Authority check on Tcode

Hello Experts,
Please can any one tell me, how does the code behave in the below situation.
AUTHORITY-CHECK OBJECT 'S_TCODE'
ID 'TCD' FIELD 'ZSCHECK'
Here am checking whether the user has access to this Tcode 'Zscheck.' what happens if the user has Z*(partial wild card) or *(wildcard char's) in his role.
Does the user is allowed to access the TCode or rejected?
Thanks In advance.
Also how to do the Authorization-check at the table level.
(table-maintenance) ??

Hi,
I don't see a need to check S_TCODE authorization explicitely, as it is always being checked by the system whenever you start a transaction.
Yes, Z* allows any Z-transaction, whereas * allows all transactions.
The authorization on table level is checked via S_TABU_DIS for an authorization group, which can be assigned in the table maintenance generator (SE54 or via SE11).
Cheers
Thomas

Similar Messages

Tcode for see AUTHORITY-CHECK asignement for User ?

Hi everybody
1. Does somebody knows a TCode for see an Authorization Object directly, that is i know to see them using SU21, then selecting an Authorization Class and then i see the corresponding Auth.Objetcs. But, is there a Tcode for see the Auth.Objects without see first the Auth.Classes ?
2, Is there a Tcode for see the Auth.Objects and values assigned for a user , that is, a Tcode for evaluate if an AUTHORITY-CHECK is going to be passed by an specific user-object-activity ?
For example, i have the Auth.Object 'M_MATE_WRK' wich uses the Plant (WERKS) object. Is there a Tcode wich allow me to know if a user has asigned this Auth.Object for specified Plant (WERKS) Value, and wich activities does the user has permited ?
Thanks..
Frank

Hello Frank
Call transaction SUIM (User Information System) and check the available reports there. I am sure you will find a report fulfilling your requirement.
Regards
Uwe

Authority-check for particular comp code

Hi All,
when i'm using standard Authority Object F_BKPF_BUK for a particular standard code say 'CO01'. but it is working for all company code, but i want work for only one company code say 'CO01' ONLY.i'm using in report program (zreport prog)
I written code as
AUTHORITY-CHECK OBJECT 'F_BKPF_BUK'
ID 'BUKRS' FIELD 'BE10'
ID 'ACTVT' FIELD '03'.
Please can u advice on this .
Many Thanks in Advance for u r Answer
Naren

Hi
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.
If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.
This means you have to allocate an authorization object in the definition of the transaction.
For example:
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC <> 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.
Reward points if useful
Regards
Anji

Authority Check at the T.Code level for the user in particular User Group

Hi Friends,
I have created a ZREPORT and assigned this report to a ZTRANSACTION CODE.
Need to give Authority Check at the T.Code level for the user in particular User Group.
I have searched in SCN, but not get suitable pages.
How to solve this?
Regards,
Viji.

Hi Viji.
Saha way is actual way for authority tcode but user authority in TCODE:- SE38 he/she can run report(ZREPORT) wise program is run is no authority check.
Another way is you have also check authority in program level.
DATA: T_ROLE_USERS TYPE STR_AGRS OCCURS 0 WITH HEADER LINE.
   INITIALIZATION.
CALL FUNCTION 'ESS_USERS_OF_ROLE_GET'
    EXPORTING
      ROLE       = 'ZROLE'' " Role define
    TABLES
      ROLE_USERS = T_ROLE_USERS.
READ TABLE T_ROLE_USERS WITH KEY UNAME = SY-UNAME.
   IF SY-SUBRC NE 0.
   RETURN.
   ENDIF.
Thanks & Regards
Rahul

AUTHORITY-CHECK on cost center

We have set the authorisation (using object cost center) to time admin such that they can maintain leave for certain group of the user.
The question is now how to program the abap code so that my customised leave report can validate the authorisation to ensure that when he generate the leave report, other those employees who are in the cost center that he is authorise to view is listed?
Appreciate if you can share the code.

Hi,
see the help link also.
[http://help.sap.com/saphelp_nw70/helpdata/en/9f/dbaccb35c111d1829f0000e829fbfe/content.htm]
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.

Custom Authority Check across system

Hi all
I have got an authority check requirement I need help with. I have to restrict certain users --which have a specified role- to not be able to access certain profit/cost centers in any reporting activity.
When these users run any report transaction, example" FBL3N; they do not see the profit/cost center line items (documents) which are not assigned to them.
Anyone have a solution for this?
Some thoughts i have;
1) Create an authorization field and assign a check table with the values i wish to be shown. Create an authority check statement in an enhancement on EVERY tcode.
2) Create the authorization object and assign to the user role.
Looking forward for a reply.
Points will be rewarded.
Thanks

Well did some working on it. Created an authorization class,object and assigned it the PRCTR field.
Then we assigned it at the organizational level- prctr from 201 to 201-
Then we tried FB03, document list and then tried to view documents. Unfortunately it still shows all documents regardless of the profit center being other then 201.
Am I missing something here?

How to create authority check object and assign to ztcode which is of modu

Dear ,
how to create authority check object and assign to ztcode which is of custom module pool program.its urgent kindly help points rewarded.

Manoj,
You can check with your Basis team to create authorisation object and assigining tcodes to the user profiles.
K.Kiran.

