目录
写在前言
角色相关标准 TABLES:usr02, agr_define。。。
AGR_USERS分配角色到用户
UST04 用户角色参数文件名
角色相关BAPI:
| 'BAPI_USER_GET_DETAIL' | |
| 分配添加角色 | BAPI_USER_ACTGROUPS_ASSIGN |
| 删除角色 | BAPI_USER_ACTGROUPS_DELETE |
| 复核角色分配 | 'PRGN_RFC_CREATE_AGR_MULTIPLE' 'PRGN_RFC_ADD_AGRS_TO_COLL_AGR' |
| 获取当前用户的所有角色对象 | 'NAVIGATION_SELECT_AGRS_OF_USER' |
| 权限检查 | FUNCTION 'AUTHORITY_CHECK' |
业务需求背景
很多用户没有SAP GUI账号(涉及LICENSE) ，结合公司内部的组织架构层级管理，行业的主数据管理等特殊业务场景，开发更适应一线公司使用的权限自助申请平台，后台通过接口自动生成权限。
功能与界面UI设计
Portal前端自助申请的界面设计如下(可以自定义其他显示)：
组织架构选择：
岗位选择：
选择所有的岗位，否则历史岗位和权限会被覆盖
选择您申请权限有效期，到期后权限自动释放。
由岗位自动带出角色。
业态/业务范围选择：
选择属于哪些项目：
DDIC表对象设计
1. FI Organizational structure MASTER DATA TABLE
下面是几个角色申请维度的用户分配表，可以分配*，也可以分配其他维度。配* 有全部权限，CHECK用户权限时按优先级读取。
2. User Assign Organizational structure table
组织可以分配*，也可以分配组织层级的集团/区域/城市公司/项目公司等任一维度。
3. User Assign GSBER Table
4. User Assign Project Table
5. User Assign Postion Table
Save Entries Such AS:
接口方案设计
基于UI界面涉及到的接口大致如下：
| SeqNo | Function | Function Description |
| 1 | 组织架构接口(FI维度) | 从FI&HR模块同步公司组织架构层级(FI和HR模块都有一套组织层级管理体系 两边是拉通的，财务是区域城市公司项目公司，HR是标准OM组织编码O-O可以到一级二级部门的维度) |
| 2 | 岗位接口 | 同步HR标准的HRP1000岗位主数据接口 |
| 3 | 业态接口 | 同步公司不同业态，也就是SAP FI标准的业务范围GSBER |
| 4 | 项目主数据接口 | 最小的颗粒度。很多人员分配在项目上，只有某些项目的权限 |
| 5 | 角色接口 | 同步PFCG标准角色，通过岗位自动带出显示 |
| 6 | 角色分配接口 | 角色提交K2/OA申请通过后，角色分配接口 |
1. 组织接口
FUNCTION ZPI1000_HCODE.
*"----------------------------------------------------------------------
*"*"本地接口：
*" TABLES
*" T_TAB STRUCTURE ZPI1000_S_HCODE OPTIONAL
*"----------------------------------------------------------------------
SELECT HCODE HNAME NTYPE HTEXT NIDUP INTO TABLE T_TAB FROM ZTFI0005.
sort T_TAB ASCENDING BY HCODE.
DELETE ADJACENT DUPLICATES FROM T_TAB COMPARING HCODE.
ENDFUNCTION.
2.
FUNCTION ZPI1000_HCODE_ALL.
*"----------------------------------------------------------------------
*"*"本地接口：
*" TABLES
*" T_TAB STRUCTURE ZTFI0005 OPTIONAL
*"----------------------------------------------------------------------
SELECT * INTO TABLE T_TAB FROM ZTFI0005.
sort T_TAB ASCENDING BY HCODE.
* DELETE ADJACENT DUPLICATES FROM T_TAB COMPARING HCODE.
ENDFUNCTION.
3. 项目同步接口
FUNCTION ZPI1000_PROJ.
*"----------------------------------------------------------------------
*"*"本地接口：
*" TABLES
*" T_TAB STRUCTURE ZPI1000_S_PROJ
*"----------------------------------------------------------------------
SELECT A~PSPID A~POST1 A~VBUKR B~XMFLINTO TABLE T_TAB
FROM PROJ AS A
INNER JOIN PRPS AS B
ON A~PSPID = B~POSID.
ENDFUNCTION.
4. 用户角色分配接口
接收用户portal端选择申请的几类信息数据，调用标准BAPI CALL FUNCTION 'BAPI_USER_ACTGROUPS_ASSIGN' 实现
FUNCTION Parameters:
DDIC ELEMENTS DESIGN:
注意：每次是先删除用户原来的全部角色再覆盖
FUNCTION ZPI1000_USER_ASSIGNMENT.
