Authorization check for a program/table

Hi ,
Can anyone help me out in
   How to do authorization check for an abap program and also a table.
   I have no idea about the authorizations.
My requirement is that I need to do the authorization check in such a manner that only users having a certain profile
1. should be able to execute the program
2. View of the entries of the table.
Thanks & Regards,
Keerthi

Hello Keerhi ,
I got you wrong at first!
If you want to have only certain users to be able to do certain operations, then you need to assign the appropriate roles to those users!
First find the role
second add the user in the role ( PFCG T code---> USers tab)
Raj

Similar Messages

  • Authorization check for a program (Not SAP standard) from SA38(End user )

    Hi All,
    I have a requirement which involved in restricting the user to execute the program using SA38.Please suggest me.
    I went to SU20 but could not find the right way how to do?
    Thanks in advance

    1) check authority  object  for  field  for  whcich  u  want  to check  authority  is  present  or  not
    for  this  use transaction su20 /su21
    2)if  it  is  not  u create  object   by using su21.
    3)after that in programm use fm AUTHORITY-CHECK OBJECT .
    ex---AUTHORITY-CHECK OBJECT 'V_LIKP_VST'
    ID 'VSTEL' FIELD t_sel-vstel
    ID 'ACTVT' FIELD '01'
    ID 'ACTVT' FIELD '02'
    ID 'ACTVT' FIELD '03'
    ID 'ACTVT' FIELD '04'
    ID 'ACTVT' FIELD '18'
    ID 'ACTVT' FIELD '24'
    ID 'ACTVT' FIELD '25'
    ID 'ACTVT' FIELD '85'.
    IF sy-subrc <> 0.
    t_authority-vstel = t_sel-vstel.
    APPEND t_authority.
    CLEAR t_authority.

  • Special authorization need for read cluster table??

    In one report, I use following coding to read information from RFDT table:
    form get_f110_parm .
      f110id-laufd   = p_laufd.
      f110id-laufi   = p_laufi.
      f110versionpar = space.
      clear:   buktab, fkttab, slktab, sldtab, trctab, usrtab,
               faetab, jobtab, f110v, f110c,  trcopt, f110versionpar.
      import buktab fkttab slktab sldtab trctab usrtab
             faetab jobtab f110c trcopt f110versionpar
             from database rfdt(fb) id f110id
             accepting padding.
    endform.                    " GET_F110_PARM
    I can fill F110c, trcopt and f110versionpar by this program. But there is no entry in table like fkttab, usrtab.
    Is there any authorization need for read cluster table??
    Thanks in advance.
    Edited by: Amy Xie on Dec 21, 2010 10:41 AM

    Hello,
    After you run your code, check transaction SU53 to see if any authorization check failed.

  • Authorization check For T code

    Hi everyone,
    Can anybody guide to set a  authorization check  for a particular Tcode.
    I have ztable where users are assigned particular numbers.
    I want the users who are assigned some numbers should be able to use this particular t code
    Thanks in advance

