{"id":965,"date":"2012-02-24T18:51:54","date_gmt":"2012-02-24T18:51:54","guid":{"rendered":"http:\/\/sapsecurityanalyst.com\/WP\/?page_id=965"},"modified":"2015-05-03T06:08:10","modified_gmt":"2015-05-03T06:08:10","slug":"hr-general-authorization-concept","status":"publish","type":"page","link":"https:\/\/sapsecurityanalyst.com\/WP\/hr-general-authorization-concept\/","title":{"rendered":"HR General Authorization Concept"},"content":{"rendered":"<p>&nbsp;<\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><br \/>\n<span style=\"color: #4c4c4c;\">There are two ways to set up HR Security &#8211; <strong><span style=\"color: #0000ff;\">HR\u00a0<\/span><\/strong><\/span><\/span><strong><span style=\"color: #0000ff; font-family: verdana;\"><strong>G<\/strong>eneral Authorizations <\/span><\/strong><span style=\"color: #0000ff; font-family: verdana;\">and <strong>HR<\/strong>\u00a0<strong>Structural Authorizations.<\/strong><br \/>\n<\/span><br \/>\n<span style=\"color: #0000ff; font-family: verdana;\"><!--more--><br \/>\n<strong>HR Structural Authorizations<\/strong> <span style=\"color: #4c4c4c;\">are position based and are used to <strong>restrict<\/strong> access to organizational objects like jobs, tasks, organizational units, person, position etc.<\/span><br \/>\n<\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><br \/>\n<span style=\"color: #4c4c4c;\"> Here we will be discussing about HR General Authorization concepts.<\/span><\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><\/span><br \/>\n<span style=\"color: #0000ff; font-family: verdana;\"><strong>HR General Authorizations<\/strong> <span style=\"color: #4c4c4c;\">are <strong>role based<\/strong>. Roles are created using <strong>PFCG<\/strong> tcode with necessary authorizations so that users can perform their tasks.<\/span><br \/>\n<\/span><br \/>\n<span style=\"color: #4c4c4c; font-family: verdana;\"> Roles are generated to provide the necessary authorizations. We have already discussed about role and authorization concept in our <strong>R\/3 Security<\/strong> related topics. Please refer to them for more details.<br \/>\n<\/span><br \/>\n<span style=\"color: #0000ff; font-family: verdana;\"><span style=\"color: #4c4c4c;\">We know that authorization objects are one of the most important elements as far as sap authorization concepts are concerned. <strong>Below is a list of some of the most important authorization objects used in HR Security:<\/strong><\/span><br \/>\n<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"text-decoration: underline;\"><span style=\"color: #0000ff; font-family: verdana; text-decoration: underline;\"><strong><!--more--><\/strong><\/span><\/span><\/p>\n<h3><span style=\"text-decoration: underline;\"><span style=\"color: #0000ff; font-family: verdana; text-decoration: underline;\"><strong><br \/>\n<\/strong>Important HR Security Authorization Objects<br \/>\n<\/span><!--more--><br \/>\n<\/span><\/h3>\n<table class=\"easy-table-creator tablesorter\" style=\"width: 100%;\">\n<thead>\n<tr>\n<th>\n<h2><span style=\"color: #4c4c4c; font-family: verdana;\">Sl No.<\/span><\/h2>\n<\/th>\n<th>\n<h2><span style=\"color: #4c4c4c; font-family: verdana;\">Authorization Object<\/span><\/h2>\n<\/th>\n<th>\n<h2><span style=\"color: #4c4c4c; font-family: verdana;\">Description<\/span><\/h2>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">1<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_APPL<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Applicants<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">2<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_PCLX<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Clusters<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">3<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_PCR<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Payroll Control Record<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">4<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_ABAP<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Reporting<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">5<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_ORGIN<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Master Data<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">6<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_PERNR<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Master Data &#8211; Personnel Number Check<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">7<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_ORGXX<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Master Data &#8211; Extended Check<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">8<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_TCODE<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR Transaction Code<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">9<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0PLOG<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0Personnel Planning<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">10<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_NNNNN<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0Customer-Specific Authorization Object<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">11<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_ORGINCON<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Master Data with Context<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">12<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_ORGXXCON<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR: Extended Check with Context<\/span><\/h3>\n<\/td>\n<\/tr>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">13<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0P_NNNNNCON<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c; font-family: verdana;\">\u00a0HR Master Data: Customer-Specific Authorization Object with Context<\/span><\/h3>\n<\/td>\n<\/tr>\n<\/tbody>\n<tfoot>\n<tr>\n<td>\n<h3><span style=\"color: #4c4c4c;\">\u00a0<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c;\">\u00a0<\/span><\/h3>\n<\/td>\n<td>\n<h3><span style=\"color: #4c4c4c;\">\u00a0<\/span><\/h3>\n<\/td>\n<\/tr>\n<\/tfoot>\n<\/table>\n<p><span style=\"color: #4c4c4c; font-family: verdana;\"><!