Authorization object tables

Hi,
I am building a cusom security report which will have user id, roles, authorization objects, and info objects inside the authorization object(s). I have been able to get users and their roles with tables (usrefus, usr21, adrp, usr02, agr_users) but am having problems finding the following -
Can someone tell me the table names? Any additional info would be appreciated.
Thank.

Hi Clark
Check this Click for authorizations in reporting
http://help.sap.com/saphelp_nw70ehp1/helpdata/en/55/2bb33b90131e73e10000000a11402f/frameset.htm
Regards
Jagadish

Similar Messages

Table Name - For Authorization objects and fields.

Hi
Could any one let me Know In which Table Authorization Objects and Authorization fields are stored.
Thanks N Regards.
Priya

hi,
TOBJ ---> Authorisation Objects
Refer to the link.
http://saptechnicalinfo.blogspot.com/2008/07/sap-authorization-objects-tables.html
Regards
Sumit Agarwal

Authority Object Table name

Hi All,
is there any method to find out the Authority object Relation to table-field name.,like M_MATE_WRK has relation with fieldname WERKS in table MARA.
I dnt want to use and custom authorization and link with it any table.
Regards,
Anuj jain

Dear Gautam,
Agree with you as many table can be linked with this but in this case i want all these linked tables...is this possible ?
For Tables Ref i have this link whose tables i used already for my requirement.
http://abaplovers.blogspot.com/2008/07/sap-authorization-objects-tables.html
Regards,
Anuj

Authorization object to display table field names in english text in SE17

Hi,
One of users have issues with the filed name getting displayed in technical format instead of english text while browsing table information in SE17. Normally we can set this in through Settings->User Parameters. But here for this user, user parameter option is greyed out and he doesn't have access to SE16.
Is there any other way to change user specific parameters, instead of granting him accesss to SE16 or enabling user parameters in SE17?
Thanks,
Mano

Hi,
I made him run SU53 on SE17 transaction the log is showing that authorization check failed for S_ALV_LAYO with value 23.
Actually i have access SE16 and for me also, user parameter option is greyed out in SE17. I ran SU53 on SE17 in my session i also got same log.
One more observation is, the user's colleague also doesn't have access to SE16 and user parameter option is greyed out in SE17 but he can view the table field names in english. So we are wondering if some authorization object is missing here.
We do not want user to make any changes through GUI.
Thanks,
Mano.

SRM 7.0 authorization objects for table maintenance

Hi guys,
I wanted to know how authorization objects work in SRM.
I created a custom table which key filed is company code (BUKRS). And in the table maintenance view I have to add an authorization object based on the company code.
Is it possible to do that in SRM?
Thanks!!

Hi,
Authorization concept is same for all ABAP based application. Do you have any issue in SRM?
Regards,
Masa

