<html><div style='background-color:'><DIV>
<P>Tomasz,</P>
<P>I have tested the functionality that allows Possible Agents to be defined on basis of security roles, there is a slight problem at the moment which we are trying to resolve : If the actual agent has an "indirect" version of the "direct" role been assigned to the task then he will not be able to acces the task, namely he will not be recognised as one of the possible agents.</P>
<P>The second problem we had was that in this scenario, when the selected agent is not recognised as a potential agent (although he should in this case), the task is sent to all Possible Agents with the consequences you can imagine.</P>
<P>Thierry Logiest <BR><BR></P></DIV>
<DIV></DIV><BR><BR><BR>
<DIV align=left> </DIV>
<DIV></DIV>
<DIV></DIV>
<DIV></DIV>
<DIV></DIV>>From: "Zmudzin,Tomasz,VEVEY,GL-DS/DM" <TOMASZ.ZMUDZIN@NESTLE.COM>
<DIV></DIV>>Reply-To: SAP Workflow Users' Group <SAP-WUG@MITVMA.MIT.EDU>
<DIV></DIV>>To: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Subject: Re: AW: How can I disable the SAP office forwarding under SAP 4.6 c
<DIV></DIV>>Date: Tue, 4 Jun 2002 17:32:13 +0200
<DIV></DIV>>
<DIV></DIV>>Folks,
<DIV></DIV>>
<DIV></DIV>>you already know I'm stubborn, so let me defend my proposal:
<DIV></DIV>>
<DIV></DIV>>- Agreed, sometimes you need to make a compromise and make a task like such
<DIV></DIV>>general.
<DIV></DIV>>
<DIV></DIV>>- Still, if we talk about good design practices, going forward with jobs to
<DIV></DIV>>specify Group A will do fine. That's what jobs are created for -- they
<DIV></DIV>>determine your responsibilities in the organization. I know it's often hard
<DIV></DIV>>to push this through, especially in existing installations. But then I'd
<DIV></DIV>>argue that if you already have 800 jobs, a new one for a "Approver of..."
<DIV></DIV>>will not hurt, but may actually bring you closer to a clean,
<DIV></DIV>>well-maintainable design. It's not the number that counts, but rather the
<DIV></DIV>>structure of the content.
<DIV></DIV>>
<DIV></DIV>>- AND HERE'S THE REAL CATCH:
<DIV></DIV>>I've seen some EBP workflows in which Group A has been specified by... user
<DIV></DIV>>role (NOT what we maintain in PFAC, but the one used by security folks to
<DIV></DIV>>define user authorizations, menus etc. -- object type 'AG'). So if you have
<DIV></DIV>>an elementary security role that controls the access to your functionality,
<DIV></DIV>>and assign this role to your task, all the folks who have authorizations to
<DIV></DIV>>perform a task are automatically assigned to Group A. I admit I haven't
<DIV></DIV>>tested this kind of setup in plain old R/3, but I expect this should work
<DIV></DIV>>OK. And I believe this is perfect from the maintenance point of view.
<DIV></DIV>>
<DIV></DIV>>In other words I agree that we need to respect the reality and that we
<DIV></DIV>>cannot argue with the way a specific system is set up. Still, if we have
<DIV></DIV>>some options, we should at least investigate the nice ones and try to use
<DIV></DIV>>the cleanest approach possible.
<DIV></DIV>>
<DIV></DIV>>With my warm greetings and kind regards,
<DIV></DIV>>Tomasz.
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>-----Original Message-----
<DIV></DIV>>From: Thomas Maue [mailto:TMaue@sial.com]
<DIV></DIV>>Sent: Tuesday, June 04, 2002 4:47 PM
<DIV></DIV>>To: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Subject: Re: AW: How can I disable the SAP office forwarding under SAP
<DIV></DIV>>4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Tomasz,
<DIV></DIV>>
<DIV></DIV>>I agree with Stephan - in a lot of cases you cannot
<DIV></DIV>>determine all the possible agents (your group A). What if
<DIV></DIV>>you are using a role to derive selected agents (your group
<DIV></DIV>>B). For example, a simple role using document data (for a
<DIV></DIV>>user ID) and then finding the manager (Org Structure) of
<DIV></DIV>>that user. If you had 1000 possible document user ID's you
<DIV></DIV>>would have to resolve each one manually to find the possible
<DIV></DIV>>agents that need to be manually assigned to the task.
