Protocol of failed authority check - analogue to SU53

Hello
I'm looking for way to retrieve the last failed authority check when a user interacts with a WDA application. Transaction SU53 seems not to protocol such failed authority checks when executed in WDA runtime.
Thanks,
Mathias

Similar Messages

Analize authority checks in web dynpro processing

Hi,
I'm facing strange things here.
A user was reported not to be able to successfully use a function provided in our system:
We provide a function for use of our call center agents that will reprocess and output document and send it by mail to the customer. It looks as if it worked but the mail is not sent.
I started SE80 with my own user and put some external breakpoints in the webdynpro code for the agents username. Then I started the webdynpro application by entering the URL into the browser and logging in with the agent's credentials.
On my first try, the debugger started ehen the external breakpoint was reached. SY-UNAME was the agent's name but everything went fine.
Obviously the authority checks where done for my own user although there was a different sy-uname.
I logged off completely and started a second time. I used my owner user to set the external breakpoints because the agent's user has no rights for development, just restricted to a couple of roles.
This time I got a rabax state error - the dump was caused because the agent's user does not have authority for debug. The rabax error shoed me the call hierarchy and pointed to the method where I set the external breakpoint.
So, is the any way to come close to the code where authorization check fails?
Or - which we could try: What are the roles/profiles for use of SAPOFFICE? (in SU53, we can see failed checks, but it looks strange as there are failed authority-checks for ...ADMIN - dont know exactly because now I', home and don't have remote access).
Good ideas always welcome!
Note: Nobody knows why this function is implemented in Webdynpro but we have to live with it and get it working for this group of agents.
Regards
Clemens

Traditionally I would probably have used ST01 with the "Authorization check" option and general filters to log which authority checks are working / failing.
But now I quite like using ST05 (SQL Trace) instead as drilldown to the code is available ... you can tick the "Buffer Trace" option and "Activate Trace with Filter" to log the other user's calls - this will then display lots of references to tables USOBX_C and USRBF2 - drilling to the code on these usually gives you the "authority-check object 'xyz' .." details.
Jonathan

Authority Check on Table - Restrict Entries based on check

Hi,
I need to add an authorization check to a table.
The check will restrict certain entries from displaying, based on the check of some table fields.
The table is custom and I know which authority object to use, as well as which fields to restrict.
How do I do this?
Thanks!

Hi N.,
select all data into internal table, loop at the table, do authority check for each table, delete records that fail authority check, display results.
Or use SELECT INTO structure, check authority , append if authority check is OK (SY-SUBRC = 0), ENDSELECT, then display.
Try which way is better based on memory requirement and performance.
I hope this answer will help you. If not, feel free to ask for details.
Regards,
Clemens

