into authorization objects. Within these authorization objects, you can also define activities, such as Create, Change .
Customer-specific field groups have to be checked by customer-specific programs. Nevertheless, existing function modules can still be called to carry out the authorization check.
- Master Data Commission Contract Partner (General)
- ⇒ Create
- ⇒ Change
- ⇒ Display
A commission manager who has authorization to edit objects is also automatically authorized to display them.
The system checks the following authorization objects:
Authorization types: &lt;B\_BUPA\_ATT&gt;
Field groups:
&lt;B\_BUPA\_FDG&gt;
Authorization groups:
&lt;B\_BUPA\_GRP&gt;
Role of commission contract partner:
&lt;B\_BUPA\_RLT&gt;
(The authorization looks for the role of commission contract partner. Payment cards: &lt;B\_CCARD&gt; )
- Master Data Contract
- ⇒ Create
- ⇒ Change
- ⇒ Display
The authorization to perform activities on a commission contract is divided into three views that are controlled by their authorization objects.
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Activity for other contracts: &lt;E\_CACS\_SFC
(The contracts that do not belong to the user currently logged on to the system.)
Activity for your own contracts:
&lt;E\_CACS\_SMC&gt;
(The contracts that belong to the user currently logged on to the system.)
Activity for commission contracts of business partners in managerial positions: &lt;E\_CACS\_SLC &gt;
The following authorization objects:
&lt;E\_CACS\_SMC&gt;
&lt;E\_CACS\_SFC&gt;
&lt;E\_CACS\_SLC&gt;
are searched for the respective activity:
(01 Create , 02 Change , 03 Display ).
In the case of authorization for editing other contracts, the system checks whether the user is a business partner who also has the role of commission clerk. If this is the case, the system takes the PD-Org structure to read all subordinate organizational units and contracts below the organizational unit to which the business partner is assigned as commission clerk.
In the case of authorization for processing own contracts, the system checks the user's own contracts. For a user to be able to view his or her own contracts, the system user must be entered as a business partner in the role of commission contract partner (and also the User field). The system user is then able to maintain and display all of the contracts determined on the basis of the above criteria. Users can also maintain and display all the contracts that they themselves have " parked " (contracts with "parked" status).
You can, however, get around the structural authorization by assigning authorizations to the object E\_CACS\_CTR .
## Master Data Portfolio Assignment
The system checks the following authorization objects:
Administration in PFO: &lt;E\_PFO\_ADM&gt;
(Checks the authorizations for administrative activities in portfolio assignment).
Mass activities in PFO: &lt;E\_PFO\_MAS&gt;
Checks whether the user can start EDT.
Objects in PFO: &lt;E\_PFO\_OBJ&gt;
Checks whether a user is authorized to access the following programs:
PFO\_SEG: Display of segments in PFO
PFO\_GZO: Display of business object assignment role
PFO\_SZO: Display of assignment role for assignment object
## Master Data Organizational Plan
Assignment: commission contract -PD-Org
When you are working in a commission contract and actively save it, the system checks whether you are authorized to assign a position.
The system checks which organizational unit the clerk is assigned to (user ID and link 290 between organizational unit and position), and whether the organizational unit to be assigned is in the clerk's area of validity.
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Activity for other contracts:
&lt;E\_CACS\_SFC
Activity for your own contracts:
&lt;E\_CACS\_SMC&gt;
Activity for commission contracts of business partners with managerial positions: &lt;E\_CACS\_SLC &gt;
Personnel planning and development, and structure authorizations: &lt;PLOG&gt; PD
## Info Center
## ⇒ My Workplace
The system checks the following authorizations as to whether the user who has logged in is a commission clerk:
Authorization object: &lt;S\_MWB\_FCOD&gt;
Authorization profile: &lt;S\_MDT\_ALL&gt;
## Info Center
## ⇒ My Remuneration
No qualifying authorizations objects implemented.
- Info Center Reports Line Items
- ⇒ Valuation
- ⇒ Remuneration &amp; Liability
- ⇒ Settlement
A check is made as to whether the user only sees those contracts for which he/she has authorization, in other words, his/her own contract and those assigned to the user. The system calls data service module CACS\_ORG\_PERMISSIONS\_ASK 'Check OU and CContract for Clerk' .
If the selection teasers or display fields include field CTRTBU-ID , data service module CACS\_READ\_DATA looks for the user's own contract or for authorization to view other contracts.
As with the commission contract, authorization must be given through authorization object &lt;E\_CACS\_SMG&gt;.
