Pelssers Davy
[email protected]
Pagina 1
12/11/2012
How to restrict access to “Direct Links” or d”Direct link Groups” via
UIU_COMP?
If you logon to the CRM 7.0 system, using the standard delivered business role
“SALESPRO”, you will normally see the following direct link groups:
In the screenshot you can see that
there are 2 direct Link Groups in the
navigation bar.


Create
Recent Items
How can you find this back in Customizing?
In the SAP IMG (SPRO), use the following path:
SAP IMG >> Customer Relationship Management >> UI Framework >> Business
Roles >> Define Business Role
Pelssers Davy
[email protected]
Pagina 2
12/11/2012
Select the Business Role “SALESPRO” and open the folder “Adjust Direct Link
Groups” on the left side of the configuration screen.
You can recognize the two “Direct Link Groups”, and also see that they are marked as
‘visible’. As such they do appear when you logon with this business role SALESPRO.
Within the ‘direct link group SLS-CREATE’ you can see that the following direct
links are defined:
Again, you should notice that these direct links that are marked as ‘visible’ can be
directly accessed in the WEB UI.

One way to remove the direct link for EVERY USER having the business role
SALESPRO would be to remove the entry, or at least ‘unflag’ the entry from
being visible.
Pelssers Davy
[email protected]

Pagina 3
12/11/2012
A second way is to disallow the access based on the authorization values
maintained in the authorization object UIU_COMP.
Based on the following SQVI Query, we can directly find back all relevant details for
UIU_COMP, by simply entering the name of the Business Role, e.g. SALESPRO.
Table Name
CRMC_UI_PROFILE
CRMC_UI_NB_A_DLG
CRMC_UI_ROLE_DLG
CRMC_UI_LLINK_T
CRMC_UI_LLINK
CRMC_UI_COMP_IP
Information stored
Contains the link between Business role and Navigation
Bar Profile
Contains the link between Navigation Bar Profile and
related Direct Link groups
Link between the direct link group and the direct links
Contains the Texts of the Logical Link IDs
Contains the link between the Logical Link ID and the
Target ID
Contains the necessary data for UIU_COMP
(component/Window/Inbound Plug)
Pelssers Davy
[email protected]
Pagina 4
12/11/2012
Query selection of Input/Output fields:
Field
Business
Role
Nav. Bar
Profile
Group ID
Position
Logical
Link ID
Link Visible
in Dir. Link
Group
Link
Deleted
Language
Key
Title
Component
Name
Window
Name
Target ID
Inbound
Plug
UI Object
Type
UI Action
Table
CRMC_UI_PROFILE
Input
X
Output Tech. Name
X
PROFILE
CRMC_UI_PROFILE
X
X
CRMUI_NAVBAR
CRMC_UI_NB_A_DLG X
CRMC_UI_NB_A_DLG
CRMC_UI_ROLE_DLG X
X
X
X
GROUP_ID
POSITION
LINK_ID
CRMC_UI_ROLE_DLG X
X
VISIBLE
CRMC_UI_ROLE_DLG X
X
DELETED
CRMC_UI_LLINK_T
X
LANGUAGE
CRMC_UI_LLINK_T
CRMC_UI_COMP_IP
X
X
TITLE
COMPONENT
CRMC_UI_COMP_IP
X
WINDOW
CRMC_UI_COMP_IP
CRMC_UI_COMP_IP
X
X
TARGET_ID
INBOUND_PLUG
CRMC_UI_COMP_IP
X
OBJECT_TYPE
CRMC_UI_COMP_IP
X
OBJECT_ACTION
X
When I run the Query for the Business Role SALESPRO, I see the following results:
Pelssers Davy
[email protected]
Pagina 5
12/11/2012
Practical Example 1
As seen earlier, when you logon as a user having the Business Role SALESPRO, the
“direct link groups” and their respective “direct links” are the following:
Based on the Query I now can easily found out the technical details necessary to
restrict access to one or more of these logical links for the authorization object
UIU_COMP.
Direct Link
Group
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
Direct Link Group
ID
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
Direct Link Title
Opportunity
Quotation
Contact
Lead
Appointment
Interaction Log
E-Mail
Task
Component
Name
BT111M_OPPT
BT115QM_SLSQ
BP_CONT_MAIN
BT108M_LEA
BT110M_ACT
BT110M_ACT
BT110M_ACT
BT110M_ACT
Suppose I only want the Call Center Agent to use/create:
 Contact
 Appointments
 Interaction Logs.
Window
Name
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
Inbound Plug
CREATE
CREATE
CREATE
CREATE
CREATE_APPT
CREATE_CALL
CREATE_MAIL
CREATE_TASK
Pelssers Davy
[email protected]
Pagina 6
12/11/2012
In my PFCG authorization role Z_CRM_UIU_SLS_PROFESSION_A, which is made
as a copy of the standard PFCG role SAP_CRM_UIU_SLS_PROFESSIONAL; I
remove the following entries, marked in red:
Direct Link
Group
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
CREATE
Direct Link Group
ID
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
SLS-CREATE
Direct Link Title
Opportunity
Quotation
Contact
Lead
Appointment
Interaction Log
E-Mail
Task
Component
Name
BT111M_OPPT
BT115QM_SLSQ
BP_CONT_MAIN
BT108M_LEA
BT110M_ACT
BT110M_ACT
BT110M_ACT
BT110M_ACT
Window
Name
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
MainWindow
Inbound Plug
CREATE
CREATE
CREATE
CREATE
CREATE_APPT
CREATE_CALL
CREATE_MAIL
CREATE_TASK
Remark: make sure you do NOT have an authorization value having all * values, like
below. You have to ‘deactivate’ this.
Now I search for the 5 authorization value combinations that I need to remove, and
delete them.
&
&
This particular ‘value range’ I changed into two authorization values that now look
like this:
Pelssers Davy
[email protected]
Pagina 7
12/11/2012
and
Make sure that you open the ‘component name’ values; in order to see if they are
maintained here…..it can be difficult to find them back 
You will notice that removing these entries has an effect on other parts of the
Navigation. When you would press on the navigation link ‘LEADS’ in the Work
Center Sales Cycle, you jump to the SEARCH PAGE.
But on that SEARCH PAGE, you will normally also have a “NEW” button, which is
actually the ‘create’ button, if you want to create a new lead.
After pressing the Navigation Link
“leads” in the workcenter ‘Sales
Cycle’, you will jump to the search
page for Leads; where you
normally see the “NEW” button in
order to create new leads.
Pelssers Davy
[email protected]
Pagina 8
12/11/2012
After making the changes in my PFCG role Z_CRM_UIU_SLS_PROFESSION_A,
I log on with my test user that has the adjusted authorization role, and see the
following:
DIRECT LINKS:
I also check the impact in the Work Center “Sales Cycle”.
I still have my navigation link
that direct to the search page
of “Leads”, which is OK.
Pelssers Davy
[email protected]
Pagina 9
12/11/2012
Clicking on the navigation link itself, I jump to the search page and see that the
“NEW” button is still there.
Now, strictly seen, this should NOT be the case, but when I was at SAP Walldorf AG
concerning CRM 7.0 security, I was told that SAP had not yet foreseen a completely
consistent logic for all buttons.
It does work on some parts however: (see Practical Example 2)


