topic Re: Default authorization objects in Application Development and Automation Discussions

Default authorization objects

Former Member — Fri, 13 Mar 2009 06:16:10 GMT

Hello all,

To explain my problem I use some tcodes for example.

I've created a new single role with only one tcode -> VT02N.

One of the authorization objects which will be added is V_VTTK_SHT. This object contains two fields, 'activity' and 'Shipment type'. Both fields are default empty. I've set them to 'full authorization' and the fields will get the values ' * '. Generate etc. no problem.

Now I want to add tcode VT03N. When I do this the authorization object V_VTTK_SHT will be added again only the field 'activity' will default get the value '03'. As I see it '03' is included by ' * ' which has been set before.

How do I prevent this to happen because this takes a lot of time every time I do a 'merge with new data' because this will happen for a lot of objects in sertain roles....

Thx in advance,

Patrick

Re: Default authorization objects

Former Member — Fri, 13 Mar 2009 06:32:28 GMT

While generating profile select Expert Mode for Profile Generation then select the action Edit old status then new object canu2019t be added

Re: Default authorization objects

Former Member — Fri, 13 Mar 2009 06:47:07 GMT

This is a nice example of why activity and action related fields should be maintained in SU24 and not PFCG, and if you choose to know more than what is documented in SU24 then you should let it know by creating your own manual instances of the authority, and if you choose to know better... then make it "changed".

See SAP note 113290 for "the rules" of PFCG in combination with SU24.

Cheers,

Julius

Re: Default authorization objects

Former Member — Fri, 13 Mar 2009 07:05:42 GMT

When I choose "Edit old status" will a authorization object, which isn't in the list yet, be added or do I have to add it manually then?

Edited by: P. Keltjens on Mar 13, 2009 8:05 AM

Re: Default authorization objects

Former Member — Fri, 13 Mar 2009 07:11:37 GMT

I would think that if the object is not in your role yet, then "Edit old status" will not be available for it - but I have never tried.

I think what Ravi M is indicating, is that you can change the status of the object from "Maintained" to "Changed"... but please read the above SAP note first to see what the implications of this are.

Your weapon of first choice should always be to maintain SU24 first, as this keeps the concept intact in a documented and reusable way.

Cheers,

Julius

Re: Default authorization objects

Former Member — Fri, 13 Mar 2009 07:14:26 GMT

I've already started reading.

Thnx for the quick replies!

Re: Default authorization objects

Former Member — Sun, 15 Mar 2009 17:38:49 GMT

This message was moderated.