Profile &lt;E\_CACS\_REP&gt; also exists. This profile controls authorization for reporting. It includes the following objects: &lt;K\_KA\_RPT&gt;
with the following activities:
01 Add or Generate, 02 Change, 03 Display, 04 Print, Edit Messages,.16 Execute, 21 Transport, 28 Display Line Items, 29 Display Saved Data, 32 Save, 60 Import, 61 Export 65 Reorganize, 66 Update, L0 All Functions, L1 Scope of Functions Stage1, L2 Scope of Functions Stage 2 and &lt;K\_KA\_RCS&gt;
with the following activities:
01 Add or Generate, 02 Change, 03 Display, 21 Transport, 60 Import, 65 Reorganize.
In background (batch) processing, the system must save the user ID with the reports that are created. The same authorization checks are made as with online processing.
The reports that are created can be saved. When a user calls a saved document, the system does not check whether the user is permitted to view the data. You should therefore create different reports for each authorization group.
You have to define a Superuser role (user with extensive authorization) before you can set up reports.
- Info Center Reports Totals
- ⇒ Valuation
- ⇒ Remuneration &amp; Liability
- ⇒ Settlement
See Info Center → Line Items
If the position or the number of the organization unit is part of the ID, the system must check whether the clerk has authorization for the position or organizational unit.
## There are two variants:
- Authorization for the organizational unit
- Different reports for each type of organizational unit
## Info Center Remuneration Inquiry
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APP&gt;
Post document:
&lt;E\_CACS\_DOC&gt;
Display/change other commission contract:
&lt;E\_CACS\_SFC&gt;
## Info Center
- → Display of Settlement Lock
The following authorization object is used: E\_CACS\_DOC
## Administration
## Periodic Processing Data Transfer
There is no specific authorization check for data transfer. The check depends on the particular process, regardless whether this occurs as a dialog or by EDT.
## AdministrationPeriodic ProcessingClosing
- ⇒ Flat Rates, Guarantees
- ⇒ Guarantee Offsetting
- ⇒ Additional Commission Cases
- → Accruals Notification
The following authorization objects are used:
Authorization for mass processing:
E\_CACS\_MAS
Authorization for settlement:
&lt;E\_CACS\_ACC&gt;
## AdministrationPeriodic Processing
## ⇒ Settlement Schedule Run
The following authorization objects are used:
Authorization for mass processing:
E\_CACS\_MAS
Authorization for settlement:
&lt;E\_CACS\_ACC&gt;
## AdministrationPeriodic Processing
- ⇒ Settlement
The following authorization objects are used:
Authorization for mass processing:
E\_CACS\_MAS
Authorization for settlement:
&lt;E\_CACS\_ACC&gt;
## AdministrationPeriodic ProcessingCorrespondence
- ⇒ Mass Printing
- ⇒ History
The following authorization objects are used:
Authorization for mass processing:
E\_CACS\_MAS
## AdministrationPeriodic Processing
## ⇒ Commission Contracts
The system checks the following authorization objects:
See
Master Data End Contracts
## Administration
- ⇒ Current Administration
- ⇒ Edit Period Rules
<!-- image -->
The system checks the following authorization objects:
Administration functions in Change &amp; Transport System: &lt;S\_CTS\_ADMI&gt;
Table maintenance:
&lt;S\_TABU\_DIS&gt;
## AdministrationCurrent Administration
## ⇒ Standard Commission Contract
The system checks the following authorization objects:
Administration functions in Change &amp; Transport System: &lt;S\_CTS\_ADMI&gt;
Table maintenance:
&lt;S\_TABU\_DIS&gt;
## AdministrationCurrent Administration
## ⇒ Edit Target Rules
The system checks the following authorization object:
Target agreements: Authorization to process rules:
## AdministrationCurrent Administration
## ⇒ Lock Agent for Settlement
The system checks the following authorization object:
Table maintenance:
&lt;S\_TABU\_DIS&gt;
## AdministrationCurrent Administration
## ⇒ Mass Updating
Mass data processing is conducted here.
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Authorization for mass processing: &lt;E\_CACS\_MAS&gt;
## AdministrationCurrent Administration
## ⇒ Retroactive Case Processing
The system checks the following authorization object:
Checks the creation and processing of RCP worklists. &lt;E\_CACS\_RCP&gt;
The Activity and Commission Application fields are checked.