What is authorization object and how to create it for a table

Hi All,
What is authorization object and how to create it for a table?
Thanks

Hi
Authorization
For authorization checks, there are many ways of linking authorization objects with user actions in an SAP system. The following discusses three possibilities in the context of ABAP programming.
Authorization Check for Transactions
You can directly link authorization objects with transaction codes. You can enter values for the fields of an authorization object in the transaction maintenance. Before the transaction is executed, the system compares these values with the values in the user master record and only starts the transaction if the appropriate authorization exists.
Authorization Check for ABAP Programs
For ABAP programs, the two objects S_DEVELOP (program development and program execution) and S_PROGRAM (program maintenance) exist. They contains a field P_GROUP that is connected with the program attribute authorization group. Thus, you can assign users program-specific authorizations for individual ABAP programs.
Authorization Check in ABAP Programs
A more sophisticated, user-programmed authorization check is possible using the Authority-Check statement. It allows you to check the entries in the user master record for specific authorization objects against any other values. Therefore, if a transaction or program is not sufficiently protected or not every user that is authorized to use the program can also execute all the actions, this statement must be used.
AUTHORITY-CHECK OBJECT object
                        ID name1 FIELD f1
                        ID name2 FIELD f2
                        ID namen FIELD fn.
object is the name of an authorization object. With name1, name2 ... , and so on, you must list all fields of the authorization object object. With f1, f2 ... , and so on, you must specify the values that the system is to check against the entries in the relevant authorization of the user master record. The AUTHORITY-CHECK statement searches for the specified object in the user profile and checks the useru2019s authorizations for all values of f1, f2 ... . You can avoid checking a field name1, name2 ... by replacing FIELD f1 FIELD f2 with DUMMY.
After the FIELD addition, you can only specify an elementary field, not a selection table. However, there are function modules available that execute the AUTHORITY-CHECK statement for all values of selection tables. The AUTHORITY-CHECK statement is supported by a statement pattern.
Only if the user has all authorizations, is the return value sy-subrc of the AUTHORITY-CHECK statement set to 0. The most important return values are:
·        0: The user has an authorization for all specified values.
·        4: The user does not have the authorization.
·        8: The number of specified fields is incorrect.
·        12: The specified authorization object does not exist.
A list of all possible return values is available in the ABAP keyword documentation. The content of sy-subrc has to be closely examined to ascertain the result of the authorization check and react accordingly.
REPORT demo_authorithy_check.
PARAMETERS pa_carr LIKE sflight-carrid.
DATA wa_flights LIKE demo_focc.
AT SELECTION-SCREEN.
AUTHORITY-CHECK OBJECT 'S_CARRID'
                  ID 'CARRID' FIELD pa_carr
                  ID 'ACTVT' FIELD '03'.
IF sy-subrc = 4.
    MESSAGE e045(sabapdocu) WITH pa_carr.
ELSEIF sy-subrc <> 0.
    MESSAGE e184(sabapdocu) WITH text-010.
ENDIF.
START-OF-SELECTION.
SELECT carrid connid fldate seatsmax seatsocc
    FROM sflight
    INTO CORRESPONDING FIELDS OF wa_flights
    WHERE carrid = pa_carr.
    WRITE: / wa_flights-carrid,
             wa_flights-connid,
             wa_flights-fldate,
             wa_flights-seatsmax,
             wa_flights-seatsocc.
ENDSELECT.
Regards
Hitesh

Authorization object for table

Hi All,
I have created a table in Se11 and not allowing maintance generator.
Can any one please suggest if I am not allowing table maintaince then how I can attach authorization object to the tabe.
Thanks,
Sandeep.

Hi sandy,
1. I am not allowing table maintaince
    If u are not allowing the table for maintenance,
   then authorisation group is NOT REQUIRED.
2. Authorisation group is required only,
   in case where we allow table maintenance thru sm30.
(other wise there is no use of authorisation group for table)
regards,
amit m.

Is there any table for see Authorization object for Function code?

Hi,
I am facing problem in finding autho. object for function code.
My problem is, in tcode cor2 there is function Approval (in Menubar->process order->function->approval), I want to restrict this to some users.
So is there any way or table to see function code's authorization object..
Thanks...

Hi ,
I such scenario the best way is to run trace (ST01) and analyse to find used/missing authorization objects.
Regards,

Table for authorization objects

Hi All,
What is the table where all authorizations for a user for a particular authorization object is maintained?
Thanks,
Neelima.

hi friend
usr04 -User master authorizations alone
usr07 - it will display all the authorisation object field name.
if its helpful reward for the same
regards
vijay

How to get all authorization objects for a certain authorization profile

Hi ABAP experts,
I have the following problem: for a certain authorization profile of a role (created with transaction PFCG) I would like to get all contained authorization objects: e.g. for the contained object PLOG I would like to know/read all corresponding parameter values.
So:
- where are these values stored (dictionary table)?
- is there already a FM or a report to read all authoriation values for a certain authorization profile?
Thanks in advance.
Best regards,
Oliver