<DIV></DIV>>
<DIV></DIV>>This would be a maintenance nightmare. You would have to
<DIV></DIV>>make 1000 assignments and continually update. Positions are
<DIV></DIV>>usually one to one with users so this does not help. Jobs
<DIV></DIV>>can save some effort but in the above example the job is not
<DIV></DIV>>relevant so you might only have 800 assignments.
<DIV></DIV>>
<DIV></DIV>>A general task assignment is really the only way to go in a
<DIV></DIV>>lot of situations.
<DIV></DIV>>
<DIV></DIV>>Regards,
<DIV></DIV>>
<DIV></DIV>>Thomas Maue
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>> "Becker Stephan (extern)"
<DIV></DIV>>
<DIV></DIV>> <STEPHAN.BECKER.EXT@MCHW. DIV < To:>>SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>> siemens.de> cc:
<DIV></DIV>>
<DIV></DIV>> Sent by: SAP Workflow Subject: AW: How can
<DIV></DIV>>I disable the SAP office forwarding
<DIV></DIV>> <OWNER-SAP-WUG@MITVMA.MIT DIV < c 4.6 SAP under>>
<DIV></DIV>> .EDU>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>> 06/04/02 09:50 AM
<DIV></DIV>>
<DIV></DIV>> Please respond to "SAP
<DIV></DIV>>
<DIV></DIV>> Workflow Users' Group"
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Gotcha, man, you're on the right track, the thing is just
<DIV></DIV>>that EVERYONE is
<DIV></DIV>>potentially in group A, so there's no point to make any
<DIV></DIV>>assignments other
<DIV></DIV>>than a general task assignment there..
<DIV></DIV>>
<DIV></DIV>>-----Urspr|ngliche Nachricht-----
<DIV></DIV>>Von: Zmudzin,Tomasz,VEVEY,GL-DS/DM
<DIV></DIV>>[mailto:Tomasz.Zmudzin@nestle.com]
<DIV></DIV>>Gesendet: Dienstag, 4. Juni 2002 12:45
<DIV></DIV>>An: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Betreff: FW: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>... and being so stubborn I'd just add that indeed you need
<DIV></DIV>>to specifically
<DIV></DIV>>assign all the possible Group B users as belonging to Group
<DIV></DIV>>A which may seem
<DIV></DIV>>impossible at the first look in a large installation -- but
<DIV></DIV>>again naming
<DIV></DIV>>them via jobs & positions will save the day.
<DIV></DIV>>
<DIV></DIV>>Kind regards -- and I promise to stop bombing you for a
<DIV></DIV>>while,
<DIV></DIV>>Tomasz
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>-----Original Message-----
<DIV></DIV>>From: Zmudzin,Tomasz,VEVEY,GL-DS/DM
<DIV></DIV>>Sent: Tuesday, June 04, 2002 12:36 PM
<DIV></DIV>>To: 'SAP Workflow Users' Group'
<DIV></DIV>>Subject: RE: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Yes -- but I think we're still talking about two different
<DIV></DIV>>things... From
<DIV></DIV>>the functional point of view the agents for a task are
<DIV></DIV>>determined by
<DIV></DIV>>checking three groups of agents:
<DIV></DIV>>
<DIV></DIV>>Group A: All the allowed agents of the task. If a task is
<DIV></DIV>>"general", this
<DIV></DIV>>are all system users. If it's not, these are all the agents
<DIV></DIV>>assigned in to
<DIV></DIV>>the task in the assignment (PFTC--> Additional Data -->
<DIV></DIV>>Agent assignment).
<DIV></DIV>>This is static, cannot be changed at run-time. And this is
<DIV></DIV>>specified at task
<DIV></DIV>>level -- no matter in which workflow you use the task, it
<DIV></DIV>>will have the same
<DIV></DIV>>allowed agents.
<DIV></DIV>>
<DIV></DIV>>Group B: Those specified in the "Agents" section of the task
<DIV></DIV>>within
<DIV></DIV>>workflow. This is dynamic (e.g. via role or container
<DIV></DIV>>element) and can be
<DIV></DIV>>determined / altered at runtime.
<DIV></DIV>>
<DIV></DIV>>Group C: Those specified in the "Excluded" section of the
<DIV></DIV>>task within
<DIV></DIV>>workflow (dynamic)
<DIV></DIV>>
<DIV></DIV>>Now finally the agents for a task are determined as those
<DIV></DIV>>belonging to Group
<DIV></DIV>>A _AND_ Group B, but _NOT_ belonging to Group C. Thus if we
<DIV></DIV>>talk about
<DIV></DIV>>authorizations, we can model them by using the agent
<DIV></DIV>>assignments (Group A).
