topic Re: Authorization object ?? in Application Development and Automation Discussions

Authorization object ??

Former Member — Mon, 23 Jan 2006 09:45:56 GMT

can anyone send me good material on Authorization object concepts ??

Also plz tell me why we need authorization object in abap program. Wt is the syntax.? Guide me in detail

uses ? example ?

Re: Authorization object ??

FredericGirod — Mon, 23 Jan 2006 09:52:01 GMT

Hi Hari,

authorization is a too big subject to be simply answered. Look the help : http://help.sap.com

object and element will be list in the transaction SU20 / SU21.

To check if you miss an authorization look the transaction SU53.

and finaly, if you allow a user to create a delivery maybe you will not allow to create a purchasse order or anything else.

For the command, the magic button "F1" on the authorization-check will answer you.

Rgd

Frédéric

Re: Authorization object ??

Former Member — Mon, 23 Jan 2006 09:57:56 GMT

Authorization Object are used to give authority to the user according to the position he or she is holding the organization unit.

Different roles are assigned to the position of the organization unit and these roles in turn are assigned to the task.

In SAP these task are assigned to the transactions .

So the user is given authorization for the particular transaction.

This way user are controlled from using the data which they are not supposed to accesss.

Sometimes the authorizatio is only to read , that mean user can see the data but cannot change.

In some case the user is not eligible to see the data not relevant to his aera . eg. a sales rep in one sales area is not supposed to view the data of another sales area or sales rep.

Even the user might be authorized for a transaction but the usage will be limited to area relevant to his /her work.

Syntax u can find in abap help.

AUTHORITY-CHECK type this and use F1.

Re: Authorization object ??

abdul_hakim — Mon, 23 Jan 2006 10:00:52 GMT

Check the below link..

http://help.sap.com/saphelp_47x200/helpdata/en/b5/ea95ccf91c7644b1499e26d44c8318/frameset.htm

Authorization is used to check whether a particular has the authorization to execute certain operation.For eg calling a transaction.With this we can avoid unauthorized access in SAP System..

Abdul

Re: Authorization object ??

Former Member — Mon, 23 Jan 2006 10:13:26 GMT

Thanx friends,

can u tell me which tcodes to refer step wise.

i m having list of su* all transactions. but i m unable to find wht actually they r doing.

if anyone having help file like pdf format. plz mail me to hariabap2005@yahoo.co.in

Re: Authorization object ??

lajitha_menon — Mon, 23 Jan 2006 10:19:35 GMT

use transaction su03 for creating auth objects.

Re: Authorization object ??

Former Member — Mon, 23 Jan 2006 10:46:31 GMT

This a snap shot of how authorizations works

Authorization object is created in tcode SU21. And authorization fields are created in SU20.

For each authorization object, we insert a number of fields. If the field for which we want to create authoriztion is not there, we create that field in SU20.

Eg : F_BKPF_BLA is an authorization object which has two fields, authorization group(BRGRU) and activity(ACTVT). Using this authorization object, you determine with which document type line items can be posted and processed.

Authorizations are created for this object giving the value permitted for each field

eg authorization 1 - S_AUTH_1

activity - 01

BRGRU - authorization group

Users have this authorization can perform activity 01, that is creating.

authorization S_AUTH_2

*activity - 01, 02, 03.

BRGRU - authorization group

Users having this authorization can perform activities 01, 02 and 03, that is create, change and display.

A profile is created to store the authorizations and transactions allowed for a particular user(by defining the role). This is done using transaction PFCG. And this profile name is maintained in the user record for each user.

When the user logins, the user record is checked.

Every time an action is taken by the user, an authority-check command must be called in the program

AUTHORITY-CHECK OBJECT 'F_BKPF_BLA'

ID 'BRGRU' FIELD T003-BRGRU

ID 'ACTVT' FIELD '03'.

Now, for this particular login, if an authorization for the given value is present, the transaction is accepted. Else the check fails and the action will not be allowed for the user.

For eg, if authorization S_AUTH_1 is there in the profile for that user, then this is allowed. But if only S_AUTH_2 is there, then the check fails.