    hi
    chk this out
    AUTHORITY-CHECK
    Basic form
    AUTHORITY-CHECK OBJECT object
        ID name1  FIELD f1
        ID name2  FIELD f2
        ID name10 FIELD f10.
    Effect
    Explanation of IDs:
    object
    Field which contains the name of the object for which the authorization is to be checked.
    name1 ...
    Fields which contain the names of the
    name10
    authorization fields defined in the object.
    f1 ...
    Fields which contain the values for which the
    f10
    authorization is to be checked.
    AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).
    You must specify all authorizations for an object and a also a value for each ID (or DUMMY).
    The system checks the values for the IDs by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.
    If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.
    If the return code value in SY-SUBRC is 0, the user has the required authorization and may continue.
    The return code value changes according to the different error scenarios. The return code values have the following meaning:
    4
    User has no authorization in the SAP System for such an action. If necessary, change the user master record.
    8
    Too many parameters (fields, values). Maximum allowed is 10.
    12
    Specified object not maintained in the user master record.
    16
    No profile entered in the user master record.
    24
    The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.
    28
    Incorrect structure for user master record.
    32
    Incorrect structure for user master record.
    36
    Incorrect structure for user master record.
    If the return code value is 8 or 24, inform the person responsible for the program. If the return code value is 4, 12, 16 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP because authorizations have probably been destroyed.
    Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.
    Note
    Instead of ID name FIELD f, you can also write ID name DUMMY. This means that no check is performed for the field concerned.
    The check can only be performed on CHAR fields. All other field types result in 'unauthorized'.
    Example
    Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:
    Table OBJ: Definition of authorization object
    M_EINF_WRK
       ACTVT
       WERKS
    Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations
    M_EINF_WRK_BERECH1
       ACTVT 01-03
       WERKS 0001-0003 .
    can display and change plants within the Purchasing and Materials Management areas.
    Such a user would thus pass the checks
    AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
        ID 'WERKS' FIELD '0002'
        ID 'ACTVT' FIELD '02'.
    AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
        ID 'WERKS' DUMMY
        ID 'ACTVT' FIELD '01':
    but would fail the check
    AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
        ID 'WERKS' FIELD '0005'
        ID 'ACTVT' FIELD '04'.
    To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK

  • Authorization checks for PNP LDB

    question    : how to validate authorization checks for pnp logical database?
    2 nd question: hr report
    this report is basically for salary survey. in this i had so many fields can any body let me know how
    can i form the internal tables. and i have to display overall 150 fields in csv file for that
    how can i take in to the final internal table.
    what is the logic behind this:
    T71JPR09-JOBCODE
    PA0000-PERNR
    HRP1000-STEXT
    P0006-PSTLZ
    PA0008-ANSAL * 100 / PA0008-BSGRD
    PA0015-BETRG
    PA0761-LTEXT  WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-GRADT  WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-ZZGRANT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
    PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN esu YEAR 1
    like that i had.
    please give me the steps how can i proceed.

    Hi,
    The PNP database will take care of authorization check. It will not execute if used does not have authorizations.
    Hope this helps.

  • Create authorization check for a report

    Hi,
    I need to create an authorization check for a report. It means that I need to restrict the usage of the report to couple of users ( 'USER1' and 'USER2' ). How can I do that? I did read through a lot of threads regarding this piece got a bit confused and stuck while creating the authorization object.
    Say the report name is ZHR_TIMEABC.
    Can anyone explain how to create an authorization object and how are they tied to the object and call them in the abap code?
    Thanks in advance,
    VG

    Hi,
    Thanks. Here is my understanding, S_C_FUNCT calls a system generated function module to make an authority check. So, if different users say USER1 and USER2 have different authroization levels, defined in their user profile, just adding this piece code will take care of authroization check for the program OR do I need to take care of something else?
    If so, when do we need to create the authorization objects using SU20 and assign the group and follo this process? When do we use this approach ( lot of threads on authority check have mentioned this procedure)?
    Your inputs will be helpful to understand this concept.
    Thanks,
    VG

  • Authorization Check for Special Stock Indicator in IE02

    Dear Gurus,
    Would like to check with you if there is an authorization check for change in Special Stock Indicator in IE02-SerData Tab?
    For example, the User will only be allowed to change the Special Stock Indicator only to "E" - Sales Order.
    Would appreciate your help.
    Thanks.

    Hi,
    This cannot be done by using standard auth object. Standard SAP doesnt support control via this field.
    Take help of your ABAP team and create an customized authorization object "Z_OBJECT" with field SOBKZ and which check these field value in table EQBS. Assign this auth object to role and profile you want.
    Use the user exit IEQM0003 Additional checks before equipment update. Give a logic to check auth object when while using equipment change tcode.

