Authorization check for plant

Guys,
I need to creat an authorization object with field Plant
In my user exit I need to check for that particular plant , if authorized proceed else exit.
how can achive this.
Please provide me the Step by step procedure.
Appropriate answers willb e rewarded.
Thanks in advance

created one field in su20(ZWERKS)
Not ZWERKS it should be WERKS .here save your efforts.
in aurthorization tab>change aurthorization data>selected sap_all
saved generated
selected sap_all
saved generated this is wrong also from change aurthorization data here you must select all plant values except 3AA0.
and make sure in aurthorization tab green light should be there after generate.cause in this process this screen bit buggy.
Update:from SU21 you must create both Authorization object and class from create button(drop down).and make sure in Authorization object you assing the both class and field(werks which you already created in su20)

Similar Messages

Selection screen and authorization check for plant from 2 diff tables?

Hi,
Could anyone help me out?
how to write code for this?
u2022   Fields for selection
Plant : WERKS (one selection) - check authorization access u2013 Mandatory .
Material code MATNR (one selection) - Mandatory
and while doing the authorization check how should i check it ? here iam taking the table as t001w for werks and for selection screen iam taking it from another Z table......i should take 2 different tables here.....for selection and for authorization.
my code is pasted below:
                 Data Declarations                                  *
data: s_werks type t001w-werks.
                 Selection Screen                                    *
SELECTION-SCREEN BEGIN OF BLOCK b1 WITH FRAME TITLE text-h01.
PARAMETER : p_werks like Ztable-werks OBLIGATORY,
              p_matnr like mara-matnr OBLIGATORY.
SELECTION-SCREEN END OF BLOCK b1.
                 Start-of-Selection                                  *
START-OF-SELECTION.
**-Get Plants for Authorization check.
   SELECT werks
          FROM t001w
          INTO TABLE it_werks
      WHERE werks IN s_werks.
    LOOP AT it_werks INTO x_werks.
       v_werks = x_werks.
Regards,
Reddy

Plant : WERKS (one selection)
That means only 1 plant value to be given? Then you can use PARAMETERS instead of SELECT-OPTIONS. And additionally, you'll only have to check that plant value.
Using SELECT-OPTIONS you would indeed retrieve the plants and check each individual selected plant. Your code for that is good enough to start with.
I wouldn't do the check in the START-OF-SELECTION event, but rather in the AT SELECTION_SCREEN event.
To perform an authorisation check; try the ABAP help on AUTHORITY-CHECK. And you will need to know which authorisation object you need to use.
Just noticed you're using PARAMETERS
WHERE werks IN s_werks
should be
WHERE werks eq p_werks
But actually you don't need to select T001W. Just use the value in p_werks.
Edited by: Maen Anachronos on Oct 10, 2008 7:53 PM

How to find out Authorization Object for Plant

Hi,
I have to implement an Authorization check for Plant in My Report Program.
Is there any transaction which can help me to find out Authorization Object for any field like Material and plant?
Thanks,
Mamta

Using SU21 u can create Authorisation Object.
The ABAP command AUTHORITY-CHECK is used for performing authorizaton checks in programs.
check f1 help on AUTHORITY-CHECK for the syntax.
check these links
link:[http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c;jsessionid=(J2EE3417500)ID1605942050DB11298929682009193279End]

Authorization check for CO88

Dear all,
I found there is no authorization check for plant in CO88, this means if user do not enter the plant, then all the orders will be settled, would anyone tell me how to control this?
thanks,
Ben

Ben,
You can control this by creating seperate roles and giving plantwise authorization in these roles.. Please check Tcode PFCG for further details...
Thanks

