Copying values of a singular authorization object between roles?

Suppose I have an authorization object assigned to a role and its fields hold a large amount of data (say S_TCODE with a lot of transaction codes specified via ranges). Suppose further that I want to have this same object with this same data in another role. The other objects of the two roles are different and I'd rather not type the large amount of data into the authorization object again.
Is there a way to copy/paste just one authorization object between two roles?
I know how to make a copy of an authorization object and its values within the same role, but I haven't found a way to copy between roles.
ursa

Hi Ursa,
I havent come across any export object kinda thing...
This may help you in practical situation...
Let us consider your particular requirement related to s_tcode.
for that go to suim -
transactions -> executable for role .
Give the role name get the list of transaction codes.
Download into excel file. then copy from there and paste into your new role menu or in s_tcode object.
Mostly we dont get that much list for other objects.
One more thing you can do.
click on display tab beside the object in your source role, you get the list window.
type ctrl + Y and then copy the 7-8 lines and paste it in the object of new role.
Cheers.
Shamish
Message was edited by:
Shamish Lele

Similar Messages

Authorization Object And Roles For Functional Consultant

Dear Expert,
What kind of respective Authorization Object And Roles would be provided to Functional Consultant (FI,MM, SD, PM, PS, CO, HR )at the time of implementation ?
Thanx in advance
Pavel

Thanks Juan,
We now already have it here and in the NW IDM forum a few times as well...
Cheers,
Julius

Programmatically assigning Authorization Objects to roles

Hi there,
I have created an authorisation object with eight fields. The fields control which parts of my application are accessible to the user. (Each field is one category, each category has several subcategories).
What I want to do is the following:
There shall be a custom authorization dialog, wherein the system administrator can configure the access of the application for a specific user.
In plain text: I want to develop an interface which makes it possible to assign authorisation objects with specific values to a user or to an already existing role.
Is there any functionality, that allows me to perform this assignment and regenerate the users profile?
I already discovered, that the table UST12 contains the connection between the authorization profile of a role and an authorization object, as well as the assigned values. Anyhow, just to write new values to that table has no affect to the authorization when calling "authority-check object" in an ABAP report.
Does anyone know, whether there are standard functions in the ERP System, that support the changing of authorization objects and the regeneration of roles?
Thank you very much,
Gregor
Edited by: Gregor Bender on Mar 11, 2008 8:41 AM

>
Gregor Bender wrote:
> I already discovered, that the table UST12 contains the connection between the authorization profile of a role and an authorization object, as well as the assigned values.
Nope, sorry, it's not the connection but only one of the many.... Roles and profiles are stored in quite a lot of different tables so manipulating one table directly will hardly ever get you the desired situation. It may even lead to problems due to inconsistencies.
For mass regenerating profiles there's transaction SUPC.
For manipulating the contents of roles/profiles have a look at scripting with SECATT or LSMW in combination with PFCG.
If you want to write code to add objects to roles you have to look at least in tables AGR_1250, AG_1251 and AGR_1252. The UST* tables are updated when generating profiles and/or comparing users.

Open Authorization Objects in role after role Transport

Hi All,
I have transported a R/3 (ECC6, support) role from Dev to QA and Dev (Multiple clients). After transport, Role has authorization tab with status (green) but when i display authorization data i found one new open authorization object (yellow).
I already have generated profile before tranporting. Role is also okay in Dev other clients (We have multiple clients in Dev) with status green and no open authorizations (yellow)
Any feedback/suggestions ?
Thanks in advance
Khasim.

This happens when PFUD runs at the same time as you are generating the role. Refer to this note: 355030 - Loss of authorizations after profile generation. Another remote reason could be if your source (DEV) and target (QA) systems use different characters sets. (Note #535554).
If it is the former case, re-transporting your role may just be the solution for you. Just re-generate the role in DEV and initiate a new transport.
Hope this helps.
Ashutosh

New Authorization Object within Role

hi everybody,
does anyone know how can i get New Authorization Objects for any Role for the new release that did not exist in the same Role from former release?
tables AGR_1250 and AGR_1251 do not show if object is new for this role. they only show if object is new itself.
thanks a lot,
javier rubio

pandu,
se54 is not related with this topic.
thank you very much for your answer, very hepful

Authorization Object for role creation for query display?