*"----------------------------------------------------------------------
*"*"本地接口：
*" IMPORTING
*" VALUE(I_USER) TYPE SY-UNAME
*" EXPORTING
*" VALUE(E_MSG) TYPE STRING
*" TABLES
*" T_POST STRUCTURE ZPI1000_S_POST OPTIONAL
*" T_AGRNAME STRUCTURE ZPI1000_S_AGRNAME OPTIONAL
*" T_ORG STRUCTURE ZPI1000_S_ORG OPTIONAL
*" T_POSNR STRUCTURE ZPI1000_S_POSNR OPTIONAL
*" T_YT STRUCTURE ZPI1000_S_YT OPTIONAL
*"----------------------------------------------------------------------
DATA:LT_AGR_USERS TYPE TABLE OF AGR_USERS,
LT_ORG LIKE ZTAB0015 OCCURS 0 WITH HEADER LINE, "用户组织
LT_POSNR LIKE ZTAB0017 OCCURS 0 WITH HEADER LINE, "用户项目
LT_POST LIKE ZPI1000 OCCURS 0 WITH HEADER LINE, "用户岗位
LT_YT LIKE ZTAB0026 OCCURS 0 WITH HEADER LINE,
LS_AGR_USERS LIKE LINE OF LT_AGR_USERS,
LS_AGR_DEFINE LIKE AGR_DEFINE,
LS_USR02 LIKE USR02.
DATA: LT_INS LIKE UST04 OCCURS 0 WITH HEADER LINE.
DATA: IT_RETURN LIKE BAPIRET2 OCCURS 0 WITH HEADER LINE,
IT_BAPIAGR LIKE BAPIAGR OCCURS 0 WITH HEADER LINE.
CLEAR: E_MSG.
SELECT SINGLE ZVAL1
FROM ZTPORTAL001
INTO @DATA(LV_WAIT)
WHERE ZKEY1 = 'AUTH_WAIT'.
DO LV_WAIT TIMES.
SELECT SINGLE * INTO LS_USR02 FROM USR02 WHERE BNAME = I_USER and UFLAG = 0.
IF SY-SUBRC NE 0.
WAIT UP TO 1 SECONDS.
ELSE.
EXIT.
ENDIF.
ENDDO.
SELECT SINGLE * INTO LS_USR02 FROM USR02 WHERE BNAME = I_USER.
IF SY-SUBRC NE 0.
CONCATENATE '用户' I_USER '在系统中不存在' INTO E_MSG.
EXIT.
ENDIF.
* SELECT * FROM AGR_USERS INTO TABLE LT_AGR_USERS WHERE UNAME = I_USER.
*
* LOOP AT LT_AGR_USERS INTO LS_AGR_USERS.
* CALL FUNCTION 'PRGN_DELETE_USER_ASSIGNMENT'
* EXPORTING
* USER_NAME = I_USER
* ACTIVITY_GROUP = LS_AGR_USERS-AGR_NAME
* FROM_DATE = LS_AGR_USERS-FROM_DAT
* TO_DATE = LS_AGR_USERS-TO_DAT
** ORG_FLAG = ' '
** SHOW_ERROR_MESSAGES = 'X'
* EXCEPTIONS
* ACTGROUP_NOT_AUTHORIZED = 1
* ACTGROUP_NOT_EXISTING = 2
* ACTGROUP_ENQUEUED = 3
* OTHERS = 4.
* IF SY-SUBRC <> 0.
** Implement suitable error handling here
** E_MSG = '用户历史权限删除失败'.
* CONCATENATE '用户:' I_USER ':ICP历史权限删除失败' INTO E_MSG..
* ROLLBACK WORK.
* EXIT.
* ELSE.
* COMMIT WORK AND WAIT .
* ENDIF.
* ENDLOOP.
CHECK E_MSG IS INITIAL.
T_AGRNAME-AGR_NAME = 'B:COMM'.
APPEND T_AGRNAME.
DELETE ADJACENT DUPLICATES FROM T_AGRNAME.
LT_INS-BNAME = I_USER.
APPEND LT_INS.
LOOP AT T_AGRNAME.
IT_BAPIAGR-AGR_NAME = T_AGRNAME-AGR_NAME.
IT_BAPIAGR-FROM_DAT = SY-DATUM.
IT_BAPIAGR-TO_DAT = '99991231'.
APPEND IT_BAPIAGR.
ENDLOOP.
DO 3 TIMES.
CLEAR:IT_RETURN[],IT_RETURN,E_MSG.
CALL FUNCTION 'BAPI_USER_ACTGROUPS_ASSIGN'
EXPORTING
USERNAME = I_USER
TABLES
ACTIVITYGROUPS = IT_BAPIAGR
RETURN = IT_RETURN.
READ TABLE IT_RETURN WITH KEY TYPE = 'E'.
IF SY-SUBRC EQ 0.
CONCATENATE '用户:' I_USER ':ICP权限分配失败:' IT_RETURN-MESSAGE INTO E_MSG.
ROLLBACK WORK.
WAIT UP TO 2 SECONDS.