Authorization object for plant on selection-screen

Hi All,
I need to cehck the authorization object for plant on sleection screen..the palnt is select-options.
I have written the code
Declaration of local constants.
CONSTANTS : lc_i(1) TYPE c VALUE 'I',
              lc_eq(2) TYPE c VALUE 'EQ'.
REFRESH : r_werks.
LOOP AT s_werks.
    IF s_werks-low IS NOT INITIAL.
      AUTHORITY-CHECK OBJECT 'M_MATE_WRK'                "Check if the user has autorization for the plant.
                           ID 'ACTVT' FIELD '03'
                           ID 'WERKS' FIELD s_werks-low.
      IF sy-subrc NE 0.
        r_werks-sign   = lc_i.
        r_werks-option = lc_eq.
        r_werks-low    = s_werks-low.
        APPEND r_werks.
      ENDIF.
    ENDIF.
ENDLOOP.
LOOP AT s_werks.
    IF s_werks-high IS NOT INITIAL.
      AUTHORITY-CHECK OBJECT 'M_MATE_WRK'                "Check if the user has autorization for the plant.
                           ID 'ACTVT' FIELD '03'
                           ID 'WERKS' FIELD s_werks-high.
      IF sy-subrc NE 0.
        r_werks-sign   = lc_i.
        r_werks-option = lc_eq.
        r_werks-low    = s_werks-high.
        APPEND r_werks.
      ENDIF.
    ENDIF.
ENDLOOP.
My doubt is will the authorization will check the plants in between 1001 and 2001..suppose i have pplants 1001,1002,1003,1004,2001..Now will the above code will check for all the plants or only 1001 and 2001 if i specify in the select-options.
Regards,
raj

Hi Raj
First no need to LOOP AT s_werks and check s_werks-high as it will always be present only once in the table s_werks.
Do this
SELECT werks FROM t001w INTO li_werks
WHERE werks IN s_werks.
LOOP AT li_werks.
*check your authority thing here and fill the range
ENDLOOP.
Pushpraj

Authorization Check for Storage Location

Hi Experts,
I have the following requirement :-
I have Plant : P081 created under Company Code : P110.
I have got various Storage Locations under this Plant for example
KT01 - Main Stores
KT24 - Remote Store.
The KT24 store is basically a remote location store. I have activated the Authorization for the Storage Location KT24 in the SPRO Settings
Material Management --> Inventory Management and Physical Inventory --> Authorization Management --> Authorization check for storage location.
I have maintain the following authorizations for the Object M_MSEG_LGO as follows :-
1. OBJECT : M_MSEG_LGO.
>> 2. USER ID : 081Store
>> 3. PLANT : P081
>> 4. STORAGE LOCATION : Kt24
>> 5. ACTIVITY : 01-03
>> 6. MOVEMENT : 101, 102, 201, 221, 261
and authorization for T_code MIGO_GR and MIGO_GI . I want to restrict the user for transaction only for this storage location but the system is allowing the user to post GR document for KT01 stores also.
Can any one suggest a solution or settings that need to be done for the user to be restricted to prepared GR for Storage Location KT24 only.
Thanks in advance.
AJ

Hi,
You set the authorizations to users with tcode PFCG. To know the reason of deny some access run tcode SU53 after SAP denies the access to some documents / objects.
Regards,
Eduardo

Authorization check for production order settlement

Hi All,
Production order settlement currently can be done by any user of any company code. there is a high risk involved in the same since unauthorized postings may happen. Hence we need to add authorization check for production order settlement. Can we maintain the same at the plant or the company code level?
Waiting for your replies. Thanks in advance!
Regards,
Aman Goel

hi
What venki has told abt the exit, its absolutely correct.Even i have used the same exit
     From table CAUFV pick Material(PLNBEZ),Basic Start Date(GLTRP),Plant(WERKS) .
     Pass parameter Material(PLNBEZ) and Plant(Werks) in table MBEW in respective fields i.e. Material(MATNR) and Plant(WERKS).
     Pick the latest record for the current period(LFMON) and year(LFGJA).
     Pick Product Cost Estimate number(KALN1) from the record and pass it to table KEKO.
     Check if Production Order Basic Start Date(GLTRP)<= BIDAT, if NO post Error Message.
This is the FS for EXit PPco0007
Reward if useful
Amit

Authorization check For T code

Hi everyone,
Can anybody guide to set a authorization check for a particular Tcode.
I have ztable where users are assigned particular numbers.
I want the users who are assigned some numbers should be able to use this particular t code
Thanks in advance

