SAP_FI_AP_VENDOR_MASTER_DATA

Question

We require an authorisation / activity group to allow postings to one-time vendors ie. only allow a user with this access the ability to post to OTVs.
Is there an authorisation object that allows postings to particular vendor master records or preferably a vendor
account group?
The only SAP provided role I could find was: SAP_FI_AP_VENDOR_MASTER_DATA.  Are there any others anyone knows of that can be used to achieve this requirement?
Any assistance would be appreciated. Thanks.

Answer 1

Hi Benjamin,
Most of SAP works in this way.
If the master record does not have an authorization group on it and the user does not have any
authorization for a non-existing authorization group, then in SAP logic they
"match" and the authority check is "passed" by virtue of the check not being performed.
Take a look in tcode SU21 and the documentation on F_BKPF_BEK:
Definition
Using this authorization object, you determine for which vendor accounts line items can be
posted and processed.
Note
This authorization is optional.
The authorization group does not only have an effect when working with the accounts,
but also when working with the master records. If you assign this authorization when
working with accounts, you must also assign an authorization for the
corresponding authorization group when working with the master records. The authorization
object for this is called "F_LFA1_BEK".
Defined fields
The object consists of the fields "Authorization group" and "Activity". The authorization
group can be freely defined by the user. You take the possible input values
for the field "Activity" from table TACTZ.
Procedure
If you want to use this authorization, proceed as follows:
define the authorization which you want to assign to selected employees, in
which you list the authorization groups and the activities allowed.
allocate this authorization using the corresponding profile.
enter an authorization group in the master records which are specifically to
be protected. You can enter an authorization group in either the general
or in the company code-specific area of the master records.
An (initial) exception is S_TABU_DIS. If the standard SAP utility transactions are used,
then a table without an authorization group is given a "symbolic" authorization
group called '&NC&' which is checked. So you should seriously try to avoid
giving users access to this symbolic auth group. In the case of account groups,
s_program groups, etc it is a bit different as the check is only performed when
a security measure is found to have been required.