  • Authorization Checks in Z programs

    Dear Experts,
    Fist of all, thanks for your time. We're being asked to review each Functional Specification in the company to suggest to the developement team the standard objects that should be included in the code in order to restrict the access within each developement. My understanding was that, as an standard practice, developers only use bapis, standard functions or call transactions in their code, for which we should be covered, as SAP includes standard object checks in them (so when using a bapi associated to VA01, the objects in the code for VA01 are being checked). The exception for this are reports, for which we have a Z object with most of the Organizational Values like Company Code, Plant, etc to allow restrictions to take place (and developers are supposed to include this check in this code).
    My first question is: is it true that bapis, standard functions and call transactions use the regular standard objects when being executed?.
    If this is the case, is there any point in suggesting the objects to be checked to the developers?. It looks as if this would be redundant, as SAP is making sure they're being checked when bapis, standard functions and call transactions are executed...(exception made for reports, as mentioned)
    Thanks a lot for your help!!
    Best regards,
    CMPT

    Hi,
    It is always a good idea for the Z transaction review to be performed by the Security consultant. After all it will be his responsibility later on to restrict access to the transaction. You can always ask for the functional consultant's help with understanding the use of the transaction
    In case the custom transaction has been created similar to or is an enhancement on a standard SAP transaction, then it is always a good idea to have at least the same authorization checks for the Z txn also.
    For new developments you need to ensure that the authorization checks need to be implemented based on the functionality of the txn and the data it manipulates. For eg., if you have a Z-txn to make changes to purchase orders, you need to ensure that the program checks for change activity for Purchasing Org, Purchasing Group and Plant values and any other authorization relevant data.
    The auth objects to be used depends entirely on the data and the functional module the custom program belongs to. I generally prefer to use SAP standard objects where possible. Else create new auth objects as per requirement.
    Regards,
    Sanju

  • Syntax check for inactive programs(object)

    I am having some program in internal table now i have to do syntax check for the programs, actually I can use SLIN but SLIN will not do Syntax check if the object is not active, is there  any way that I can check for many programs one after the other.

    Hi Vikram,
    USe the transaction SAMT.
    Please flooow the link below it will solve u r pblm.
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/40c62223-639e-2a10-dd9a-b1dd9af73aeb
    Thanks

  • Disabling authorizations checks for transactions SU53 and/or SU56.

    Greetings.
    I seem to remember reading that there was either a system profile parameter or a table entry that can be used to disable all authorizations checks for transactions SU53 and/or SU56.
    Any truth in this or is my mind playing tricks on me?

    Hi,
    I guess theres is profile param auth/tcodes_not_checked(I guess thats right), this will exclude SU53/SU56 from checks on transaction code.
    This can be done using RZ10 and need to restart the system.
    Rakesh

  • Authorization check for production order settlement

    Hi All,
    Production order settlement currently can be done by any user of any company code. there is a high risk involved in the same since unauthorized postings may happen. Hence we need to add authorization check for production order settlement. Can we maintain the same at the plant or the company code level?
    Waiting for your replies. Thanks in advance!
    Regards,
    Aman Goel

    hi
    What venki has told abt the exit, its absolutely correct.Even i have used the same exit
    •     From table CAUFV pick Material(PLNBEZ),Basic Start Date(GLTRP),Plant(WERKS) .
    •     Pass parameter Material(PLNBEZ) and Plant(Werks) in table MBEW in respective fields i.e. Material(MATNR) and Plant(WERKS).
    •     Pick the latest record for the current period(LFMON) and year(LFGJA).
    •     Pick Product Cost Estimate number(KALN1) from the record and pass it to table KEKO.
    •     Check if Production Order Basic Start Date(GLTRP)<= BIDAT, if NO post Error Message.
    This is the FS for EXit PPco0007
    Reward if useful
    Amit

  • How can I remove this extra authorization check for dynamic parameters

    Hello expert,
           I created a new dynamic hirarchical parameters as " client-->policy" in crystal report.   these parameter value are coming from a physical table.  the other part of report extract data by a oracle procedure. when I ran this report in client, it is ok for everything. but when I schedule it or run it in infoview,  I need extra authorization for access these dynamic parameter, eventhough this is not for accessing other parameters.  How can I remove this extra authorization check for dynamic parameters?