hi
chk this out
AUTHORITY-CHECK
Basic form
AUTHORITY-CHECK OBJECT object
    ID name1 FIELD f1
    ID name2 FIELD f2
    ID name10 FIELD f10.
Effect
Explanation of IDs:
object
Field which contains the name of the object for which the authorization is to be checked.
name1 ...
Fields which contain the names of the
name10
authorization fields defined in the object.
f1 ...
Fields which contain the values for which the
f10
authorization is to be checked.
AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).
You must specify all authorizations for an object and a also a value for each ID (or DUMMY).
The system checks the values for the IDs by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.
If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.
If the return code value in SY-SUBRC is 0, the user has the required authorization and may continue.
The return code value changes according to the different error scenarios. The return code values have the following meaning:
4
User has no authorization in the SAP System for such an action. If necessary, change the user master record.
8
Too many parameters (fields, values). Maximum allowed is 10.
12
Specified object not maintained in the user master record.
16
No profile entered in the user master record.
24
The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.
28
Incorrect structure for user master record.
32
Incorrect structure for user master record.
36
Incorrect structure for user master record.
If the return code value is 8 or 24, inform the person responsible for the program. If the return code value is 4, 12, 16 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP because authorizations have probably been destroyed.
Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.
Note
Instead of ID name FIELD f, you can also write ID name DUMMY. This means that no check is performed for the field concerned.
The check can only be performed on CHAR fields. All other field types result in 'unauthorized'.
Example
Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:
Table OBJ: Definition of authorization object
M_EINF_WRK
   ACTVT
   WERKS
Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations
M_EINF_WRK_BERECH1
   ACTVT 01-03
   WERKS 0001-0003 .
can display and change plants within the Purchasing and Materials Management areas.
Such a user would thus pass the checks
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0002'
    ID 'ACTVT' FIELD '02'.
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' DUMMY
    ID 'ACTVT' FIELD '01':
but would fail the check
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0005'
    ID 'ACTVT' FIELD '04'.
To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK

Authorization checks for PNP LDB

question : how to validate authorization checks for pnp logical database?
2 nd question: hr report
this report is basically for salary survey. in this i had so many fields can any body let me know how
can i form the internal tables. and i have to display overall 150 fields in csv file for that
how can i take in to the final internal table.
what is the logic behind this:
T71JPR09-JOBCODE
PA0000-PERNR
HRP1000-STEXT
P0006-PSTLZ
PA0008-ANSAL * 100 / PA0008-BSGRD
PA0015-BETRG
PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-GRADT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-ZZGRANT WHERE PA0761-CPLAN = LTI PLAN PSU YEAR 1
PA0761-LTEXT WHERE PA0761-CPLAN = LTI PLAN esu YEAR 1
like that i had.
please give me the steps how can i proceed.

Hi,
The PNP database will take care of authorization check. It will not execute if used does not have authorizations.
Hope this helps.

Create authorization check for a report

Hi,
I need to create an authorization check for a report. It means that I need to restrict the usage of the report to couple of users ( 'USER1' and 'USER2' ). How can I do that? I did read through a lot of threads regarding this piece got a bit confused and stuck while creating the authorization object.
Say the report name is ZHR_TIMEABC.
Can anyone explain how to create an authorization object and how are they tied to the object and call them in the abap code?
Thanks in advance,
VG

Hi,
Thanks. Here is my understanding, S_C_FUNCT calls a system generated function module to make an authority check. So, if different users say USER1 and USER2 have different authroization levels, defined in their user profile, just adding this piece code will take care of authroization check for the program OR do I need to take care of something else?
If so, when do we need to create the authorization objects using SU20 and assign the group and follo this process? When do we use this approach ( lot of threads on authority check have mentioned this procedure)?
Your inputs will be helpful to understand this concept.
Thanks,
VG

Need to Create a Check for Plant in WBS & Plant in Network

Dear Guru's,
While creating Project (CJ01) my users are creating in a Plant, and while creating network for the same project/WBS, they are using different Plant Code.
Since my Profit center is related to the plant in CJ01,
and because of wrong Plant in network, all my PR/ PO is going in a different Profit center, which is creating a huge problem while auditing.
I need to Create a Check for Plant in WBS & Plant in Network...!!
Kindly suggest me the ways to do it and how to do it...

