Authorizations for Tcode Execution

Question

Hi. 
I understand that users assigned a particular Tcode eg. PFCG might not be able to execute this Tcode if he is not assigned the corresponding Authorization object and related activity field values for the PFCG transaction to work.
One tedious method of verifying that the user does indeed have authorization is to require the user to login and execute the transaction PFCG itself.
Is there a faster way for the Administrator to check if the end-users does have the relevant authorizations/authorization_objects to support the execution of a tcode PFCG? This applies to all other tcodes.
Thank you very much.

Answer 1

Hi Chong,
SAP delivers the tables USOBX and USOBT.
Table USOBX defines which authorization checks are to be performed within a
transaction and which not. This table also determines which authorization checks are maintained in the Profile Generator.
Table USOBT defines for each transaction and for each authorization object which
default values an authorization created from the authorization object should have
in the Profile Generator.
The tables are maintained in transaction <b>SU24</b>. This transaction displays the check indicators of a transaction. Check indicators determine if an authorization check will run within the transaction or not. Any object with CM(Check/Maintain) status will be pulled into PFCG when you add a transaction.
To check this:
Enter transaction SU24-->Enter any transaction which you want to check in "Transaction Code"->execute->Display check indicator-->Display field values.
This would show you the authorzation objects along with there field values which will be pulled into a role when you add a transaction.
Hope it helps.
Please award points if it is useful.
Thanks & Regards,
Santosh