Query: Description of security and maintaining the security table
Data security in Query is built around the custom security table /WINSHTLQ/QRSAOB, which is installed on the SAP system that stores the data to be queried. In this table, the IT/SAP administrator for the customer can specify the authorization checks on the data that users are trying to access.
The Winshuttle custom security table consists of the following fields:
- Table name: SAP Table name to be secured
- Authorization object: Assigned authorization object to be checked
- Authorization Field name: Field in the SAP table to be used for authorization check
- Authorization Field text: Text description of the field
- Authorization object text: Text description of the authorization object
You can maintain this security table by using the SAP transaction code SM30.
Note: The security table works in addition to the standard SAP user security defined for the table. If the user wants to place a further restriction on rows, you need to enter that table in the security table.
Query processing
During query creation and execution, Query performs a number of steps to restrict data access to exactly what the user is supposed to see. Query uses the Winshuttle custom security table as another security layer in which the user’s accessible Authorization objects are checked. If in a user’s SAP profile the authorization object is used and a value specified, checks are made against this value.
In the Winshuttle custom security table along with the authorization objects, the SAP table and SAP field meant for data restriction is retrieved during query processing. Authorization checks are made on the values retrieved for the SAP username and records with failed authorization are removed from the output.
Winshuttle custom security table: an example
In this screenshot, eight Authorization objects have been defined in the Winshuttle security table, with the SAP Tables and SAP Fields specified for data restriction.
Winshuttle provides certain default values in this table during the installation of the Winshuttle Function Module. The following table shows the default Authorization objects that are provided by Winshuttle.
|
SAP TABLE |
Object |
Field |
Field Description |
Auth. object text |
|
BKPF |
F_BKPF_BUK |
BUKRS |
Company Code |
Accounting Document: Authorization for Company Codes |
|
KNB1 |
F_KNA1_BUK |
BUKRS |
Company Code |
Customer: Authorization for Company Codes |
|
KNKK |
F_KNKA_KKB |
KKBER |
Credit Control area |
Credit Management: Authorization for Credit Control Area |
|
LFB1 |
F_LFA1_BUK |
BUKRS |
Company Code |
Vendor: Authorization for Company Codes |
|
SKB1 |
F_SKA1_BUK |
BUKRS |
Company Code |
G/L Account: Authorization for Company Codes |
|
EKKO |
M_BEST_EKO |
EKORG |
Purchasing Organization |
Purchasing Organization in Purchase Order |
|
EKPO |
M_BEST_WRK |
WERKS |
Plant |
Plant in Purchase Order |
|
MARC |
M_MATE_WRK |
WERKS |
Plant |
Material Master: Plants |
|
KNVV |
V_KNA1_VKO |
VKORG |
Sales organization |
Customer: Authorization for Sales Organizations |
|
VBAK |
V_VBAK_VKO |
VKORG |
Sales organization |
Sales Document: Authorization for Sales Areas |
|
VBRK |
V_VBRK_VKO |
VKORG |
Sales organization |
Billing: Authorization for Sales Organizations |
For the complete list of objects and an example, see All objects.