Custom transaction attached to SAP delivered code

Question

HI
We have a requirement that all custom program and transactions are secure. Usually we have the developers add an auth check statement to the program and add that check to the custom t-code in SU24.
today I have the situation that we are using SAP delivered code and attaching a custom transaction. Since we don't want to modify the SAP code, how is it possible to get any check on the transaction? I know that SU24 won't force the check unless the program is changed. So is there any way to have any type of auth object checked? Or is this a situation where no check would be needed and no objects added to the role when the new tcode is added? (SE93?)
Hope that makes sense!
Thanks
Bobbi

Answer 1

Here is where I run into problems. I am not a developer and have a hard time reading the code. This particular report is to display vendor address data. As far as I can tell I do not see anything that appears to be authority checks.
This is the top level of the code:
report AQZZZVEND=======ZVEND_ADDR====.
include /1BCDWB/IQG000000000055DAT.
data %dtab type standard table of /1BCDWB/IQG000000000055 with header line.
data %subrc type sy-subrc.
include /1BCDWB/IQG000000000055SSCR.
include /1BCDWB/IQG000000000055SSCRAT.
start-of-selection.
  if %runmode-extr_on <> space.
    call function '/1BCDWB/IQG000000000055EXTR'
         tables     %selopt = %seloptions
                    %dtab   = %dtab
         changing   %rtmode = %runmode
         exceptions no_data = 1
                    others  = 2.
    %subrc = sy-subrc.
    call function 'RSAQRT_CHECK_EXTR'
         exporting extr_subrc = %subrc
         tables    dtab   = %dtab
         changing  rtmode = %runmode.
  endif.
end-of-selection.
  if %runmode-show_on <> space.
    call function '/1BCDWB/IQG000000000055SHOW'
         tables   %dtab   = %dtab
         changing %rtmode = %runmode.
  endif.
   special code for old API and BW extractor calls
form %set_data changing p_lines type i.
  import ldata to %dtab from memory id 'AQLISTDATA'.
  describe table %dtab lines p_lines.
  free memory id 'AQLISTDATA'.
endform.
form %get_data tables p_dtab  structure %dtab
               using  p_first type i
                      p_last  type i.
  append lines of %dtab from p_first to p_last to p_dtab.
endform.
form %get_ref_to_table using p_lid   type aql_lid
                             p_ref   type ref to data
                             p_subrc type i.
  if p_lid = %iqid-lid.
    create data p_ref like %dtab[].
    p_subrc = 0.
  else.
    p_subrc = 4.
  endif.
endform.
================================================================================================
The abaper doesn't seem to understand what  I am asking of him so I am stuck. It appears this custom transaction will go in without any checks on it unless you can perhaps advise me on how to proceed. Any help is appreciated.