Users can have roles either full access to all projects or none.
Also, if you want to control the users access to only projects with an organisational elements like company code OR plant can be done. However, if projects are coming under same organizational elements, it cannot be done.
Generally Speaking the functional Consultants will not have authorization for the transaction code "PFCG" and its BASIS persons who would handle this issue.
Following are some basic steps in creating a role and assigning it to the users. (This is with reference to IDES only).
1. Go to T-Code PFCG
2. Create a Role by giving a name say “ZPSTEST”.
3. Click on Authorization tab.
4. You will be asked to save the profile first.
5. Go to “ Change authorization data”.
6. Choose “SAP_ALL” and adopt reference.
7. Confirm “ Yes” to insert all authorization.
8. Go and expand the link “project system”.
9. Expand the link “ PS: Project Manager for Project Definition”.
10. Here you will see two fields “ Activity for Authorization che” and Number of responsible per”.
11. Click on change button on the first field.
12. Here click on “Cancel full authorization”.
13. Now, here you can choose what all functions you want to assign for this authorization Role.
14. Choose say “ Display” and save.
15. Click on “ Number of responsible person” and choose any person , say “ XYZ”.
16. Now the authorization role is ready. This setting will ensure that any person who is assigned this role will only be able to “Display” the projects , if the responsible person is “XYZ”.
17. Go back to the pervious screen. In the process” Generate” the profile also.
18. Once you are in “Change Roles” Screen, go to tab “USER”. Here you can assign this role ZPSTEST to various users.
Try to experiment with authorizations in IDES by creating a Dummy user and assigning a Authorization profile to him.
If still in doubt, please take help from your BASIS person.
