HR Authorization Specific Scenarios.

Question

Hi all, i am faced with the following scenarios and trying to see if my solution is correct;
There is a group of HR Users in the company and each HR user in the HR department is not allowed to view each other's Personal Data. However the challenges come with this 2 exception;
1. 1 User is able to approve the leave of another, meaning there must be some maintenance access to allow Write to say IT2001 (Absences)
2. 1 or more HR users will run PAyroll for the HR department. Again, more infotypes need to be read in order to achieve this.
To separate the access within their own staff, i implement a value in IT0001-SACHP (value 001) so that they are restricted in their profile to their own HR Grouping. Their profile has all access except 001.
For the ability to approve Leave and also perform payroll, am i right to specify P_ABAP to say that i bypass IT check for the reports/programs related to the leave approval and Payroll run ?
Advice is greatly appreciated!

Answer 1

Hi,
I don't think P_ABAP bypasses Program authorization. It's for Reports.
To quote :
P_ABAP does not affect the authorization to start reports (this controls the program execution checks). Simplifies and accelerates additional individual checks in HR reports, or switches them off entirely.
If the user, as a general rule, is permitted to carry out uncritical reports (e.g. creating a list of telephone numbers), then do not assign an authorization for the object HR: Reporting (P_ABAP).
Using P_ABAP in HR Reporting:
You can use the relevant authorizations for this object to control how the objects P_ORGIN, P_ORGXX,
Customer-specific authorization object P_NNNNN are used in the specified reports to check the authorization of HR infotypes.
You can also use reports to control the infotype authorization check. This can be useful for functional reasons or to improve performance at runtime of the corresponding reports.
For this object, enter the report name(s) in the REPID field and the degree of simplification to be used for the authorization check in the COARS field.
The following degrees of simplification are possible:
COARS = <BLANK> or no authorization.
COARS = 1.The authorization checks for the infotype/subtype combination and for organizational assignment are to be checked separately.
This means that a user is authorized to read a personnel number when he or she has a read authorization for all the infotypes (subtypes) requested by the program and that the user has a read authorization for the organizational assignment of the personnel number.
COARS = 2. The authorization check is inactive.
Note that an ABAP authorization for report SAPDBPNP with COARS = 2 means that all HR reports based on the logical databases PNP or PAP (nearly all reports) cannot perform any more authorization checks. In general, you will only want to deactivate the authorization checks for a very small number of Reports. In case of doubt, do not assign your users authorizations for the P_ABAP object.
Futhermore, this authorization object differs from the object S_PROGRAM (ABAP: Program Run Checks).
The latter is used for _general program authorization checks.
In HR reports, these checks are carried out in addition to the HR infotype authorization check. HR Reporting, however, overrides the HR infotype authorization check for selected reports, with the result that the authorization checks are weakened or completely switched off.
SAP_EMPLOYEE_ERP is available only in mySAP ERP 2004 ;
Regards,
Remi