Regarding authorization checks

Question

Dear forumers,
I have a new custom transaction code, and this transaction code is defined for a custom report program.
The custom report program provides end users with an interface to view and manually maintain data records in a custom table.
I wish to add authorization checks to this via SU24. After doing this, however, I noticed that if a user without the necessary authorization is unable to access the custom transaction code, he is still able to run it via SE38 by entering the custom program name.
How can this be resolved - so that, for a user who does not have the sufficient authorization, he cannot access both the transaction code and the program name manually?
Appreciate any advice on this at all. Thanks.

Answer 1

If that is a custom program you can put the following in your program code before processing starts, right after START-OF-SELECTION and throw an error message if the function returns anything other than value 2. Replace VA42 with your transaction code
This will ensure that the user won't be able to executed it in SE38 even, if they don't have authorization to execute the transaction
CALL FUNCTION 'AUTHORITY_CHECK'
       EXPORTING
            user                = sy-uname
            object              = 'S_TCODE'
            field1              = 'TCD'
            value1              = 'VA42'
       EXCEPTIONS
            user_dont_exist     = 1
            user_is_authorized  = 2
            user_not_authorized = 3
            user_is_locked      = 4
            OTHERS              = 5.
IF sy-subrc NE 2.
  MESSAGE TYPE 'E'....
ENDIF.