Business Partner Master Data (create buttons for Individual Account/Groups etc)
Marketing and Campaign Management area
Practical Example 1
If we take a closed look at the Work Center Account Managent, you will see the
following second level navigation links.
If you next click on the link ‘accounts’ you should normally see 3 ‘create’ buttons,
related to business partner Master Data.
Pelssers Davy
[email protected]
Pagina 10
12/11/2012
Here you see 3 buttons to create a specific type of Business partner in the system.



Corporate Account
Individual Account
Group
Furthermore you also see that the option to create Business Partners of the above type
is possible via the Work Center Page of Account Management itself:
Possible Scenarios:
A) You have a scenario where you do not want users with a specific Business role
to ‘create’ any business partner, but only search/display them.
B) You have a scenario where you want users with a specific business role, only
be able to create ‘individual accounts’, but no corporate account or Groups.
Pelssers Davy
[email protected]
Pagina 11
12/11/2012
Step 1: Identify what the UIU_COMP values are for the ‘create’ actions.
When you press for example on the button ‘Corporate Account’, you jump to the
creation page for ‘corporate accounts’.
If you press the button F2 on this screen, you get technical details on this View.
Running the Query for ‘logical links for a Business Role’ and filtering on UI
Component, I see the following:
Pelssers Davy
[email protected]
Pagina 12
12/11/2012
Another option here is that searching directly in the customizing table
CRMC_UI_COMP_IP, which actually contains all TARGET IDs and the relevant
UIU_COMP data you need to restrict access, you can also try searching the following
way:
Input parameters:
 Object Action = D (create)
 Component : BP*
 Target ID: MD-BP*
This results in the following output:
It is now obvious that the entries in yellow colour are actually the ones you might
want to restrict access to.
Pelssers Davy
[email protected]
Pagina 13
12/11/2012
Step 2: I will now adjust my PFCG role Z_CRM_UIU_SLS_PROFESSION_A
which is a copy of the standard PFCG role
SAP_CRM_UIU_SLS_PROFESSIONAL.
In my copied role, I find back the above entry. When I deactivate it; and logon with
my test-user I now see the following:
Check 1: Account Page – CREATE Buttons
The buttons for CREATION are now ‘greyed out’, meaning I can not use them!!
>> Result is as expected!
Check 2: the Work Center Page creation options
The entries to create a corporate account, Individual account or Group also
disappeared here, which is correct!
Pelssers Davy
[email protected]
Pagina 14
12/11/2012
What I have illustrated above is actually scenario A.
I now reactivate the authorization values, but remove ‘corporate account and group’
and see the results, but should be able to create ‘individual accounts’.
So I delete the following Inbound Plugs:
CREATE_CORP
CREATE_GROUP
Check 1: Account Page – Creation Buttons
OK, as I have the ‘activated’ button again.
Check 2: Work Center Page
This is also fine as I have the additional navigation link for ‘individual account’.