Protect sensitive HR tables from ABAPer and BASIS

Question

Hello
We are trying to work out some security authorizations where in we can protect HR master data through direct access to HR tables through SE16 or SM30 for info type tables like PA0008 or PA0015 etc. I know that these tables have authorization group 'PA' and we can build a role using S_TABU_DIS using this autho group but we have about 30 such infotypes to be protected. If we build a role with S_TABU_DIS and Auth group='PA' we will land up protecting all the Infotypes. Other problem is that if we create a new auth group 'ZPA' for these 30 infotype tables, thats too much customization as we might have problems during future upgrades.
My question to the forum members is - What solutions were explored or implemented for such situations?
Thanks
Snehal

Answer 1

Dear Snehal,
Maintain all such sensitive infotypes in a Z table. Implement a proper BAdi/Enhacement that will be called whenver user accesses the transactions that you want to restrict and validate against that Z table. If the entry exists in Z table raise an error message saying 'You are not authorized' else display.
You would need to bypass this validation for users other than ABAPer or BASIS. For that you may need to maintain proper naming convention or some logic.
Please check this sample program from other thread to find BADI and enhancement for a given transaction code. You just need to create a custom program in your system by cut and paste below codes.
REPORT ZTEST.
TABLES: TSTC,
TADIR,
MODSAPT,
MODACT,
TRDIR,
TFDIR,
ENLFDIR,
SXS_ATTRT ,
TSTCT.
DATA: JTAB LIKE TADIR OCCURS 0 WITH HEADER LINE.
DATA: FIELD1(30).
DATA: V_DEVCLASS LIKE TADIR-DEVCLASS.
PARAMETERS: P_TCODE LIKE TSTC-TCODE,
P_PGMNA LIKE TSTC-PGMNA .
DATA: WA_TADIR TYPE TADIR.
START-OF-SELECTION.
IF NOT P_TCODE IS INITIAL.
SELECT SINGLE * FROM TSTC WHERE TCODE EQ P_TCODE.
ELSEIF NOT P_PGMNA IS INITIAL.
TSTC-PGMNA = P_PGMNA.
ENDIF.
IF SY-SUBRC EQ 0.
SELECT SINGLE * FROM TADIR
WHERE PGMID = 'R3TR'
AND OBJECT = 'PROG'
AND OBJ_NAME = TSTC-PGMNA.
MOVE : TADIR-DEVCLASS TO V_DEVCLASS.
IF SY-SUBRC NE 0.
SELECT SINGLE * FROM TRDIR
WHERE NAME = TSTC-PGMNA.
IF TRDIR-SUBC EQ 'F'.
SELECT SINGLE * FROM TFDIR
WHERE PNAME = TSTC-PGMNA.
SELECT SINGLE * FROM ENLFDIR
WHERE FUNCNAME = TFDIR-FUNCNAME.
SELECT SINGLE * FROM TADIR
WHERE PGMID = 'R3TR'
AND OBJECT = 'FUGR'
AND OBJ_NAME EQ ENLFDIR-AREA.
MOVE : TADIR-DEVCLASS TO V_DEVCLASS.
ENDIF.
ENDIF.
SELECT * FROM TADIR INTO TABLE JTAB
WHERE PGMID = 'R3TR'
AND OBJECT in ('SMOD', 'SXSD')
AND DEVCLASS = V_DEVCLASS.
SELECT SINGLE * FROM TSTCT
WHERE SPRSL EQ SY-LANGU
AND TCODE EQ P_TCODE.
FORMAT COLOR COL_POSITIVE INTENSIFIED OFF.
WRITE:/(19) 'Transaction Code - ',
20(20) P_TCODE,
45(50) TSTCT-TTEXT.
SKIP.
IF NOT JTAB[] IS INITIAL.
WRITE:/(105) SY-ULINE.
FORMAT COLOR COL_HEADING INTENSIFIED ON.
Sorting the internal Table
sort jtab by OBJECT.
data : wf_txt(60) type c,
wf_smod type i ,
wf_badi type i ,
wf_object2(30) type C.
clear : wf_smod, wf_badi , wf_object2.
Get the total SMOD.
LOOP AT JTAB into wa_tadir.
at first.
FORMAT COLOR COL_HEADING INTENSIFIED ON.
WRITE:/1 SY-VLINE,