Hi Deepa,
The Check you are trying to create between Plant defined at Project def and network level that should be same can be achieved through validation at the network level by using a user exit at network level.
                While creating the network you can change the plant value not equal to the value at proj def/network profile may be one of the reason is since the network type is defined for more than one plant (OPUV).
                While creating validations at network level we do not have the option of setting the prerequisite/check using WBS or Proj def fields (i.e. PROJ-, PRPS- fields)    so we need to create a user exit at the network level.
I am not sure but logically u can have a user exit for both prerequisite and check steps of the validation.
You need to create the user exit in program ZGGBR000.
Please take help from your Abaper for the same.
OPSI-Network header-Validation- Step - Prerequisite u2013 Check u2013 Message.
Prerequisite
If Proj Profile = u2018XXXu2019 and Network Profile = u2018XXu2019 (or as per your logic if need be use a exit)
CHECK.
PROJ-WERKS = CAUFVD-WERKS   (This logic needs to be defined in user exit and set the same user exit at the check.)
Once you define the user exit in ZGGBR000, it will be available in the tab u2018exitsu2019 at the Prerequisite and Check levels.
The name of the form pool (e.g., ZGGBR000) that contains your user exit must be stored in table T80D.
It is important that you make declare the code generation program for your user exit; how many and what type of parameters you are using for the user exit. You do this by entering your newly defined user exits in the form routine GET_EXIT_TITLES. Found in program ZGGBR000.
Check with your Abaper to check on all the aboveu2026
Message:
Plant at Network level should be same as at Project def level.
Hope it helps you,All the best..
Regards
Vinayak.

Authorization Check for Special Stock Indicator in IE02

Dear Gurus,
Would like to check with you if there is an authorization check for change in Special Stock Indicator in IE02-SerData Tab?
For example, the User will only be allowed to change the Special Stock Indicator only to "E" - Sales Order.
Would appreciate your help.
Thanks.

Hi,
This cannot be done by using standard auth object. Standard SAP doesnt support control via this field.
Take help of your ABAP team and create an customized authorization object "Z_OBJECT" with field SOBKZ and which check these field value in table EQBS. Assign this auth object to role and profile you want.
Use the user exit IEQM0003 Additional checks before equipment update. Give a logic to check auth object when while using equipment change tcode.

Authorization check for a program/table

Hi ,
Can anyone help me out in
How to do authorization check for an abap program and also a table.
I have no idea about the authorizations.
My requirement is that I need to do the authorization check in such a manner that only users having a certain profile
1. should be able to execute the program
2. View of the entries of the table.
Thanks & Regards,
Keerthi

Hello Keerhi ,
I got you wrong at first!
If you want to have only certain users to be able to do certain operations, then you need to assign the appropriate roles to those users!
First find the role
second add the user in the role ( PFCG T code---> USers tab)
Raj

Authorization checks for bank account number in vendor master

I am trying to find a way to set up authorization checks for specific fields in the vendor master: LFBK-BANKL, LFBK-BANKN, LFBK-EBPP_ACCNAME and LFBK-EBPP_ACCNAME. I am tring to set ip up so that if you have access to transactions FK03 or XK03, you can view vendor master data except for the above fields.
Does anyone know of a way to accomplish this? Your help will be greatly appreciated.
Thanks
-Peru

HI Peru,
To supress a field in FK03 u will have to check
Financial Accounting (New)>Accounts Receivable and Accounts Payable>Vendor Accounts>Master Data>Preparations for Creating Vendor Master Data-->Define Screen Layout per Activity (Vendors)
in that Display Vendor (Accounting) for FK03 and Display vendor (centrally) for Xk03
But there bank account no is not there.
Moreover there r no authorization objects for all the fields that u gave.
So try creating screen variant/ transaction variant in SHD0.
Regards,
Kiran

How to turn off the authorization checks for a object in infoproviders?

Hi - how can I turn off the authorization check for an object (ex: 0orgunit) in infoproviders?
I have 0orgunit as an authorization-relevant object and is used in one of the cubes. When reports are run for this cube, this is causing authorization issues. The object is present in other cubes also but I have to remove or turn off the authorization check of this cube alone. How to do this? Please help.
Thanks,
Raj.

Hi Raj,
Srinivas, is right , however in BI7 the correct transaction is RSECADMIN and not RSADMIN.
In BW3.5, use RSSM transaction to do thins.
OR
Go to transaction RSECAUTH ---> Choose the authorization object that has been created for org unit(and has been assigned to the user). Go to change mode. Remove the cube from the dimension 0TCAIPROV
If you are using old authorization concept in 3.5 or in 7.0
Go to RSSM. In the checks for infoprovider, enter your infoprovider name. Choose change.Here you will see a checkbox to switch off the authorization.
Hope this helps you,
Best regards,
Sunmit.

Authorization check for plant

Similar Messages

Maybe you are looking for