## AdministrationCurrent Administration
## ⇒ Object Transfer
The system checks the following authorization object:
FOA: Authorization object for accessing Framework for Object Assignment
## &lt;E\_CACS\_OAA&gt;
## AdministrationCurrent Administration
&lt;E\_CACS\_TRU&gt;
## ⇒ Unlock Payment
The system checks the following authorization objects:
Authorization for settlement: &lt;E\_CACS\_ACC&gt;
Authorization for mass processing: &lt; E\_CACS\_MAS&gt;
## AdministrationàCurrent Administration
- → Maintenance of Settlement Lock
The following authorization object is used: &lt;E\_CACS\_DOC&gt;
- Administration System Administration Commission Clerk
- ⇒ Create
- ⇒ Authorize
- ⇒ Change
- ⇒ Display
The authorization must check the role of commission contract partner.
Authorization object &lt;B\_BUPA\_RLT&gt; must be assigned to users to enable them to process commission clerk master data.
Own check of field group user ID and B\_BUPA\_FDC.
- Administration System Administration Resetting
The system checks the following authorization object:
(Authorization for mass processing): &lt;E\_CACS\_MAS&gt;
## AdministrationSystem AdministrationResetting
- ⇒ Data Transfer
- ⇒ Flat Rates, Guarantees
- ⇒ Additional Commission Case
- ⇒ Settlement
- ⇒ Settlement Schedule Run
- → Accruals Reversal
The system checks the following authorization object:
(Authorization for mass processing): &lt;E\_CACS\_MAS&gt;
## AdministrationSystem AdministrationArchiving
- ⇒ Commission Cases
- ⇒ Commission Documents
- ⇒ Commission Contracts
The system checks the following authorization object:
(Authorization for mass processing) &lt;E\_CACS\_MAS&gt;
## AdministrationSystem Administration
## ⇒ Parallel Processing
There is no specific authorization check for parallel processing. The check depends on the particular process.
## AdministrationSystem Administration
- ⇒ Logs
No qualifying authorizations objects implemented
## AdministrationSystem Administration
- ⇒ Area Menus
A check runs on transaction CACSBDT.
Different authorizations are required for Display and Change .
##  Caution
Only experienced BDT experts should have authorization for this menu option, because this is the menu used to change program flow, screen structure of input screens, and so on.
## AdministrationSystem Administration
- ⇒ Customizing (General)
Users with authorization for Customizing also have display and change authorizations.
- S\_PROJECT: Controls activities related to Customizing projects ( Create, Change and so on).
- S\_PROJECTS: Superuser authorization in project management.
Authorization object &lt;S\_TABU\_DIS&gt; handles authorization for views. This object controls whether a clerk can process the views used in Customizing.
Authorization object &lt;E\_CACS\_APPL&gt; can handle views that are not generated. The system issues a query when you try to start the application.
- Administration System Administration Test
- ⇒ Compare Commission Case
- ⇒ CATT
No qualifying authorizations objects implemented.
## Administration
- ⇒ System administration
- ⇒ Individual Settings
The system checks the following authorization object:
(Authorization for mass processing): &lt;E\_CACS\_MAS&gt;
## Other Qualifying Authorizations
## Condition Technique
The system checks the following authorization objects:
Application authorization:
&lt;E\_CACS\_APPL&gt;
The following SD authorization objects are required:
Authorization for condition types and conditions maintenance:
&lt;V\_KONH\_VKS&gt;
Condition generation: Authorization for usage/application. &lt;V\_KONG\_VWE&gt;
## Generator
The generator looks for the following authorization objects:
Administration: &lt;E\_CACS\_ADM&gt;
Application authorization:
&lt;E\_CACS\_APPL&gt;
Authorization for generator:
&lt;E\_CACS\_GEN&gt;
In the current version the system queries activity 2. A user with authorization for this menu option can also work in change and display mode.
Authorization for namespace conversion
Authorizes user to convert data as a consequence of the namespace change: &lt;E\_CACS\_NSC&gt; .
The definition of the conversion is not affected by this.
Defined fields CACS\_APPL:
Limits the conversion to a specified commission application.
## Organizational Management Drilldown
The following authorization objects are used:
Application authorization:
&lt;E\_CACS\_APPL&gt;
Activity for other contracts:
&lt;E\_CACS\_SFC
Activity for your own contracts:
&lt;E\_CACS\_SMC&gt;
Activity for commission contracts of business partners with managerial positions: &lt;E\_CACS\_SLC &gt;
PD: Personnel planning and development, and structure authorizations: &lt;PLOG&gt;
## Financial Accounting
The user requires authorization for the FI area to create documents (for Accounts Receivable/Accounts Payable accounting).
##  Recommendation
SAP recommends that you use the profile generator (transaction PFCG ) to create authorization profiles).
## Business Rule Editor
The system checks authorization object &lt;E\_CACS\_BR&gt; for the following:
1. Maintenance of rule characteristics for the standard commission contract
2. Individualization of the business rules in the commission contract
3. Binding of business rule data objects for valuation and remuneration