Workitems being created under different usernames

[Andy Curtis]

I've seen this in SRM. Authorisation that it was failing on was a PLOG or
PLOGI thing!

Andy



>
> ---------- Forwarded message ----------
> From: "Mike Pokraka" <wug at workflowconnections.com>
> To: "SAP Workflow Users' Group" <sap-wug at mit.edu>
> Date: Tue, 16 Mar 2010 13:00:34 -0000 (GMT)
> Subject: Re: Workitems being created under different usernames
> Interesting!
> Well in that case I'd suggest two alternatives:
>
> - Use a 'determine agents' step that calls RH_GET_ACTORS in background
> instead of using a rule on the step.
>
> - If you want to avoid a background step you could cde the agent
> determination as a functional method that bypasses auth checks (e.g. by
> doing direct table reads, possibly calling the rule thereafter) and insert
> that as an agent expression on your step. If you haven't used WF-OO, don't
> worry because there's no need for the any of the workflow-specific stuff
> for classes/objects aren't stored in the container. Just code a static
> method that returns your agent parameter and plug it into the expression.
>
> Cheers,
> Mike
>
>
> On Tue, March 16, 2010 3:32 am, Rick Bakker wrote:
> > Hi Mike,
> >
> > I made sure Advance with Dialog was turned off both for the step in
> > question and the preceding step. I also turned off Advance with Dialog
> > at the workflow header. And I looked at 'User context' in the classic
> > view. It still says the step is being created by the actual agent of
> > the previous step.
> >
> > I then changed the agent determination to a test fm which does nothing
> > but check SY-UNAME and determine the agent based on that. Again, the
> > result was as expected - the preceding actual agent is executing the
> > rule. It could be that SAP is overwriting SY-UNAME but I did notice
> > before that the authorization problems that certain users were having
> > with the AC rule disappeared when authorizations were added, and
> > reappeared when they were taken away again.
> >
> > So I conclude that the rule is run by the preceding actual agent, even
> > without advance with dialog.
> >
> > cheers
> > Rick Bakker
> > Hanabi Technology
> >
> > On Tue, Mar 16, 2010 at 12:20 AM, Mike Pokraka
> > <wug at workflowconnections.com> wrote:
> >> Just to state the obvious: did you switch it off for the previous step?
> >> Failing that, try disabling it at the workflow header just to test.
> >> I vaguely remember having problems in this area before - but that was
> >> some
> >> time ago.
> >>
> >> Another thing: Don't take the log at face value. It will show you the
> >> user
> >> under which it pretends to execute, even though the actual session may
> >> differ. Look at the technical log and switch to the old-style technical
> >> log & expand the steps. Then scroll all the way across to the right and
> >> the column 'User context' will show you the real user.
> >>
> >> To further confuse, some bits are workflow aware and will perform auth
> >> checks according to the current workflow agent, whereas others will use
> >> SY-UNAME, which may be different. (But don't always trust SY-UNAME
> >> either,
> >> because I've seen SAP code occasionally overwrite SY-UNAME in order to
> >> impersonate dialog users in a bacground process).
> >>
> >>
> >>
> >> On Mon, March 15, 2010 10:59 am, Rick Bakker wrote:
> >>> Thanks Ramki and Mike, I admit I didn't think of that. But, it doesn't
> >>> work!
> >>> Workitems are still created by the actual agent of the previous
> >>> workitem, even after SWU_OBUF.
> >>>
> >>> On Mon, Mar 15, 2010 at 8:40 PM, Mike Pokraka
> >>> <wug at workflowconnections.com> wrote:
> >>>> Rick,
> >>>>
> >>>> Creating the next work item within the current user's context
> >>>> facilitates
> >>>> advance in dialog. I think switching that off for the step involved
> >>>> should
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.mit.edu/pipermail/sap-wug/attachments/20100316/9619f62a/attachment.htm