topic Re: find authorization object value for user in Application Development and Automation Discussions

find authorization object value for user

Former Member — Tue, 16 Dec 2008 15:48:17 GMT

Hello Friends,

Do you know of any Function module or transaction that tells if a particular user has authorization to a given authorization object?

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 15:53:21 GMT

SU53 will tell you if an authorization check has failed for a user... also which values exist in the user's role for the failed object (if any).

Other than that, report RSUSR002 (reachable via transaction SUIM) is a good candidate.

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:00:42 GMT

Hi,

i want to know that how many unique objects are assign to particular user along with field value in that object. It is for to find out the exccess authorization assign to that user with values.

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:02:12 GMT

Take a look at report RSUSR008_009_NEW.

Other options are the GRC products.

Cheers,

Julius

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:07:33 GMT

Hi,

i dont have GRC or any other tool. i wanted to do it from sap level or from any ABAP program

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:17:04 GMT

The first report I mentioned is an ABAP report tool included in the standard system.

Cheers,

Julius

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:22:21 GMT

it is not working in my SAP system(4.6 B) and RSUSR008 is for to check transaction combination critical for security

Re: find authorization object value for user

Private_Member_119218 — Tue, 16 Dec 2008 16:25:47 GMT

Like Trond pointed out - use transaction S_BCE_68001397.

You can access it from transaction (actually a menu) SUIM.

Navigation path under SUIM:

/User/Users by Complex Selection Criteria/By Authorization Values

This will let You enter the authorization object and specify authorization values for the object (if you want to).

Another candidate is S_BCE_68001396. The navigation path is the same, the selection is simplified to auth. object only.

Both transactions are just different variants of the same program - RSUSR002.

(Learn SUIM, it's any user admin's bestest friend.)

If you don't mind, could you please explain what are You going to use this information for? It would be a shame if you'd misinterpret the results you get from either transaction.

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:28:40 GMT


> it is not working in my SAP system(4.6 B) and RSUSR008 is for to check transaction combination critical for security

You could have mentioned that earlier...

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:35:23 GMT

Sorry i didnt mentioned it earlier and thanks for your reply

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 16:51:17 GMT

I don't know which SP level you are on for your 46B system, but there were a number of bugs in the SUIM area which have since been solved.

Good luck,

Julius

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 17:00:16 GMT

Juluius !

Just---I am simply spellound by the wealth of info you possess ..and how easliy you pull it out for the benefit of other mortals ! I hope you would not delete this post as somthing thats not realted to this question !!

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 17:11:08 GMT

Hi Martinsh,

thanks for your reply. I am doing internal audit for our SAP system. for that i wanted to take out report of exccess authorization.It is for every users at assign object level with allowed activity values and then wants to compare it with permitted values(SOD). Generally all this activity is done by some tools (approvan, BIZview etc) available in market.

Regards

Koushal

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 20:46:07 GMT

The catch word here is 'Excess Authorization" its for you to tell what ' excess authorization " is for your organization.

May be SAP_ALL woudl be a good stratign point

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 21:51:07 GMT

Not sure if this is what you wanted, but I would agree with George here: You need to get a minimum baseline in place for the various types of users, before you start analyzing their SoDs - otherwise you will just break your head trying to work at it.

On 46B (out of support) you might only need only to work on it to get that right, but you can still do a decent job of it if you get the baseline right first

Cheers,

Julius

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 22:16:25 GMT

Please Try table TOBJ - you can see User id & Auth Objects. hope this helps you

Re: find authorization object value for user

Former Member — Tue, 16 Dec 2008 22:20:24 GMT


> Please Try table TOBJ - you can see User id & Auth Objects. hope this helps you

???

Re: find authorization object value for user

Former Member — Wed, 17 Dec 2008 13:39:54 GMT

Dear friends thanks for your valuable reply

table TOBJ only gives authorizaion object in SAP level, it will not give object assign to user and values.

by the help of SU56 Tcode we can find authorization object assign to user with values but it is not in consolidate form. to get into consolidate form we wil need to create ABAP program.

Regards

Koushal

Re: find authorization object value for user

jurjen_heeck — Wed, 17 Dec 2008 14:15:24 GMT

> by the help of SU56 Tcode we can find authorization object assign to user with values but it is not in consolidate form. to get into consolidate form we wil need to create ABAP program.

You can also have a look at SAPquery and/or the quickviewer SQVI. If your user comparison is up to date a join on tables AGR_USERS and AGR_1521 may help you get the information you want.

Re: find authorization object value for user

Former Member — Wed, 17 Dec 2008 14:21:12 GMT

AGR_USERS only give roles assign to user or vice versa that can also be find from complex selection in SUIM