<DIV></DIV>>This is static, shared across workflows -- just as
<DIV></DIV>>authorizations are. Users
<DIV></DIV>>that don't belong to group A will not be able to execute an
<DIV></DIV>>item.
<DIV></DIV>>
<DIV></DIV>>In your e-mail you're probably referring to Group B -- this
<DIV></DIV>>can be
<DIV></DIV>>determined dynamically at run-time based on document content
<DIV></DIV>>etc., on a
<DIV></DIV>>per-process instance basis. So this is where you try to
<DIV></DIV>>determine your
<DIV></DIV>>agents based on config tables, responsibilities, document
<DIV></DIV>>content etc.
<DIV></DIV>>Because in the end only those belonging both to A and B will
<DIV></DIV>>be picked, A
<DIV></DIV>>still acts like authorizations. And finally Group C is
<DIV></DIV>>subtracted, the same
<DIV></DIV>>way.
<DIV></DIV>>
<DIV></DIV>>So in our particular problem we can still specify our agents
<DIV></DIV>>dynamically for
<DIV></DIV>>Group B (using frequently-changing tables, responsibilities
<DIV></DIV>>etc.). But --
<DIV></DIV>>instead of making the task general (Group A = all), we
<DIV></DIV>>assign it to the
<DIV></DIV>>allowed users only. Then you set the task attributes to
<DIV></DIV>>"General forwarding
<DIV></DIV>>not allowed", and we still have the very dynamic agent
<DIV></DIV>>determination, but
<DIV></DIV>>the task can be only forwarded to those you trust.
<DIV></DIV>>
<DIV></DIV>>Or did I get it wrong?
<DIV></DIV>>
<DIV></DIV>>BR - Tomasz
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>-----Original Message-----
<DIV></DIV>>From: Becker Stephan (extern)
<DIV></DIV>>[mailto:Stephan.Becker.ext@mchw.siemens.de]
<DIV></DIV>>Sent: Tuesday, June 04, 2002 12:06 PM
<DIV></DIV>>To: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Subject: AW: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Thomasz, my point was that in many approval situations, you
<DIV></DIV>>CANNOT determine
<DIV></DIV>>possible agents at definition time (other than saying it's a
<DIV></DIV>>general task)
<DIV></DIV>>as the possible agents are determined at runtime, from
<DIV></DIV>>document data, using
<DIV></DIV>>tables and/or other settings that change frequently in the
<DIV></DIV>>production
<DIV></DIV>>system.
<DIV></DIV>>
<DIV></DIV>>-----Urspr|ngliche Nachricht-----
<DIV></DIV>>Von: Zmudzin,Tomasz,VEVEY,GL-DS/DM
<DIV></DIV>>[mailto:Tomasz.Zmudzin@nestle.com]
<DIV></DIV>>Gesendet: Dienstag, 4. Juni 2002 11:52
<DIV></DIV>>An: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Betreff: Re: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>But in this case you can define the allowed agents for this
<DIV></DIV>>task, and
<DIV></DIV>>restrict forwarding to these agents only. Not only will this
<DIV></DIV>>solve the
<DIV></DIV>>problem of forwarding restriction, but also will guard you
<DIV></DIV>>against possible
<DIV></DIV>>mistakes in the dynamic determination of agents...
<DIV></DIV>>
<DIV></DIV>>I somehow believe that the allowed agent assignment is often
<DIV></DIV>>underutilized... It's just a great mechanism to implement
<DIV></DIV>>authorization-like
<DIV></DIV>>restrictions for workflow tasks.
<DIV></DIV>>
<DIV></DIV>>Kind regards,
<DIV></DIV>>Tomasz
<DIV></DIV>>
<DIV></DIV>>-----Original Message-----
<DIV></DIV>>From: Becker Stephan (extern)
<DIV></DIV>>[mailto:Stephan.Becker.ext@mchw.siemens.de]
<DIV></DIV>>Sent: Tuesday, June 04, 2002 11:11 AM
<DIV></DIV>>To: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Subject: AW: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>For example: say there is no way to restrict agent
<DIV></DIV>>assignment at definition
<DIV></DIV>>time, because agents are determined dynamically at runtime
<DIV></DIV>>(e.g. for signing
<DIV></DIV>>of invoices), for example from movement data that changes
<DIV></DIV>>all the time, but
<DIV></DIV>>you still want to prohibit forwarding because signatory
<DIV></DIV>>authorisation is
<DIV></DIV>>linked to the person only..