Hi,
check the following it might useful for you:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c
if helpful reward points are appreciated

Mass update to FILENAME field in S_DATASET authorization object

We are migrating to a new fileserver with a new hostname, and so I've been asked to update about 1900 instances of the S_DATASET authorization object for the new FILENAME value. I'd like to do this programmatically if possible.
What I've learned so far is that I need to update the value in table USR12, but the value is encoded. When I look at the table in SE16, I do not see the encoded value field. The value does show in UST12, but I'm told this is an unreliable table.
So I'd like to know..
1. How can I look at the value if not in SE16?
2. Is there an API I can use to encode/decode the value? If not, where is the specification on how to build it?
If this is better addressed in a different forum, which one should I try next?
Thanks,
Dan

Hi there,
Okay I started a few tests and made a bit of progress, but am running into the problem that if I don't check the authority first using the FM and want to test what happens when the user is not authorized, then the bugger dumps (as expected and mentioned in the note)...
But the behaviour as you have described:
>
> Path                   Saveflag Fs_noread Fs_nowrite Fs_Brgru
> =============================================================
> *                                 X         X            DUMY
> /temp/FI/..                       X         X            DUMY
> /temp/FI               X                                 FIFI
>
... is correct, and I found something interesting in the F1 on the spth-path field which explains this.
> Caution:
> - If you enter paths generically in the table SPTH, the most precise specification counts.
> - If you select the no-read or no-write fields in the table SPTH, this overrides the authorization group.
So, the DUMY is not needed as the check does not use it in those cases, and "/temp/FI/.." is anyway more specific than "*" so the system would have used it for DUMY anyway. But that is irrelevant... because if the begru field is empty in the FM, then the check is not performed.
So, the only check which is effective to protect the path, is:
Path                   Saveflag Fs_noread Fs_nowrite Fs_Brgru
=============================================================
/temp/FI               X                                           FIFI
... and the "fs_noread" and "fs_nowrite" flags should be understood as "no protectable authority to read" and "no protectable authority to write" and not the activity field which the authority is being checked against. This is coming from the S_DATASET check (which is already known at that time to the function module).
Using these flags, you can leave the entries in the table without having to delete them if you want to turn them off and on temporarily. Perhaps an "active / inactive" switch would have been clearer...
form CHECK_PERMISSION using ISPTH_HEAD type SPTH
                            MODE       type CLIKE
                            SUBRC      type SY-SUBRC.
data: ACTIVITY like AUTHB-ACTVT.
   SUBRC = 0.
   case MODE.
     when 'R'.
          ACTIVITY = '03'.
     when 'W'.
          ACTIVITY = '02'.
     when 'D'.
          ACTIVITY = '02'.
   endcase.
   if ISPTH_HEAD-FS_BRGRU <> SPACE. "Here it is... for BEGRU checks there must be a value...
      authority-check object 'S_PATH'
          id 'FS_BRGRU' field ISPTH_HEAD-FS_BRGRU
          id 'ACTVT'    field ACTIVITY.
       if SY-SUBRC <> 0.
          SUBRC = 3.
       endif.
   endif.
endform.
Cheers,
Julius

Report to check authorization object used in customized programs

Hi Guys,
An auditor came and he raised a question to us, he asked whether all of our customized transactions and programs are maintained with authorization checks? The question is how can we check what authorization objects are used for our customized programs and transaction codes? The developer did not maintain the objects used for that program in SU24 table. Is there a program or a report to show us all the authorization object used for a customised program or transaction? Example : T-code MIGO we can check in SU24 table for all the authorization object used. How do we check for customized tcodes? Please advise. Thanks!
Edited by: Jarod Tan on Nov 25, 2010 9:42 AM

Note that some programs are built in such a way that no (visible) auth check is necessary, or even desired at all.
To determine the necessity of an auth check, you should check that starting it has an entry point (tcode, rfc, service) which is appropriately restricted. The rest (whether and where and how a further check is evaluated) is entirely dependent to what the program actually does.
Well designed applications generally have centralized functions and methods, and the checks are in there or a "base check" they use.
Others again use the same in UI programming to determine the visibility of functions, to make the application more intuitive for the user. This on it's own is however not a sufficient auth check to rely on.
Code review is an art form!
Cheers,
Julius

How to use CRM authorization object.