Authority check at field level in the sales order

Dear all, our business requirement is the following:
only some users should be able to see the prices (including netwr, netpr,...) in the sales order depending on the authority check performed on the sales group field.
This means that for an order of sales group 'A':
a user of sales group 'A' can see the prices and change the order, a user of sales group 'B' cannnot see the prices but can change the order, a user of sales group 'C' can display the order but cannnot see the prices.
I ask you if such a scenario can be realized in SAP.
We currently run SAP ECC 5.0.
thx all !
bye Roberto

Hi
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.
If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.
This means you have to allocate an authorization object in the definition of the transaction.
For example:
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC <> 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.
<REMOVED BY MODERATOR>
regards
Anji
Message was edited by:
Alvaro Tejada Galindo

How to make Authority Check for ALVGrid?!

Hey mates,
i got the problem which is mentioned in the headline. How can i make an authority check for my ALVGrid? I mean i want to restrict special functions to the matching users ( Display, Edit, Delete mode ).
Would be cool if someone can help
Regards Basti

Hello Bastian
A simple approach would be to define three different transactions (e.g. Z_MYALV01, Z_MYALV02, Z_MYALV03) for editing/deleting, editing only and displaying only. Add the following coding to the report displaying your ALV grid:
CASE syst-tcode.
    WHEN gc_tcode_create.    " 01
      " Allow all grid functions
    WHEN gc_tcode_change. " 02
      " Suppress grid functions for deleting rows
    WHEN gc_tcode_display. " 03
      " Suppress grid functions for editing/deleting
    WHEN others.
      RETURN.
   ENDCASE.
Regards
Uwe

How to create authority check

how to create authority check and how to apply for kunnr field near at selection-screen for validating this field, i mean is there any tcode for it becoz when i click on pattern button it ask authority check objectname (der r some inbuilt object already existing like s_carrid for airlines)

You can find out the authority objects from transaction SU21.
E.g. you can use the object V_KNA1_VKO to check the authority for given Sales Organizations.
You can find this object under the category SD.
Regards,
Naimesh Patel

How to debug a authority check in program and a authorisation object in tco

Can anyone tell me how to debug a authority check in program and a authorisation object in tcode
i just want to know the flow of authorisation object in debugging how user is assocaited with authorisation object and roles.
i know if sy-subrc ne 0 is authorisation failed ,so please help me anyone on this.
every time when i put breakpoint ,if its program level only, i am able to decide only through sy-subrc but iam unable o view the flow .

flow cannot be seen, we have to be based on sy-subrc only...
you cannot see the flow in read table... describe table... transfer...
the authorization object will be assigned to the data element, that data element has some realtion to the roles given to the users. So if the role of the user and data element value doesnt match the sy-subrc NE 0.

Urgent! Problem with authority-check

Hi all,
I encounter some wierd scenario with authority-check.
I try to run IW41 (create order confirmation) and the following authority-check
AUTHORITY-CHECK OBJECT 'C_AFKO_ATY'
       ID 'ACTVT' FIELD TMP_ACTVT
       ID 'AUTYP' FIELD ACT_AUTYP.
IF NOT SY-SUBRC IS INITIAL.
    MESSAGE E124 WITH SY-TCODE RAISING MISSING_AUTHORITY.
ENDIF.
was successful. However, when i try to run the FM CO_RI_CONFIRMATION_CREATE (use to create order confirmation), the exact same code is run and when i reach the above authority-check, it fails even if all the variable passed to the check is the same.
How can this happen? I need some help. Very urgent.

Hi Mil,
Check the values of TMP_ACTVT and ACT_AUTYP for both the cases.
May be they are different.
Reward points if useful.
Regards,
Atish

Authority Check Object

Hello Freinds,
If there is a field from custamize table for exa.(Zmara-werks )then can we use standard authority check object? or should we create custamize authority object.
Please guide me...........
Thanks,
Amar

Hi ,
To Find Authorization Object for a particular field, use TCode SU21. Click on Find button and enter the filed name to know the Authorization Object.
If suitable combination of required fields is not found in Authorization objects, new objects need to be created. Use TCode SU21 to create new authorization objects. Click on Create Button and enter new object class name and press save button.

Include authority check in PM User exit

Dear all,
Is there any user exit for adding an authority check object in IW31 transaction program?
Kindly advise.
Thanks.

Hi,
There is a Function module AUTHORITY-CHECK to check the authrization, here you can give the trnasaction code as well as the user name .. look at the function module in SE37..
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.
If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.
This means you have to allocate an authorization object in the definition of the transaction.
For example:
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC <> 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.
Reward points if useful
Regards
Ashu

RE: Authority checks included in the info set of the query

Hi all,
I am checking the program code for one of our custom tcodes and i asked ABAP team to add authority check to the program code because there is no auth check in the code and abapers told me that the authority check is included inside the info set of the query and not in the program . the program is used to execute the query in the Tcode.
how to find the Authority checks included in the info set of the query.
Thanks in advance,
Sun.

If you have the BI support roles assigned to you and the security admin roles please login to the BI system
execute transaction RSECADMIN, click on the analysis tab and execute as the user who is assigned the role with restrictions.
For variables in authorizations like ( type customer exit )
use RSECADMIN - maintain authorization tab - Click on value authorization tab.
Keytransaction is RSECADMIN & infoobject maintenance details you can get from RSD1.
Regards

Authority check on Tcode

Similar Messages

Maybe you are looking for