Bom Changing Authorization Check (CS02,CS62)

Hi all
I am tring to block users from changing Material Bom usage 1 without ECM
but allowed them to change Order Bom any usage without ECM
I used c_stue_ber and c_stue_noh for tring block them
also i couldn't find any user exit that i can used for this validation.
can some one find a way to do check validation in the first screen in cs02
Please Help Thank

No need to do validation by using any User exits , U can maintain values in the user profile , So SAP will take care of these validations.
Regards
Prabhu

Similar Messages

Bom Change Authorization (CS02,CS62)

Hi all
I am tring to block users from changing Material Bom usage 1 without ECM
but allowed them to change Order Bom any usage without ECM
I used c_stue_ber and c_stue_noh for tring block them
also i couldn't find any user exit that i can used for this validation.
Please Help

Hello Kobi,
In exceptional cases you can allow a BOM change without a change number
using the authorization object C_STUE_NOH for BOMs with history
requirements.
Hope it works...
Cheers, Dudle.
PS: Plz Do not forget to give rewards

Bom Changing Authorization (cs02,cs62)

Hi all
I am tring to block users from changing Material Bom usage 1 without ECM
but allowed them to change Order Bom any usage without ECM
I used c_stue_ber and c_stue_noh for tring block them
also i couldn't find any user exit that i can used for this validation.
there is any way for block material bom usage 1 only from changing without ECM
Please Help Thank

Hello Kobi,
In exceptional cases you can allow a BOM change without a change number
using the authorization object C_STUE_NOH for BOMs with history
requirements.
Hope it works...
Cheers, Dudle.
PS: Plz Do not forget to give rewards

BBP_PS_PROJECT_GET_LIST: Checks for Change Authorization.

Hi,
I have a custom SAP program that is required to fetch pertinent details from a project.
The SAP function module BBP_PS_PROJECT_GET_LIST retrieves several internal tables is used for this purpose.
For some reason this function module, which looks like it should only retrieve information and cannot perform changes itself, checks for Change authorization to object C_AFKO_ACT. As a result, users with Change access to projects can run this and get the appropriate results (in internal table IT_AFVC). However, users with Display access only to projects do not have any data returned back in this same structure.
Any idea on how to go about this problem?
Regards
Jibat

Hi,
See also the foll related notes before you implement the corrections in the note 818342 based on your current SP level for SRM 4.0.
Note 742314 - BADI for approver selection when adding/changing approvers
Note 802581 - Error in call "BBP_WFLH_AGENTS_FOR_CHANGE_GET"
BR,
Disha.
Do reward points for useful answers.

BOM Change Issue

I have material number, component number in my file. I need to change the issuing storage location for each component. I am unable to figure out the way to write a bdc. Shall i use cs02 or cs05. Also if go inside the bom change how do select a component in my BDC??
with regards
MurugeshRajeev

ok,
following previous instruction do the recording in LSMW.
in 4 th step of LSMW i.e. in filed mapping add a validation for Material type where you write a query on MARA to check if material type is 'Whatever you wnat'.Only do transfer_record for transaction which satisfy youir condition , for rest of them do SKIP_TRANSACTION.
let me know if any questions.

Authorization check in CS20

Hi gurus,
Please help.
Our user have used CS20 when we are still using SAP 4.6C. But when we upgraded to ECC6, error appeared. Error message "no authorization in CS05".
Could you please advice on what is the diference on both SAP releasE>?
Thank you

Dear Acel,
There's no change or modifications made in ECC 6.0,for the BOM changes CS20 or CS05.
You can check the release notes in these links,
[SAP R/3 4.7|http://help.sap.com/saphelp_47x200/helpdata/en/2d/99959a9764b944b7358ed97dfbe6b7/frameset.htm]
[ECC 6.0|http://help.sap.com/saphelp_erp2005/helpdata/en/43/688055b88f297ee10000000a422035/frameset.htm]
Regards
Mangalraj.S

Kanban authorization checks (SU24, PK13N, PK*)

