topic Re: Second Level Auth. in Application Development and Automation Discussions

Second Level Auth.

Former Member — Thu, 12 Mar 2009 09:49:27 GMT

Dear

I have created a role in which only one tcode(C223 - Production Version) has assigned. In change auth. (pfcg - role authorization) data there is no Material Type object is being availble / asked. However I have to apply second level on material type.

Conseuqenly, I have added munally an object of Material Type (M_Mate_Mara) but it doesnt restrict the user to view only anth. material types.

Kindly help in this regards;

Re: Second Level Auth.

jurjen_heeck — Thu, 12 Mar 2009 09:58:34 GMT

> Conseuqenly, I have added munally an object of Material Type (M_Mate_Mara) but it doesnt restrict the user to view only anth. material types.

Just adding objects to a role will never enforce extra restrictions. If you run a trace while executing the tcode you'll see which authority-checks are actually executed, including the ones switched off in SU24.

Re: Second Level Auth.

Former Member — Thu, 12 Mar 2009 12:05:00 GMT

thanks Dear;

Actually, I am new in Basis,

I have called SU24; then called required tcode C223 and added object Material Type Object.

After all in role auth. it shows Material Type object (no need to add it munally) but it again not restricting by material type.

regads;

Re: Second Level Auth.

jurjen_heeck — Thu, 12 Mar 2009 12:10:26 GMT

The basic rule you have to understand here is:

You can not add authority-checks to programs without actually modifying the code

So if you need extra security, best talk to an abaper.

Re: Second Level Auth.

Former Member — Thu, 12 Mar 2009 12:14:49 GMT

Please go to SU24 and change status of this object to C/M for C223.

Regards,

Surpreet

Re: Second Level Auth.

jurjen_heeck — Thu, 12 Mar 2009 12:26:57 GMT

> Please go to SU24 and change status of this object to C/M for C223.

Does that make it magically appear in the source code? I'm actually trying to dig through that at the moment and the only object I've found so far is C_FVER_WRK with the fields ACTVT ans WERKS so no material type there......

Re: Second Level Auth.

Former Member — Thu, 12 Mar 2009 12:37:59 GMT

But I have added M_MATE_MAR from SU24.

and check / Yes option.

after that there are two objects appare C_FVER_WRK and M_MATE_MAR.

and in filed BEGRU in have added some material type but invain....

Re: Second Level Auth.

jurjen_heeck — Thu, 12 Mar 2009 12:45:36 GMT

Please re-read my earlier posts carefully.

To put it in simpler words:

Adding keys to your keyring does not make the corresponding locks appear in your door. For that you'd need a carpenter and/or locksmith.

To get extra authority-checks into a program you need an abaper.