Web Service Homepage: Authority check failed

Dear Colleagues,
I have created a Web Service and now I want to test it via its Web Service Homepage (TA WSADMIN). The Homepage is displayed correctly, but testing leads to an error:
Authority check failed
Are there any prerequisites I maybe do not accomplish?
(I tested a very similar web service in another system, and there it works)
Here are some more information about my service:
- Service was build with Web Service Wizzard out of a function module
- Here you can see the conversation resulting of the test:
POST /sap/bc/srt/rfc/sap/Z_TEST_Q73_CONFIG_WS?sap-client=003 HTTP/1.1
Host: bsl8011.wdf.sap.corp:50073
Content-Type: text/xml; charset=UTF-8
Connection: close
Cookie: <value is hidden>
Cookie: <value is hidden>
Authorization: <value is hidden>
Content-Length: 381
SOAPAction: ""
<?xml version="1.0" encoding="UTF-8" ?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema">
<SOAP-ENV:Body>
<ns1:Z_TEST_WS_CONFIG xmlns:ns1='urn:sap-com:document:sap:rfc:functions'>
<INPUT>TEST</INPUT>
</ns1:Z_TEST_WS_CONFIG>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
HTTP/1.1 500 Internal Server Error
content-type: text/xml; charset=utf-8
content-length: 363
sap-srt_id: 20060404/125124/v1.00_final_6.40/1B0831447838C429E10000000A424016
server: SAP Web Application Server (1.0;700)
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/">
<soap-env:Body>
<soap-env:Fault>
<faultcode xmlns:n0="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">n0:FailedAuthentication</faultcode>
<faultstring xml:lang="e">Authority check failed</faultstring>
</soap-env:Fault>
</soap-env:Body>
</soap-env:Envelope>
The WSDL-Document looks as follows:
<?xml version="1.0" encoding="utf-8"?><wsdl:definitions targetNamespace="urn:sap-com:document:sap:rfc:functions" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="urn:sap-com:document:sap:rfc:functions" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><wsdl:types><xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:tns="urn:sap-com:document:sap:rfc:functions" targetNamespace="urn:sap-com:document:sap:rfc:functions" elementFormDefault="unqualified" attributeFormDefault="qualified"><xsd:simpleType name="char60"><xsd:restriction base="xsd:string"><xsd:maxLength value="60"/></xsd:restriction></xsd:simpleType><xsd:element name="Z_TEST_WS_CONFIG"><xsd:complexType><xsd:sequence><xsd:element name="INPUT" minOccurs="0" type="tns:char60"/></xsd:sequence></xsd:complexType></xsd:element><xsd:element name="Z_TEST_WS_CONFIGResponse"><xsd:complexType><xsd:sequence><xsd:element name="OUTPUT" type="tns:char60"/></xsd:sequence></xsd:complexType></xsd:element></xsd:schema></wsdl:types><wsdl:message name="Z_TEST_WS_CONFIG"><wsdl:part name="parameters" element="tns:Z_TEST_WS_CONFIG"/></wsdl:message><wsdl:message name="Z_TEST_WS_CONFIGResponse"><wsdl:part name="parameters" element="tns:Z_TEST_WS_CONFIGResponse"/></wsdl:message><wsdl:portType name="Z_TEST_Q73_CONFIG_WS"><wsdl:operation name="Z_TEST_WS_CONFIG"><wsdl:input message="tns:Z_TEST_WS_CONFIG"/><wsdl:output message="tns:Z_TEST_WS_CONFIGResponse"/></wsdl:operation></wsdl:portType><wsdl:binding name="Z_TEST_Q73_CONFIG_WSSoapBinding" type="tns:Z_TEST_Q73_CONFIG_WS"><soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/><wsdl:operation name="Z_TEST_WS_CONFIG"><soap:operation soapAction=""/><wsdl:input><soap:body use="literal"/></wsdl:input><wsdl:output><soap:body use="literal"/></wsdl:output></wsdl:operation></wsdl:binding><wsdl:service name="Z_TEST_Q73_CONFIG_WSService"><wsdl:port name="Z_TEST_Q73_CONFIG_WSSoapBinding" binding="tns:Z_TEST_Q73_CONFIG_WSSoapBinding"><soap:address location="http://bsl8011.wdf.sap.corp:50073/sap/bc/srt/rfc/sap/Z_TEST_Q73_CONFIG_WS?sap-client=003"/></wsdl:port></wsdl:service></wsdl:definitions>
Can anyone help me, I have no Idea
Message was edited by: Hans-Peter Bauer

The message server defined in the SAP-Logon is us4278.wdf.sap.corp
But the url of the web service starts with http://us4185:58500/wsnavigator/jsps/explorer.jsp?description=WebServiceZ_TEST_Q73_CONFIG_WS
But I think that's not the problem, is it? As I mentioned above the test page can be shown, but the after filling in the input parameters an pressing send, there appears the authorisation error.
For better illustration I made some screenshots for you:
1) http://wipux2.wifo.uni-mannheim.de/~wi01211/sonstiges/WS_HOMEPAGE_OVERVIEW.gif
2) http://wipux2.wifo.uni-mannheim.de/~wi01211/sonstiges/WS_HOMEPAGE_TEST_INPUT_FORM.gif
3) http://wipux2.wifo.uni-mannheim.de/~wi01211/sonstiges/WS_HOMEPAGE_TEST_reqest_response.gif
What can be wrong, if the error "n0:FailedAuthentication" appears?
Regards,
Peter
Message was edited by: Hans-Peter Bauer

