InsightSAP Roles made easy

The InsightSAP suite is delivered with the following pre-defined authorization roles:

1. Product administrator
2. Group administrator 
3. Maker
4. Business end-user
5. Authorization administrator

Product administrator

Role ID – /DPS/RAINBOW_ADMIN

The product administrator is the one in-charge of setup at the Product level. The job includes configuration of the product together with setting up what activities could be used product-wide. 

The Product Administrator role should be granted to one of two employees.

Group Administrator 

Role ID – /DPS/RAINBOW_GROUP_ADMIN

Groups are an important notion within Insight Creator and Insight Publisher – Groups are used to split content by working-teams, a thing that’s achieved by InsightSAP Authorization. Therefore, almost all the authorization-objects provided by InsightSAP, use the field Group. 

As a result, people belong to the same Group will be able to share the various artifacts. By the same token, people belong to different groups, will not be able to see other Group’s artifacts. 

InsightSAP is provided w/o specific groups built-in. 

One exception is the virtual group 1MY (My Objects): By default, each Insight Creator Variant or Insight Publisher job that was created by the current user, and isn’t assigned to a specific Group, is automatically assigned to the virtual group 1MY, provided by the system. For all other users, the group field of such a report/job will remain unassigned/empty.

The various groups, needed by the organization, should be locally configured. A common convention is setting relevant SAP modules (or any related aggregation) as the basis for Group. This way, groups such as FI-CO, MM, and Logistics often can be found.

The Groups are not shared between Products and the group customization is to be done separately and specifically per Product.

The Group Administrator role should be granted to one of two employees per Group.

Creator 

Role ID – /DPS/RAINBOW_ADMIN

Makers are those who prepare Insight Creator Reports and Insight Publisher Jobs for the business end-users across the organization. The most recurring question in the topic is: “Who should be assigned as Makers in the organization”. The answer is often tricky. As InsightSAP requires very little (to none) code-writing, there is no real technical barrier preventing none-developers from being Makers. Therefore, in some organizations, one may find IT personnel (with some business understanding) handling InsightSAP as makers and in other organizations, top-users (with a bit of technical orientation) take that role – It is all about attitude. 

Makers walk around InsightSAP corridors and therefore need specific InsightSAP Authorization. The Maker role should be granted to as many employees in a Group that should build Insight Creator variants or/and Insight Publisher jobs.

Business end-users

Role ID – /DPS/RAINBOW_END_USER (a template authorizations role for end-user).

In opposed to Makers, business end-users in many cases do not even know that they are triggering InsightSAP transactions. They could not care less about who created the report/interface they are using. That’s why business end-users have no special InsightSAP role.

Instead, business end-users are given ad hoc authorization per given Insight Creator variant. 

Authorization Administrator

Role ID – /DPS/RAINBOW_AUTH_ADMIN

To understand how authorization is essential in InsightSAP, a specific role was granted to those who in-charge of InsightSAP Authorization. Authorization administrators may decide who will see what (content-wise), yet they – themselves – will not be able to see that content. Indeed, the may grant themselves the missing authorization objects (or even SAP_ALL) yet, this (traceable action)  would be a whole different story.

This way, authorization administrators may proactively force authorization checks upon business end-users who are to use a given Insight-Creator variant.

The Authorization Administrator role should be granted to one of two employees per Group.