2 'Enhancement/ Business Add-in',
41 SY-VLINE ,
42 'Description',
105 SY-VLINE.
WRITE:/(105) SY-ULINE.
endat.
clear wf_txt.
at new object.
if wa_tadir-object = 'SMOD'.
wf_object2 = 'Enhancement' .
elseif wa_tadir-object = 'SXSD'.
wf_object2 = ' Business Add-in'.
endif.
FORMAT COLOR COL_GROUP INTENSIFIED ON.
WRITE:/1 SY-VLINE,
2 wf_object2,
105 SY-VLINE.
endat.
case wa_tadir-object.
when 'SMOD'.
wf_smod = wf_smod + 1.
SELECT SINGLE MODTEXT into wf_txt
FROM MODSAPT
WHERE SPRSL = SY-LANGU
AND NAME = wa_tadir-OBJ_NAME.
FORMAT COLOR COL_NORMAL INTENSIFIED OFF.
when 'SXSD'.
For BADis
wf_badi = wf_badi + 1 .
select single TEXT into wf_txt
from SXS_ATTRT
where sprsl = sy-langu
and EXIT_NAME = wa_tadir-OBJ_NAME.
FORMAT COLOR COL_NORMAL INTENSIFIED ON.
endcase.
WRITE:/1 SY-VLINE,
2 wa_tadir-OBJ_NAME hotspot on,
41 SY-VLINE ,
42 wf_txt,
105 SY-VLINE.
AT END OF object.
write : /(105) sy-ULINE.
ENDAT.
ENDLOOP.
WRITE:/(105) SY-ULINE.
SKIP.
FORMAT COLOR COL_TOTAL INTENSIFIED ON.
WRITE:/ 'No.of Exits:' , wf_smod.
WRITE:/ 'No.of BADis:' , wf_badi.
ELSE.
FORMAT COLOR COL_NEGATIVE INTENSIFIED ON.
WRITE:/(105) 'No userexits or BADis exist'.
ENDIF.
ELSE.
FORMAT COLOR COL_NEGATIVE INTENSIFIED ON.
WRITE:/(105) 'Transaction does not exist'.
ENDIF.
AT LINE-SELECTION.
data : wf_object type tadir-object.
clear wf_object.
GET CURSOR FIELD FIELD1.
CHECK FIELD1(8) EQ 'WA_TADIR'.
read table jtab with key obj_name = sy-lisel+1(20).
move jtab-object to wf_object.
case wf_object.
when 'SMOD'.
SET PARAMETER ID 'MON' FIELD SY-LISEL+1(10).
CALL TRANSACTION 'SMOD' AND SKIP FIRST SCREEN.
when 'SXSD'.
SET PARAMETER ID 'EXN' FIELD SY-LISEL+1(20).
CALL TRANSACTION 'SE18' AND SKIP FIRST SCREEN.
ENDCASE.
Alternatively, you can do the following:
1. For what ever transaction u want the enhancement .. just check for the System-->status (menu) and find out the PROGRAM name....
2. Double click on to the program name and go inside the program (Abap editor)
3. Search for "Call Customer-function " ... and u'll get some search results .. If u get results then u have enhancement in that tcode .....
4. Then it actually calls a Function module .... copy the Function module name .... go to SE80 (object navigator) click on "Repository Information system" then Customer Enhancements .... Give the Function module name in the "Components" field and click Execute ....
ull get a list of Enhancements related to that Componene....
5. Choose which ever enhancement will suit ur business need ..
6. Go to CMOD... create a project .... assign ur enhancement ... and then code ur logic.... activate ur enhancement in CMOD ....... Ur Buisness need will be solved...
For a user exit......
Finding whether there is any User Exit or not for tcode VA42
1. For what ever transaction u want the user exit .. just check for the System-->status (menu) and find out the PROGRAM name.... ( The program name would be for our scenario "SAPMV45A" )
2. Double click on to the program name and go inside the program (Abap editor)
3. Search for the word "USEREXIT" .... u ll find all the user exits in the search result .. and find ur's then ...
Hope this will help.
Regards,
Naveen.