Hello,
We have Company Code info-object which is marked Authorization Relevant in BW (7.3).
We have Infocube which contains Company Code object and data for various Company code.
We have defined Analysis Authorization object which is restricted to show data for only Company Code "ABC" and same is assigned to user role.
Infocube contains data for various Company Codes such as "ABC" and "XYZ".
Bex query defined has Company Code in filter restricted by Authorization variable (Ready for input) and it is not used in output of query.
Bex query also has User Input filter on Cost Center which is not authorization relevant.
While running Bex query, user get selection screen with Company Code & Cost Center.
User (who is authorized for only "ABC" Company Code) keeps Company Code "BLANK" and selects Cost Center which is part of "XYZ" company code in transactional data.
When user executes, report output is shown. Even though data displayed actually belongs to "XYZ" Company Code.
After checking authorization trace, we can see that "I EQ :" authorization check is performed on Company Code. Please see screenshot below.
Our understanding - Irrespective of Authorization Relevant object used in Query or not, data displayed should be checked for all Authorization Relevant info-objects in Info-provider. So in above scenario, user should not have got output of data from Company Code to which he is not authorized. Is there anything missing in our setup?
![Auhtorization Issue.jpg]()
Kind Regards
Abhijit