--more--><\/span><\/p>\n<p><span style=\"color: #4c4c4c; font-family: verdana;\"><br \/>\nBefore we move ahead with the HR General Authorization checks and authorization objects, lets have a look at the various HR data types which are important for understanding HR Security concepts:<\/span><br \/>\n<script type=\"text\/javascript\">\/\/ < ![CDATA[\n\/\/ < ![CDATA[\ngoogle_ad_client = \"ca-pub-1241348474673689\";\n\/* All content above *\/\ngoogle_ad_slot = \"3293572617\";\ngoogle_ad_width = 468;\ngoogle_ad_height = 15;\n\/\/ ]]><\/script><br \/>\n<script src=\"http:\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\" type=\"text\/javascript\">\/\/ < ![CDATA[\n\/\/ < ![CDATA[\n\n\/\/ ]]><\/script><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><br \/>\n<\/span><\/p>\n<ul>\n<li><span style=\"color: #0000ff; font-family: verdana;\"><strong>Personnel Administration (PA) Data<\/strong> &#8211; <span style=\"color: #4c4c4c;\">This data is related to the various features of <strong>employees and applicants<\/strong> of an organization. By applicants we mean those who apply for jobs via job application (i.e. people who intend to be on the payroll of an organization). Both employee and applicant data is stored in PA infotype. We have already discussed about the infotype range for PA infotypes and OM infotypes in our <a href=\"https:\/\/sapsecurityanalyst.com\/WP\/home\/infotypes\"><span style=\"color: #4c4c4c;\">HR Infotype<\/span><\/a> Section. Authorization objects <strong>P_ORGIN(CON)<\/strong>, <strong>P_ORGXX(CON)<\/strong> and <strong>P_PERNR<\/strong> are used to restrict access to PA data for employees. Authorization object <strong>P_APPL<\/strong> is used to restrict access to data for applicants. We will have a detailed discussion on these authorization objects in coming topics.<\/span><\/span><\/li>\n<\/ul>\n<div><span style=\"color: #4c4c4c; font-family: verdana;\"><br \/>\n<\/span><\/div>\n<div><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><br \/>\n<\/span><\/div>\n<ul>\n<li><span style=\"color: #0000ff; font-family: verdana;\"><strong>Personnel Planning (PP) Data<\/strong> &#8211; <span style=\"color: #4c4c4c;\">Personnel Planning is also referred to as Organizational Management (OM). \u00a0The information for this data type is related Organizational data like position, job, task, person etc. The data is stored in tables of the form <\/span><\/span><span style=\"color: #4c4c4c;\"><strong>HRPXXXX<\/strong><\/span><span style=\"color: #0000ff;\"><span style=\"color: #4c4c4c;\">\u00a0where XXXX stands for infotypes. Similarly, the data for Personnel Administration &#8211; employees and applicants are stored in <strong>PAXXXX and PBXXXX<\/strong>\u00a0tables respectively where XXXX stands for infotypes. Authorization object <strong>PLOG<\/strong> is used to restrict access to PP data.<\/span><br \/>\n<\/span><\/li>\n<\/ul>\n<div><\/div>\n<div><!--more--><\/div>\n<div><\/div>\n<div>\n<ul>\n<li><span style=\"color: #0000ff;\"><strong>Time Evaluation and Payroll Results data<\/strong> &#8211; <span style=\"color: #4c4c4c;\">These data are stored in <strong>cluster tables. <\/strong>Cluster tables are of the form PCL1, PCL2 etc. Access to these data is restricted via authorization object <strong>P_PCLX.<\/strong><\/span><\/span><\/li>\n<\/ul>\n<div><\/div>\n<\/div>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><br \/>\n<span style=\"color: #4c4c4c;\">In our earlier section on R\/3 Security we discussed about the check indicator value<\/span> &#8220;<\/span><strong><span style=\"color: #0000ff;\">Do Not Check&#8221; <\/span><\/strong><span style=\"color: #0000ff;\"><span style=\"color: #4c4c4c;\">in our discussion section related to SU24 concepts. Certain authorization objects &#8220;<strong>apart&#8221;<\/strong> from <strong>BASIS and HR<\/strong> could be set to &#8220;Do Not Check&#8221; so as to skip the authority-check for these authorization objects. Since <strong>SU24 <\/strong>could not be used for skipping check for HR objects, we have an option in HR Security to selectively switch off check for certain HR Authorization objects. This can be done via<\/span> tcode <strong>OOAC. <\/strong><span style=\"color: #4c4c4c;\">The &#8220;authorization switch&#8221; for HR Authorization objects can also be switched off via<\/span> table <strong>T77S0 <\/strong><span style=\"color: #4c4c4c;\">as shown in the figure below:<\/span><br \/>\n<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC.jpg\"><!--more--><\/a><\/p>\n<p><a href=\"https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC.jpg\"><br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-1007\" title=\"OOAC\" src=\"https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC.jpg\" alt=\"\" width=\"554\" height=\"378\" srcset=\"https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC.jpg 554w, https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC-300x204.jpg 300w, https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC-290x197.jpg 290w, https:\/\/sapsecurityanalyst.com\/WP\/wp-content\/uploads\/2012\/02\/OOAC-150x102.jpg 150w\" sizes=\"(max-width: 554px) 100vw, 554px\" \/><br \/>\n<\/a><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><!--more--><!--more--><\/span><\/p>\n<p><span style=\"color: #0000ff; font-family: verdana;\"><br \/>\n<span style=\"color: #4c4c4c;\">We will discuss more about the concept of HR General Authorization in the coming topics.<\/span><\/span><\/p>\n<p>&nbsp;<\/p>\n<p><!--more--><\/p>\n<p><!--more--><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"color: #e63518;\">Next &#8211; <a href=\"https:\/\/sapsecurityanalyst.com\/WP\/home\/hr-authorization-fields\" target=\"_blank\"><span style=\"color: #e63518;\"><em>HR Authorization Fields<\/em><\/span><\/a><\/span><\/h3>\n<p>&nbsp;<\/p>\n<p><!--more--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp;<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/965"}],"collection":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/comments?post=965"}],"version-history":[{"count":47,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/965\/revisions"}],"predecessor-version":[{"id":2111,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/965\/revisions\/2111"}],"wp:attachment":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/media?parent=965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}