ELSE.
COMMIT WORK.
EXIT.
ENDIF.
ENDDO.
* CALL FUNCTION 'BAPI_USER_ACTGROUPS_ASSIGN'
* EXPORTING
* USERNAME = I_USER
* TABLES
* ACTIVITYGROUPS = IT_BAPIAGR
* RETURN = IT_RETURN.
*
* READ TABLE IT_RETURN WITH KEY TYPE = 'E'.
* IF SY-SUBRC EQ 0.
* CONCATENATE '用户:' I_USER ':ICP权限分配失败:' IT_RETURN-MESSAGE INTO E_MSG.
* ROLLBACK WORK.
* ELSE.
* COMMIT WORK.
* ENDIF.
* LOOP AT T_AGRNAME.
* CALL FUNCTION 'PRGN_ADD_USER_ASSIGNMENT'
* EXPORTING
* USER_NAME = I_USER
* ACTIVITY_GROUP = T_AGRNAME-AGR_NAME
** FROM_DATE = SY-DATUM
** TO_DATE = '99991231'
** ORG_FLAG = ' '
** SHOW_ERROR_MESSAGES = 'X'
* EXCEPTIONS
* ACTGROUP_NOT_AUTHORIZED = 1
* ACTGROUP_NOT_EXISTING = 2
* ACTGROUP_ENQUEUED = 3
* OTHERS = 4.
* IF SY-SUBRC <> 0.
** Implement suitable error handling here
** E_MSG = 'ICP用户权限分配失败'.
* CONCATENATE '用户:' I_USER ':ICP权限分配失败' INTO E_MSG..
* ROLLBACK WORK.
* EXIT.
* ELSE.
* COMMIT WORK AND WAIT .
* ENDIF.
*
* CALL FUNCTION 'PRGN_ACTIVITY_GROUP_USERPROF'
* EXPORTING
* ACTIVITY_GROUP = T_AGRNAME-AGR_NAME
* ACTION_INSERT = 'X'
** ACTION_DELETE = 'X'
* TABLES
** DEL_TAB =
* INS_TAB = LT_INS
* EXCEPTIONS
* OTHERS = 7.
* ENDLOOP.
CHECK E_MSG IS INITIAL.
LOOP AT T_POST.
LT_POST-BNAME = I_USER.
LT_POST-ZPOST = T_POST-ZPOST.
LT_POST-DATUM = SY-DATUM.
** 将岗位编码与名称拆分
SPLIT LT_POST-ZPOST AT '-' INTO DATA(LS_STR1) LT_POST-POST_CODE LT_POST-POST_NAME.
APPEND LT_POST.
ENDLOOP.
* 用户项目分配 ZTAB0017
LOOP AT T_POSNR.
LT_POSNR-UNAME = I_USER.
LT_POSNR-PS_POSNR = T_POSNR-POSNR.
APPEND LT_POSNR.
ENDLOOP.
* 用户组织分配 ZTAB0015
LOOP AT T_ORG.
LT_ORG-UNAME = I_USER.
LT_ORG-HCODE = T_ORG-ORG.
APPEND LT_ORG.
ENDLOOP.
* 用户业态分配 ZTAB0026
LOOP AT T_YT.
LT_YT-UNAME = I_USER.
LT_YT-GSBER = T_YT-GSBER.
APPEND LT_YT.
ENDLOOP.
IF T_YT[] IS INITIAL.
LT_YT-UNAME = I_USER.
LT_YT-GSBER = 'Z001'.
APPEND LT_YT.
ENDIF.
DELETE FROM ZTAB0017 WHERE UNAME = I_USER.
DELETE FROM ZTAB0015 WHERE UNAME = I_USER.
DELETE FROM ZTAB0026 WHERE UNAME = I_USER.
DELETE FROM ZPI1000 WHERE BNAME = I_USER.
MODIFY ZTAB0017 FROM TABLE LT_POSNR[].
MODIFY ZTAB0015 FROM TABLE LT_ORG[].
MODIFY ZTAB0026 FROM TABLE LT_YT[].
MODIFY ZPI1000 FROM TABLE LT_POST[].
COMMIT WORK.
ENDFUNCTION.
角色后台维护功能
如果用户在前端申请同步接口有失败的情况，需要有后台处理程序可以给运维人员补充维护。
可以做se38程序
1. 用户角色维护
*&---------------------------------------------------------------------*
*& Report ZABR007
*&---------------------------------------------------------------------*
* Program Name : ZABR007 *
* Program Title : 用户角色维护 *
* Application : *
* Description : *
* Func Spec ID : *
* Requested by : *
* Author : *
* Req Date : *
************************************************************************
* MODIFICATIONS (latest entry at the top) *
* -------------------------------------------------------------------- *
* TASK-NO DATE NAME (COMPANY) DESCRIPTION
最低0.47元/天 解锁文章
扫一扫
8663
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
