Authorisation Plugin
Since SP28 a custom plugin point is available to enable some segregation of duties for workflow responsibility maintenance.
Note that the plugin is delivered OFF by default and must be activated to be effective.
Summary
The segregation of duties plugin enables you to specify subsets of workflow responsibility groupings which can be managed by specific teams. The segregation relies on the customer having a naming convention in place for their responsibility groups as it is patterns of the name that are used to define the segregation
Example
All Journal approval groups in a company have a patter like : JOURNAL_<company code>_<level> Example : JOURNAL_US01_1
All vendor approval groups in a company have a pattern like VENDOR_<company_code> Example : VENDOR_US01
To separate the management of these approval groups you define two patterns
Journal administrators : JOURNAL_*
Vendor administrators : VENDOR_*
You can then assign appropriate security authorisation to the administrators to ensure they only manage their groups.
Important Note : The Approval Group (APP_GROUP) is the value that is checked.
Configuration
Decision tree /PROMENTA/WF_RESP_MAINT should be copied and overridden to make changes
Activation
Node STEP=CONFIG –> KEY1=AUTHS_ACTIVE
Result=ON to activate, OFF to deactivate
Group ID List
Node STEP=GROUP_LIST
This node contains the list of administrator “groups”. In the previous example this would be as shown below

Group detail
Each group must then be assigned one (or more) patterns so the system can check if the user is allowed to manage a responsibility.
In the example below the group “JOURNAL” is assigned pattern JOURNAL_*

Authorisations
The authorisations objects below are used to assign groups and permission levels to administrator users via SAP roles
Object YZYWS00001
YZYMFORMID=94500140
YZYWSKEY1=GROUP
YZYWSKEY2=<Group ID> The Group Id is taken from the group id in the decision tree above
ACTVT = 02 (for maintenance access)