Hi All,
I have a specific requirement to restrict user while he/she tries to save a record. It appears that if that restrictions are implemented the save logic for an entity has to be changed because there are some validation regarding relationship management in SAP system. SO I need to bypass that validation to allow some users of specific(Marketting) role to save the entity record bypassing that validation. here I am planning to use the CRM authorization objects. But dont know how to use these and which authorization object to refer.
Please let me know if you guys have any idea.
Regards,
Bikramjit.

Hi Bikramjit.,
You might need to create a Custom authorization object and then use it. Else you can create one Z table and maintain the User ID of all users. The mainatin one field with flag and set it to X for the user that are aloowed to save the transaction.
Also once you maintain the table, generate the table maintenance so that it becomes easier for future use.
Hope this helps

Creation of a new Authorization object

Hi ,
I need to create a new Authorization group and add three existing tables to it.
Kindly suggest a way.
Regards.

Authorization Field
Smallest unit in an authorization object. An authorization field either represents data, such as a key field in a database table, or activities, such as Read or Create. Activities are specified as identifiers, which are stored in the database table TACT and the customer-specific table TACTZ.
Maintenance using transaction SU20.
Authorization Object
Repository object that forms the basis for authorizations. An authorization object comprises up to 10 authorization fields. The combination of authorization fields, which represent data and activities, is used for authorization assignment and to check authorizations. Authorization objects are grouped together in authorization classes.
Maintenance using transaction SU21.
Authorization
Enter in the user master record or part of an authorization profile. An authorization comprises complete or generic values for the authorization fields in an authorization object. The combination determines the activities with which a user can access certain data.
Maintenance in transaction SU03 or generation from transaction PFCG (profile generator for role maintenance).
Authorization Profile
Grouping of several individual authorizations or further authorization profiles. Can be entered in the user master record instead of individual authorizations. An authorization can be assigned to authorization profiles as often as you wish.
Maintenance in transaction SU02 or generation from transaction PFCG (profile generator for role maintenance).

Mass maintenance of authorization objects

Is there a SAP transaction available to mass maintain authorization objects?
Let's say that I have 120 roles, in all of which I want to change the value of field Y of authorization object X. For example, object S_TABU_DIS. I want to exclude an authorization group in all available roles. How can I do this for all roles which have this object?
Modifying each role separately in PFCG is rather time consuming (and pretty unpleasant).

Actually, SAP does provide a solution to promote and demote fields to org. levels. There are reports for this (use them and not the table maintenance transactions!) because they automatically adjust your roles as well - otherwise you end up with inconsistencies.
But I agree with you, that org-levels is not a natural solution for this specific problem and although retrofitting security is the most expensive option, one cannot foresee all requirements from the start and Go-Live project pressure can be a factor as well to use * values for fields which on their own appear to be harmless...
You could try to write an adjustment tool for PFCG, but with "only" 120 roles I think you will be faster and safer with doing it manually. I think that less than 1 day's work should fix it. However, if you are willing to invest 2 or 3 days more, you can also consider restoring the values from the SU24 proposals. Particularly if one group of transactions are in many of the roles and you can isolate the common transaction (the "guilty one...) then you can do it more centrally in future as well.
However if you have not used the "Read old merge new" function in PFCG's expert mode, then you should be carefull with this as other objects might "correct" themselves as well. Particularly if you have been deleting standard authorizations in roles! (Why that button even exists, I don't know. No good can come of it...
Cheers,
Julius

Authorization object tables

Similar Messages

Maybe you are looking for