Authority Check Failed

I have created a Web Service for a Function Module in ECC 5.0. I was able to generate the proxy using SE37--> Web Wizard. I can see the Web Service in WSADMIN, WSCONFIG, SICF.
I am using the WSADMIN and Test Tool to generate a request for testing the proxy hosted on my ECC 5.0 system. I am finding this particular error relating Authorization. We have granted most of the Authorzations. Any Clue on how to resolve?
Request Object
POST /sap/bc/srt/rfc/sap/ZWS_CONCATENATE_STRING?sap-client=100 HTTP/1.1
Host: sapdbs.foxboro.com:8000
Content-Type: text/xml; charset=UTF-8
Connection: close
Authorization: <value is hidden>
Content-Length: 559
SOAPAction: ""
<?xml version="1.0" encoding="UTF-8" ?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema"><SOAP-ENV:Header><sapsess:Session xmlns:sapsess="http://www.sap.com/webas/630/soap/features/session/"><enableSession>true</enableSession></sapsess:Session></SOAP-ENV:Header><SOAP-ENV:Body><ns1:Ztest4 xmlns:ns1='urn:sap-com:document:sap:soap:functions:mc-style'><Par1>str1</Par1><Par2>str2</Par2></ns1:Ztest4></SOAP-ENV:Body></SOAP-ENV:Envelope>
Response Object
HTTP/1.1 500 Internal Server Error
Set-Cookie: <value is hidden>
content-type: text/xml; charset=utf-8
content-length: 363
sap-srt_id: 20091117/102452/v1.00_final_6.40/4B02B94392E30041000000000A9BAC6E
server: SAP Web Application Server (1.0;640)
<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"><soap-env:Body><soap-env:Fault><faultcode xmlns:n0="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">n0:FailedAuthentication</faultcode><faultstring xml:lang="e">Authority check failed</faultstring></soap-env:Fault></soap-env:Body></soap-env:Envelope>
Thanks.

Hi,
This means your userid/password don't have sufficient authorization.
do following:
- Grant following authorization using SU01 : *WEBSERVICE* (search for all role with webservice)
- If above doesn't work then check if your user exist in visual admin secure store (java side). Usually visual admin secure store point to ABAP client for user sync but it is possible it is not configured to right client (instead pointing to client 001).
- check service with third party tool like SOAP UI (provide ur userid/password as well) - if it is working from here then it means you have problem with userid on java side (use visual admin to troubleshoot).
Regards,
Gourav

Authority check failed in FT2

I have tried to implement the PO create example as descriped in the document "Consuming Service Operations using SAP NetWeaver Studio". When I run the example I cannot create an order. I get the error "Authority check failed" when I try to run the example. I have entered the correct password, because, if the password is wrong I get a (401) Unauthorized from the server.
I have also tried to make a Webdynpro application which used the same service, with the same result.
I have also tried with a collages user, which gave the same error.
In the webgui for the FT2 system, it seems like the user does not have access to the PO create transaction (ME21).

Hi,
Which WAS should it be the I configured. The ESA or our own?
I have configured our own WAS as described in the tutorial. Here I tried to set up the username and password and I was able to send the request.
But I'm just accessing the test system and it is there I get the error.

Reg: webservice - authority check failed

hi friends
i have created a Webservice for FM- BAPI_COMPANYCODE_GETLIST . after creating that i have tested in the case then i found a error that
"An error has occurred. Maybe the request is not accepted by the server : Authority check failed "
what are the necessary authority checks has to be done.
Thanks & Regards
suman

Hi,
Which WAS should it be the I configured. The ESA or our own?
I have configured our own WAS as described in the tutorial. Here I tried to set up the username and password and I was able to send the request.
But I'm just accessing the test system and it is there I get the error.

Authority check error + su53 + autho object

Hello,
My userid is having misising authorization for one authorization object. We have the authorization object, but it is not included in any profile / role.
Please advice me how the authority check works?
Where do we need to inlcude the authority object , In a role or profile?
Thanks and regards,
Anand

please send a screen shot of your SU53 to your SAP security team - they will know what to do with it.

Airport Extreme ver. g Failed security check for my credit card processing!

Hope this hasn't just been addressed here but I signed up for a new credit card processing service and they have a company called securitymetrics that checks the level of safety for your cc processing setup.
I failed the check due to Airport Extreme settings and don't know how to fix it.
Short version:
failure 1:Your computer is answering ping requests. Hackers use Ping to scan the Internet to see if computers will answer. If your computer answers then a hacker will know your computer exists and your computer could become a hacker target. You should install a firewall or turn off Ping requests.
failure 2:It is possible to gather information about the remote base station (such as its connection type or connection time) by sending packets to UDP port 192. An attacker connected to this network may also use this protocol to force the base station to disconnect from the network if it is using PPPoE, thus causing a denial of service for the other users. Solution: Filter incoming traffic to this port and make sure only authorized hosts can connect to the wireless network this base station listens on.
Anyone know how to address these? I looked at the settings on Airport Utility and couldn't find anything.