Hi,
Can Anybody here tell me what is the Authorization object that we use for role creation for query display?
I want to assign a role to the newly designed query! that query does not have any role so far!
Pls suggest me
Thanks,
Ravi

Hi,
I could make the authorization tab green by entering the authorization object!
But user tab still remains red as it is not allowing me to enter my username in the user tab!
in the user tab i am unable to enter my user name?
Any suggestions?
Thanks,
Ravi

Copy object from one authorization object classe to another one

Hello experts,
due our revision we have the demand to copy our custom context sensitve authorization object from the old authorization class to a new one.
Ist this generally possible? What are the impacts?
Any ideas?
Many Thanks!
Marco

> due our revision we have the demand to copy our custom context sensitve authorization object from the old authorization class to a new one.
That is a strange revision (audit) demand... Did you challenge them whether they have ever done this before and survived as release upgrade?
Is SAP_ALL otherwise okay for them? For example that people can write their own programs or maintain PRGN_CUST to include Z-classes again...
Have you tried to simply remove all profile assignments to SAP_ALL and replace them with proper roles and restrict SAP*'s HR profiles to that which applies to all users which are not employees?
You are definately barking up the wrong tree here by moving SAP objects to Z object classes and expecting it to be secure...
Cheers,
Julius

Role creation and authorization objects in sap

Hi
i want to know the full relationship between creation of roles , authorization objects ,authorizations in web as abap
Please explain the process in detail the use of PFCG and all its options and how to create Z roles

Although, It would be a very long document to explain the query, I have briefed you on the concept. I hope it leads you well.
- Roles are nothing but a container for authorizations. A role represents a specific part of an employeeu2019s job.
- The R/3 authorization concept permits the assignment of either general and/or finely detailed user authorizations. These assignments can reach down to transactions, field and field value level.
For e.g. If a user wants to create a PO we can restrict him on:
u2022     Activity : Create/Change/Display
u2022     Org elements like Company Code, Plant, Purchase Organization etc
u2022     Document type etc.
- Authorization objects are grouped in an object class such as Materials Management: Master Data (MM_G). Each Object Class may have several authorization objects and within each object we can have several authorizations (max. up to 99).
- Fields :The permissible values for the fields constitute the authorization. For e.g. ACTVT (Activity) is a field with permissible values of 01 (Create), 02 (Change) & (03 Display) for the object M_MATE_CHG (Material Master: Batches/Trading Units). Value * for field BEGRU signifies all possible values.
- An authorization allows you to carry out an R/3 task based on a set of field values in an authorization object. By themselves authorizations do not exist and they only have a meaning inside a profile
- Authorizations are contained within profiles and these profiles are assigned to users manually or automatically via role assignment. When you assign the field values for all the authorization objects and save system will auto generate a profile name.
- Authorization check are included in the transactions source code in standard SAP R/3.A user may carry out an action if the authorization check is successful for each field in the object.
Edited by: Subramaniam Iyer on Nov 27, 2008 12:08 PM

Authorization Object and Authorization...!!!

Hi BW Experts,
Could anyone plz tell me what is the difference between Authorization Object and Authorization..!!!
Thanks in Advance.
Regards,
Giftedbrain.

Giftedbrain,
Authorization Object:
An authorization object groups up to ten fields that are related by AND.
An authorization object allows complex tests of an authorization for multiple conditions. Authorizations allow users to execute actions within the system. For an authorization check to be successful, all field values of the authorization object must be appropriately maintained in the user master.
Authorization objects are divided into classes for comprehensibility. An object class is a logical combination of authorization objects and corresponds, for example, to an application (financial accounting, human resources, and so on). The line of the authorization object class is colored orange in the profile generator.
For information about maintaining the authorization values, double click an authorization object.
The line of the authorization object is colored green in the profile generator.
Authorization:
Definition of an authorization object, that is, a combination of permissible values in each authorization field of an authorization object.
An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
Authorizations allow you to specify any number of single values or value ranges for a field of an authorization object. You can also allow all values, or allow an empty field as a permissible value.
If you change authorizations, all users whose authorization profile contains these authorizations are affected.
As a system administrator, you can change authorizations in the following ways:
· You can extend and change the SAP defaults with role maintenance.
· You can change authorizations manually. These changes take effect for the relevant users as soon as you activate the authorization.
The programmer of a function decides whether, where and how authorizations are to be checked. The program determines whether the user has sufficient authorization for a particular activity. To do this, it compares the field values specified in the program with the values contained in the authorizations of the user master record.
The line of the authorization is colored yellow in the profile generator.
-Doodle