Hi,
Does anyone know why the Kanban transactions (PK*) have mostly disabled authorization check indicators in SU24?
In PK13N, for example, there is functionality to do a goods receipt (MIGO GR) and also functionality to create POs (and maybe more that I have not looked into yet).
However, the related auth objects in SU24 are not enabled (check indicator = do not check). This seems strange for these authorization objects.
Especially in light of SoD. Users could create POs or do Goods Receipt via PK13 without proper auth check and these 2 functions conflict already (using default GRC ruleset).
But that's beside the point. The question is: Is there a good reason why these are disabled and how is this NOT a secuty risk?
Now, there is one object that is enabled: C_KANBAN
But, I feel that this is insufficient to really secure the goods receipt action and the PO creation action.
For reference, a list of disabled auth objects:
C_STUE_WRK CS BOM Plant (Plant Assignments)
C_TCLS_MNT Authorization for Characteristics of Org. Area
F_BKPF_KOA Accounting Document: Authorization for Account Types
F_FICA_CTR Funds Management Funds Center
F_FICA_FTR Funds Management FM Account Assignment
F_FICB_FKR Cash Budget Management/Funds Management FM Area
F_FICB_FPS Cash Budget Management/Funds Management Commitment Item
F_LFA1_APP Vendor: Application Authorization
F_SKA1_BUK G/L Account: Authorization for Company Codes
L_BWLVS Movement Type in the Warehouse Management System
L_LGNUM Warehouse Number / Storage Type
M_BANF_BSA Document Type in Purchase Requisition
M_BANF_EKG Purchasing Group in Purchase Requisition
M_BANF_EKO Purchasing Organization in Purchase Requisition
M_BANF_WRK Plant in Purchase Requisition
M_BEST_BSA Document Type in Purchase Order
M_BEST_EKG Purchasing Group in Purchase Order
M_BEST_EKO Purchasing Organization in Purchase Order
M_BEST_WRK Plant in Purchase Order
M_LPET_EKO Purchasing Org. in Scheduling Agreement Delivery Schedule
M_MRES_BWA Reservations: Movement Type
M_MRES_WWA Reservations: Plant
M_MSEG_BWA Goods Movements: Movement Type
M_MSEG_BWE Goods Receipt for Purchase Order: Movement Type
M_MSEG_BWF Goods Receipt for Production Order: Movement Type
M_MSEG_LGO Goods Movements: Storage Location
M_MSEG_WMB Material Documents: Plant
M_MSEG_WWA Goods Movements: Plant
M_MSEG_WWE Goods Receipt for Purchase Order: Plant
M_MSEG_WWF Goods Receipt for Production Order: Plant
M_RAHM_BSA Document Type in Outline Agreement
M_RAHM_EKG Purchasing Group in Outline Agreement
M_RAHM_EKO Purchasing Organization in Outline Agreement

Hi Steven
Normally, when I submit OSS messages about security gaps the response is "working as designed", so I thought I'd try SCN first... perhaps it REALLY IS working as designed and there is a good reason why no auth checks should happen in this case.
Unfortunately this is all too common. However, I have found a lot of the times it is a Level 1 Support person in SMP advising you of this. With perseverance and escalation to a the next level the chance of a fix is greater (still not a guarantee)
It's a pity if working as per design they could explain why.
MIGO can be used in display mode only. If PK13 and PK13N are meant to be display transaction and the SU24 allows you to perform change (i.e. none of the underlying auths are checked for change) then I would refuse to close the customer incident until SAP responds further. At the end of the day, if a display transaction allows modification then it isn't a display transaction
I get the impression SU24 and some other security (e.g. authority check on '' instead of dummy) has been allowed to exist as customers give up and change the values themselves instead of getting SAP to fix their solution.
You could also look at SE97 if call transaction can be switched to yes so users cannot jump from PK13N to MIGO (assuming the code was a CALL TRANSACTION)
Regards
Colleen
P.s. - understand the comment with stale thread but take note of timezone and if you raise it on a Friday people may not see it until the following week. Although you did consider this, a lot of people on SCN put urgent in their question and then within the same day respond to their thread to "bump it" on the list

Issues with Analysis Authorization checks in APO

Hi Friends,
I am facing an issue with Analysis authorization checks in APO.
We have setup user access based on Management Entity (Analysis authorization - AGMMGTENT and 0TCAACTVT) and core APO authorizations (based on the work profile - e.g: Demand Planner).
Scenario: Consider User A has access to India and Australia Management Entities with 0TCAACTVT - *
This user also has display access to all management Entities (AGMMGTENT - * and 0TCAACTVT - 03). This scenario works very well in Quality where the RSECADMIN trace shows check on both Characteristics. However in Production the RSECADMIN trace shows up only against AGMMGTENT (*) and by default takes 0TCAACTVT as (*).
In Quality the Characteristics that get checked are as below : and it works as expected. Display access for Management Entities that are supposed to be displayed only and change access to only the Management Entities that it should.
However the Trace for Production shows the following : As a result it is allowing the user to change access to all management Entities. Which is not desirable..
Resultant trace results are as below: This should not happen..
I have compared all Analysis Authorizations and it is same across both Instances. The Demand planner access is consistent too..
Will it be possible for you to advise on what could I be missing.

Hi All,
If it helps, in Quality: the Authorization checks are listed as: Subselection (Technical SUBNR) 1
while in Production it checks Subselection (Technical SUBNR) 1 in one place, however where it fails - the check happens as Subselection (Technical SUBNR) 0.
Is there a way we can change this to SUBNR 1. Is there any table entry that I can look at to check if the Authorization check is functioning incorrectly..
Please advise.. Thanks..
Regards,
Prakash