You would enter 192 in both the Public & Private UDP/TCP entries. The Private IP Address would be an address of a non-existent device. For example, if the DHCP range is 10.0.1.2 - 10.0.1.200, enter 10.0.1.201 for this entry. (This, of course, would mean you do not have a client assigned this IP.)

AUTHORITY-CHECK & customized program

Hi,
I've applied an authority-check to my customized program. What I did was, I've created an authorization object name 'ZFI_PGRM' in SU21 and tie it with authorization fields BUKRS, ACTVT. This authority-check will validate on the company code (BUKRS) entered from the selection screen. Below are my lines in the customized program :
DATA: text      TYPE string,
          m_text TYPE string.
text = 'You are not authorised for Company Code'.
DATA: t_t001 LIKE t001 OCCURS 0 WITH HEADER LINE..
SELECT * FROM t001
       INTO TABLE t_t001
             WHERE bukrs IN s_bukrs.
LOOP AT t_t001.
AUTHORITY-CHECK OBJECT 'ZFI_PGRM'
      ID 'BUKRS' FIELD t_t001-bukrs
      ID 'ACTVT' FIELD '03'.
IF sy-subrc <> 0.
    CONCATENATE text t_t001-bukrs INTO m_text SEPARATED BY space.
ENDIF.
ENDLOOP.
At the same time BASIS tie the autorization object 'ZFI_PGRM' to the user role in order to access the program using PFCG. The problem now is the result that I'm getting always SY-SUBRC = 12 eventhough the user is allowed to access the company's report. Please help...
Haryati

Run transaction SU53 after the auth check fails and maybe it will give you a clue as to what is going on.

Getting error Failed to check in document from ODC to UCM 11g

Hi:
I am getting the below error while trying to commit image from ODC running on windows to UCM 11g running on linux
SEVERE Failed to check in document. Exception: {0}. Error is: oracle.stellent.ridc.protocol.http.HttpProtocolException: HTTP/1.1 302 Moved Temporarily
     at oracle.stellent.ridc.protocol.http.IdcHttpProtocol.writeRequest(IdcHttpProtocol.java:171)
     at oracle.stellent.ridc.IdcClient.sendRequest(IdcClient.java:140)
     at com.oracle.capture.UCM11g.Driver.checkIn(Driver.java:192)
     at com.oracle.capture.UCM11g.ComDriver.checkIn(ComDriver.java:42)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
     at java.lang.reflect.Method.invoke(Unknown Source)
     at com.jniwrapper.win32.com.server.IDispatchServer.invoke(SourceFile:209)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
     at java.lang.reflect.Method.invoke(Unknown Source)
     at com.jniwrapper.win32.com.server.CoInterfaceVTBL$VirtualMethodCallback.b(SourceFile:232)
     at com.jniwrapper.win32.com.server.CoInterfaceVTBL$VirtualMethodCallback.callback(SourceFile:135)
     at com.jniwrapper.Callback.enterPoint(SourceFile:222)
     at com.jniwrapper.Function.invokeCFunc(Native Method)
     at com.jniwrapper.FunctionCall.a(SourceFile:126)
     at com.jniwrapper.FunctionCall.call(SourceFile:34)
     at com.jniwrapper.Function.invoke(SourceFile:188)
     at com.jniwrapper.Function.invoke(SourceFile:212)
     at com.jniwrapper.win32.MessageLoopThread$LoopThread.run(MessageLoopThread.java:489)
Can anyone help me to correct this error?
Thanks & Regards,
Raj
Edited by: user13270764 on Dec 8, 2010 10:59 PM

Raj,
Are you using the 11g commit driver for ODC. Do you have the URL in the correct form:
http://Instance/web root//idcplg&AUTH=INTERNET
Thanks
Data_Bitz

User role and Authority-check ?