Restrict a t.code VK11 using Site as authorization object

Hi all,
We want to restrict VK11 t.code using Site as one of the authorizations. By default it has only Sales Org, Distr channel and division. I've added one more field for "Site" manually.
We have defined specific values for Site in authorization objects. Still system does not restrict VK11 executed by user as per site. It works with Sales org/Distr ch/Division. But it does not restrict Site-wise for that role.
Please help.
Regards,
Ankush

> I've never got past 'play dead' with such objects
Yip, I know that feeling. It is like when you leave home for a long trip having packed everything you need, but you still have the feeling that you have forgotten something important behind and will kick yourself when you need it.
> Can you please provide step by step instructions for that?
There is no step-by-step procedure nor medication to take for it. You just have to wait for it to dawn on you...
Enjoy the weekend and happy coding authority-checks,
Julius
ps: I heard that this feeling is also caused by the rising popularity of ABAP OO programming techniques, where the checks are often natively imbedded.

Authorization object for "add approver" in contracts

Hello, Experts,
I am looking for authorization object for adding approver in contracts.
But without adding authorization for changing contracts.
Regards,
Rami Kleiman - HP

1. you can try to restrict the authorization object ( Manager Role-- /SAPSRM/MANAGER) for contracts to display ( remove the change).
2. you can also change the personalization object key "BBP_WFL_SECURITY" to None ( but i, think this will affect all the objects like shopping carts purchase orders etc..)
Thanks
velu

Authorization object per systems

HI,
1. There is different authorization object in different systems (like R3 BW CRM) .
2. When we get R3 system we get out of the box authorization object and roles like for admin ...
or we have to build it?
Regards

The Netweaver "Basis" AS ABAP for example has it's objects, regardless of which components are installed. E.g. S_DEVELOP, S_DATASET, S_RFC, etc etc etc. See the BC* classes.
The application components also have their own objects (assigned to the packages of those components).
SAP does provide some roles as templates and profiles to get you started if you have nothing else (E.g. the SAP* roles and SAP_ALL profile), as well as portal roles for which you need to build the backend authorization for, as well as nothing other than the SU24 check proposals from which you need to building your own role from scratch depending on your business process design (choice of transaction).
In some cases, absolutely nothing is delivered except the coding. Those are the real buggers.
Cheers,
Julius

How to find a autorization object and roles for paricuu00F6llar documetytpe(DMS

Hello,
I have a question,Its urgent ..#
For a particular document type (for example PPN)..
How to find a authorization object and roles...Please let me know.
In the DIS which autority object and roles they use it for this.
<REMOVED BY MODERATOR>
Regards
preethi
Message was edited by:
Alvaro Tejada Galindo

This issue seems to be resolved since jDeveloper/ADF 11.1.1.3.
Am I true?

How to find a autorization object and roles for paricuöllar documetytpe(DMS

Hello,
I have a question,Its urgent ..#
For a particular document type (for example PPN)..
How to find a authorization object and roles...Please let me know.
In the DIS which autority object and roles they use it for this.
Reward with full points
Regards
preethi

This issue seems to be resolved since jDeveloper/ADF 11.1.1.3.
Am I true?

Authorization Object Values

Hi All,
There's an authorization object called P_ORGINCON. It has 8 different fields and respective values. Now, one of the fields has '' as a value (two continuous single quotes, without space between them) and another field has ' ' as a value (continuous single quotes, with space between them).
What is the difference between both the values i.e., the two different quotes with and without spaces.
It would be 'rewarding' if someone can help me on this
Cheers,
Ravi

Hi
In general different users will be given different authorizations based on their role in the orgn.
We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.
USe SUIM and SU21 T codes for this.
Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.
If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.
This means you have to allocate an authorization object in the definition of the transaction.
For example:
program an AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT <authorization object>
ID <authority field 1> FIELD <field value 1>.
ID <authority field 2> FIELD <field value 2>.
ID <authority-field n> FIELD <field value n>.
The OBJECT parameter specifies the authorization object.
The ID parameter specifies an authorization field (in the authorization object).
The FIELD parameter specifies a value for the authorization field.
The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.
You program the authorization check using the ABAP statement AUTHORITY-CHECK.
AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'
ID 'ACTVT' FIELD '02'
ID 'CUSTTYPE' FIELD 'B'.
IF SY-SUBRC <> 0.
MESSAGE E...
ENDIF.
'S_TRVL_BKS' is a auth. object
ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.
The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.
This Authorization concept is somewhat linked with BASIS people.
As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.
Take the help of the basis Guy and create and use.
Reward points for useful Answers
Regards
Anji

Copying values of a singular authorization object between roles?

Similar Messages

Maybe you are looking for