CRM - Process Flow of Authorization Check in Business Transactions

Hello Folks:
I have implemented CRM security using Process Flow of Authorization Check in Business Transactions.
What I have in place:
CRM_ORD_OP (inactive, don't want access to own documents)
CRM_ORD_LP (inactive, not using standard org level values Distribution Channel, Sales Group, Sales Office, Sales Organization, and Service Organization.)
CRM_ACT (active)
CRM_CMP (active)
CRM_ORD_OE (active, restricted to display with dummy value ' ' for Distribution Channel
Sales Group, Sales Office, Sales Organization and Service Organization, as we are not restricting on them)
CRM_ORD_PR (active and restricted to display)
Issue:
Restrictions to display for documents works fine when using CRM backend system and the system throws out a message that you are not authorized to change. But, when i come in through Portals (PCUI), i dont get the display at all and it throws out a message insufficient access authorizations.
Traces on backend CRM reveal failing on change access for CRM_ORD_LP and CRM_ORD_PR, which we dont want to give out b/c we dont want to provide change for documents.
OSS notes to SAP have resulted in no results....please advise what is wrong here.
Thanks
KT

Thanks for the Priyanka for the reply, but what you mention is not correct.
BSP errors are different from what I am refering to.
The issue is still open...and looks like a SAP bug, which even they havent been able to fix so far.
Regards,
KT

Add authorization check in Infopackage Scheduler for option 6-ABAP Routine

We want to add an authorization check in routine rssm_routines_maintain. This is in the Infopackage scheduler in the Data Selection tab under the column Type after selecting type=6(ABAP Routine). This is a core modification. We have checked with our Security team with traces and found nothing available to help us.
Two questions:
1) Is there any other way we can control who can create/change ABAP code by this method ?
2) Does anyone see this causing problems if we were to make a change to the routine to add code to do an authorization check.
Your help would be appreciated.
Robert Begin,
450-677-9411 or
514-924-4311
or email at [email protected]

Hi Chandran, we need to restrict a certain group of BW Developers from writing code in the abap routine (option 6 ) in the Infopackage of the Data Selection Tab in column Type.
The concern is that if having access to write abap code, a person can practically do as heéshe pleases with ABAP code and it is a concern.
Do you have any solution/suggestions to lock this down?
Much appreciated,
Regards,
Robert.

ESS: Who's Who Authorization Checks

Hi,
I am testing the ESS iView (tcode PZ01) in the Portal and it seems to be restricting the search results by my authorizations. I am not getting a full list of people in the system. Anyone know how to turn-off this authorization check?
I noticed this only happens when I changed the ESS Who's Who customizing in the IMG for PZ01. If I uncheck the checkbox 'Output fields list', then it checks authorzations. I'm thinking this has something to do with using the BAPI vs. using the query infoset, as the documentation states.
Message was edited by:
Kenneth Moore

Old post but I have had a similar issue and it was caused by P_ORGIN
Infortype 0105 subtype?????
Seem if the subtype is restricted then they are not displayed if subtype populated in the HR record.

Authorization Check for Special Stock Indicator in IE02

Dear Gurus,
Would like to check with you if there is an authorization check for change in Special Stock Indicator in IE02-SerData Tab?
For example, the User will only be allowed to change the Special Stock Indicator only to "E" - Sales Order.
Would appreciate your help.
Thanks.

Hi,
This cannot be done by using standard auth object. Standard SAP doesnt support control via this field.
Take help of your ABAP team and create an customized authorization object "Z_OBJECT" with field SOBKZ and which check these field value in table EQBS. Assign this auth object to role and profile you want.
Use the user exit IEQM0003 Additional checks before equipment update. Give a logic to check auth object when while using equipment change tcode.

Authorization check

Hi ,
i new to authorization so i need help ,
i go to transaction SU21 and i choose some object for example:
Object R_CPM_BSC
Text Authorization Object SEM: BSC Elements
Class SEM Strategic Enterprise Management*
Author STASTNY
Field name Heading
SEMSCARD Scorecard
SEMOBJTYPE Scorecard Elements: Object Type
SEMOBJKEY Scorecard Elements: Object Key
ACTVT Activity
And when i push on permitted activities i get:
R_CPM_BSC Authorization Object SE
ACTVT Activity
activists
01 Create or generate
02 Change
03 Display
04 Print, edit messages
1. i have always just permitted activities for ACTVT ?
if i wont that user just have display Authorization how i have to write it like below?
AUTHORITY-CHECK OBJECT R_CPM_BSC
ID ACTVT FIELD '03'
thats it i don't use the other fields?
Regards

Hi,
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.
If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.
This means you have to allocate an authorization object in the definition of the transaction.
For example:
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.
Thanks
Vikranth

Bom changes

Hi
When i add any items in bom then system creates change documents.
In that changed document only table name stpo and table key is coming but system does not show which component is added.
How to get log for component which are adde?

Dear Mayuresh,
are you using ECM or not
if not check with CS80, AUT10
if using then Go to CC03 input change number & check the changes made
Regards
Madhu

Authorization Check when logon into SAP via ITS

Hello
We have implemented Authorization Check after user have logged on to SAP via ITS in this User Exit SUSR0001. It was working fine in 46C version, but after upgrade to ERP 2005, when user logs on into SAP via ITS, this user exits is ignored, while logging normally via SAP GUI; authorization check is performed as before?
Did anyone else have experienced the same problem?

From what I understand something on that line changed. We are still hanging on to our external ITS 6.20 so I am afraid I can not go into details.

Bom Changing Authorization Check (CS02,CS62)

Similar Messages

Maybe you are looking for