Hello,
Could you please let me know how are the differences between User role and Authority-check. In a program I do not use Authority-check , And The user is not assigned to user role which contain this transaction ( for this program), Can the user execute this transaction OR he must be assigned to user role which contain this transaction to execute it . Supposing that we do not use any Authority-check in then program.
Thanks in advance

Hello Martin,
I think this answers the OP's question about user not being assigned the role which contains the trxn code. As you have explained in this case the default auth. check for S_TCODE will fail & user cannot execute the trxv. (If i remember correctly the tables for this are AGR_USERS & AGR_TCODES)
Anyways just to add to the OP's query. Auth. objects are added to profiles which in turn assigned to roles. So if you implement the auth. object in your program the user must also subscribe to the role containing the auth. obj. profile to be able to execute it.
@OP:
The transactions PFCG & SUIM might interest you. Also the tables dealing with these stuffs begin with AGR*. You can check the tables for better understanding.
BR,
Suhas

How to debug a authority check in program and a authorisation object in tco

Can anyone tell me how to debug a authority check in program and a authorisation object in tcode
i just want to know the flow of authorisation object in debugging how user is assocaited with authorisation object and roles.
i know if sy-subrc ne 0 is authorisation failed ,so please help me anyone on this.
every time when i put breakpoint ,if its program level only, i am able to decide only through sy-subrc but iam unable o view the flow .

flow cannot be seen, we have to be based on sy-subrc only...
you cannot see the flow in read table... describe table... transfer...
the authorization object will be assigned to the data element, that data element has some realtion to the roles given to the users. So if the role of the user and data element value doesnt match the sy-subrc NE 0.

Urgent! Problem with authority-check

Hi all,
I encounter some wierd scenario with authority-check.
I try to run IW41 (create order confirmation) and the following authority-check
AUTHORITY-CHECK OBJECT 'C_AFKO_ATY'
       ID 'ACTVT' FIELD TMP_ACTVT
       ID 'AUTYP' FIELD ACT_AUTYP.
IF NOT SY-SUBRC IS INITIAL.
    MESSAGE E124 WITH SY-TCODE RAISING MISSING_AUTHORITY.
ENDIF.
was successful. However, when i try to run the FM CO_RI_CONFIRMATION_CREATE (use to create order confirmation), the exact same code is run and when i reach the above authority-check, it fails even if all the variable passed to the check is the same.
How can this happen? I need some help. Very urgent.

Hi Mil,
Check the values of TMP_ACTVT and ACT_AUTYP for both the cases.
May be they are different.
Reward points if useful.
Regards,
Atish

Help reg authority-check

Hi all,
can anyone explain what this statement does.
authority-check object 'Z_Abc_def'
id 'ZAbc_defI' field '*'.
Thanks in advance

Check the sap provided help:
here is an excerpt:
AUTHORITY-CHECK
Basic form
AUTHORITY-CHECK OBJECT object
    ID name1 FIELD f1
    ID name2 FIELD f2
    ID name10 FIELD f10.
Effect
Explanation of IDs:
object
Field which contains the name of the object for which the authorization is to be checked.
name1 ...
Fields which contain the names of the
name10
authorization fields defined in the object.
f1 ...
Fields which contain the values for which the
f10
authorization is to be checked.
AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).
You must specify all authorizations for an object and a also a value for each ID (or DUMMY).
The system checks the values for the IDs by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.
If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.
If the return code value in SY-SUBRC is 0, the user has the required authorization and may continue.
The return code value changes according to the different error scenarios. The return code values have the following meaning:
4
User has no authorization in the SAP System for such an action. If necessary, change the user master record.
8
Too many parameters (fields, values). Maximum allowed is 10.
12
Specified object not maintained in the user master record.
16
No profile entered in the user master record.
24
The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.
28
Incorrect structure for user master record.
32
Incorrect structure for user master record.
36
Incorrect structure for user master record.
If the return code value is 8 or 24, inform the person responsible for the program. If the return code value is 4, 12, 16 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP because authorizations have probably been destroyed.
Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.
Note
Instead of ID name FIELD f, you can also write ID name DUMMY. This means that no check is performed for the field concerned.
The check can only be performed on CHAR fields. All other field types result in 'unauthorized'.
Example
Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:
Table OBJ: Definition of authorization object
M_EINF_WRK
   ACTVT
   WERKS
Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations
M_EINF_WRK_BERECH1
   ACTVT 01-03
   WERKS 0001-0003 .
can display and change plants within the Purchasing and Materials Management areas.
Such a user would thus pass the checks
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0002'
    ID 'ACTVT' FIELD '02'.
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' DUMMY
    ID 'ACTVT' FIELD '01':
but would fail the check
AUTHORITY-CHECK OBJECT 'M_EINF_WRK'
    ID 'WERKS' FIELD '0005'
    ID 'ACTVT' FIELD '04'.
To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK.
Regards,
ravi

Protocol of failed authority check - analogue to SU53

Similar Messages

Maybe you are looking for