<DIV></DIV>>
<DIV></DIV>>-----Urspr|ngliche Nachricht-----
<DIV></DIV>>Von: Zmudzin,Tomasz,VEVEY,GL-DS/DM
<DIV></DIV>>[mailto:Tomasz.Zmudzin@nestle.com]
<DIV></DIV>>Gesendet: Dienstag, 4. Juni 2002 11:05
<DIV></DIV>>An: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Betreff: Re: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Out of sheer curiosity -- if a task is general (i.e. can be
<DIV></DIV>>performed by
<DIV></DIV>>anyone, even if it normally lands in specific inboxes) --
<DIV></DIV>>why would we want
<DIV></DIV>>to prohibit forwarding?
<DIV></DIV>>
<DIV></DIV>>To my simple mind it looks as if it would make sense to
<DIV></DIV>>prohibit it only if
<DIV></DIV>>you have certain users allowed to perform it. Then you could
<DIV></DIV>>still
<DIV></DIV>>distinguish between allowing forwarding to allowed agents
<DIV></DIV>>only or to the
<DIV></DIV>>general user community. Or am I missing something
<DIV></DIV>>not-so-obvious?
<DIV></DIV>>
<DIV></DIV>>Kind regards,
<DIV></DIV>>Tomasz
<DIV></DIV>>
<DIV></DIV>>-----Original Message-----
<DIV></DIV>>From: Becker Stephan (extern)
<DIV></DIV>>[mailto:Stephan.Becker.ext@mchw.siemens.de]
<DIV></DIV>>Sent: Tuesday, June 04, 2002 10:37 AM
<DIV></DIV>>To: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Subject: AW: How can I disable the SAP office forwarding
<DIV></DIV>>under SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Good question.. for some reason probably only known to SAP,
<DIV></DIV>>you cannot have
<DIV></DIV>>a general task and disallow forwarding at the same time.. if
<DIV></DIV>>that is no
<DIV></DIV>>problem for you, set "general forwarding not allowed" in the
<DIV></DIV>>attributes of
<DIV></DIV>>the agent maintenance of the TS. If it is a problem, I have
<DIV></DIV>>in the past
<DIV></DIV>>chosen the (admittedly somewhat cloodgy but effective)
<DIV></DIV>>approach to check in
<DIV></DIV>>the method if the agent before and after method execution
<DIV></DIV>>are the same, and
<DIV></DIV>>to trigger an exception that is then in the builder
<DIV></DIV>>evaluated in a loop that
<DIV></DIV>>just creates the item again for the user (with a message
<DIV></DIV>>beforehand
<DIV></DIV>>informing the user about the rule).
<DIV></DIV>>
<DIV></DIV>>Hth,
<DIV></DIV>>Stephan
<DIV></DIV>>
<DIV></DIV>>-----Urspr|ngliche Nachricht-----
<DIV></DIV>>Von: Vincze Arpad [mailto:Arpad.Vincze@itelligence.hu]
<DIV></DIV>>Gesendet: Dienstag, 4. Juni 2002 10:26
<DIV></DIV>>An: SAP-WUG@MITVMA.MIT.EDU
<DIV></DIV>>Betreff: How can I disable the SAP office forwarding under
<DIV></DIV>>SAP 4.6 c
<DIV></DIV>>
<DIV></DIV>>
<DIV></DIV>>Hello Workflowers,
<DIV></DIV>>
<DIV></DIV>> I would like to disable the SAP office forwarding for
<DIV></DIV>>workitems!
<DIV></DIV>> How can I do it?
<DIV></DIV>>
<DIV></DIV>> Is there any hint?
<DIV></DIV>>
<DIV></DIV>> Regards:
<DIV></DIV>> Arpad
<DIV></DIV>>
<DIV></DIV>>Vincze Arpad
<DIV></DIV>>itelligence Hungary Kft.
<DIV></DIV>>H-1138 Budapest, Vaci zt 141
<DIV></DIV>>Tel.: (+36 1) 452 3822
<DIV></DIV>>Fax: (+36 1) 452 3839
<DIV></DIV>>Mobil: (+36 20) 9 533 578
<DIV></DIV>>arpad.vincze@itelligence.hu
<DIV></DIV></div><br clear=all><hr>Send and receive Hotmail on your mobile device: <a href='http://g.msn.com/1HM500901/156'>Click Here</a><br></html>