How do I check authority for a screen element

Question

Hello friends,
I've been assigned to work on the following problem:
In an ABAP  program, in fact PAI of a screen, I must add the authority check for a screen element (which is based on a Z table element).
That is to say, some users must be allowed to edit the screen element, while the others are only allowed to display.
I was told to look at the AUTHORITY-CHECK statement. It talks about ID and FIELD and other stuff. I find this statement very cryptic and I have no idea what these things are and how to use them. So the questions are:
1) Can I use it to restrict the ability of changing contents of a screen element?
2) If yes how do I do it? That is to say, what ID, FIELD, value, etc. do I use?
3) If not, how else can I do this?
Your help is greatly appreciated.

Answer 1

Hi Goharjou,
Answers to your questions:
1) Can I use it to restrict the ability of changing contents of a screen element?
Yes you can use AUTHORITY-CHECK to restrict the ability of changing contents of a screen element.
2) If yes how do I do it? That is to say, what ID, FIELD, value, etc. do I use?
Let me explain you with an example. Assuming your screen field is ZTABLE-COLOR and will have values such as 'GREEN', 'BLUE', 'RED', etc.
Depending on the authorization of the current user, you can restrict the access such as 'CREATE', 'CHANGE' and 'DISPLAY'. Let us talk about creating an authorization object later. First let us assume that there is an authorization object you have created named 'ZAUTH_COLOR' with two fields 'COLOR' and 'ACTVT'. The field 'ACTVT' is a standard SAP feature for checking the above authorization. The possible values are '01' (Create), '02' (Change) and '03' (Display). The field COLOR is your field we spoke earlier.
In the PAI event, you will check authorization through the following statement (for example you want to check whether current user has got change authorization for the color entered):
AUTHORITY-CHECK OBJECT 'ZAUTH_COLOR'
  ID 'COLOR' ztabe-color                                     "This will be color entered by user
  ID 'ACTVT' '02'.                                                 "Change authorization
IF sy-subrc NE 0.
*& Here do whatever you want like setting a flag and
*& later in the PBO event, disable some functions / screen-elements
*& Or raise an error message straight away
*& or raise an information message and remove whatever color
*& user has entered for which authorization is not there 
ENDIF.
Now let us talk about how the authorization object will be created and how system knows that the current user has such-and-such authorization for the color in subject:
Through SU21 tcode, you will create the authorization object ZAUTH_COLOR with two fields
   (1) COLOR
   (2) ACTVT
Maintain possible activities checking all of them '01', '02', '03'.
Provide the above information to your BASIS administrator. Your Basis admin will assign this authorization object to the user through roles and assign appropriate values for the user profile. e.g. user1 will have authorization for only ACTVT='03' (Display), user2 will have ACTVT=* (all activities), etc. As a developer, you dont have to worry about this. All that you need to do is create the auth-object, communicate to the administrator and change your program to incorporate AUTHORITY-CHECK statement.
3) If not, how else can I do this?
Not applicable
Hope the above helps you and solves your problem.
Regards
Suresh Radhakrishnan