    Hi
    Open the crystal designer  Edit the parameter In the prompt window at the existing option you can find the LOV name.
    Open the Business view manager and find that prompt name in u201CRepository Exploreru201D window and select that parameter  right click that parameter  Select edit rights  provide rights for your user name in that window.
    --Naga

  • Bypass check for this program only

    Hi FI Masters,
    i have a zprint prog ex : ZRFFOZA_H2H. i copied this prog and given a transaction(ZRFFOZA_H2H_FI   tcode : ZFI_H2H ) and run to see the results where it works fine.
    but....
    payment method can be linked to only one print program and in this test case payment method M is linked to ZRFFOZA_H2H, so now the problem is that the new transaction code ZFI_H2H is built on program ZRFFOZA_H2H_FI and the system refuses to run. 
    when i see the message it shows like this...
    The list of payment methods (M) may only be processed by other payment medium programs.
    now how can i bypass this check for this program only?
    can i have some info please....
    Thanks,
    pasala.

    hi FI masters,
    to be more clear to the above quetion,
    i have 2 zprog for the Payment run
    for the Payment method 'M' i have z prog ZRFFOZA_H2H which is configued
    again i have made a copy of above prog to ZRFFOZA_H2H_FI  and run the payment run for the Payemnt method 'M'.
    Now it gives me a message : Payment method(s) are not allowed for this program.
    since below copy prog not configed we get this message.
    NOW : What can i do to bypass this check for this program only
    can i have some info pls?
    thanks again,
    pasala.

  • Authorization checks for bank account number in vendor master

    I am trying to find a way to set up authorization checks for specific fields in the vendor master: LFBK-BANKL, LFBK-BANKN, LFBK-EBPP_ACCNAME and LFBK-EBPP_ACCNAME. I am tring to set ip up so that if you have access to transactions FK03 or XK03, you can view vendor master data except for the above fields.
    Does anyone know of a way to accomplish this? Your help will be greatly appreciated.
    Thanks
    -Peru

    HI Peru,
    To supress a field in FK03 u will have to check
    Financial Accounting (New)>Accounts Receivable and Accounts Payable>Vendor Accounts>Master Data>Preparations for Creating Vendor Master Data-->Define Screen Layout per Activity (Vendors)
    in that Display Vendor (Accounting) for FK03 and Display vendor (centrally) for Xk03
    But there bank account no is not there.
    Moreover there r no authorization objects for all the fields that u gave.
    So try creating screen variant/ transaction variant in SHD0.
    Regards,
    Kiran

  • How to turn off the authorization checks for a object in infoproviders?

    Hi - how can I turn off the authorization check for an object (ex: 0orgunit) in infoproviders?
    I have 0orgunit as an authorization-relevant object and is used in one of the cubes. When reports are run for this cube, this is causing authorization issues. The object is present in other cubes also but I have to remove or turn off the authorization check of this cube alone. How to do this? Please help.
    Thanks,
    Raj.

    Hi Raj,
    Srinivas, is right , however in BI7 the correct transaction is RSECADMIN and not RSADMIN.
    In BW3.5, use RSSM transaction to do thins.
    OR
    Go to transaction RSECAUTH ---> Choose  the authorization object that has been created for org unit(and has been assigned to the user). Go to change mode. Remove the cube from the dimension 0TCAIPROV
    If you are using old authorization concept in 3.5 or in 7.0
    Go to RSSM. In the checks for infoprovider, enter your infoprovider name. Choose change.Here you will see a checkbox to switch off the authorization.
    Hope this helps you,
    Best regards,
    Sunmit.

Maybe you are looking for