topic Re: Restrict Authorization in Application Development and Automation Discussions

Restrict Authorization

Former Member — Wed, 11 Nov 2009 07:34:19 GMT

Hello,

I want to restrict authorization... Is there a object/Tcode to do so?

Restrict Authorization for:

DBACOCKPIT -> Performance -> Additional Functions -> SQL Command Editor

This should be done as Basis users should not be able to get access at the Table Level...

Thanks,

RaHuL...

Re: Restrict Authorization

Former Member — Wed, 11 Nov 2009 08:32:44 GMT

Hello,

Your objects are within your t-code itself.

Make use of S_ADMI_FCD under it.

For documentation on this obj go to su21 and search for it.

As always, make use of trace:)

Regards,

Brahmeshwar

Re: Restrict Authorization

Former Member — Wed, 18 Nov 2009 07:43:03 GMT

Hi,

Thanks for the reply Brahmeshwar...

I have checked with S_ADMI_FCD... It doesn't work...

Any other guesses?

Thanks,

RaHuL...

Re: Restrict Authorization

Former Member — Wed, 18 Nov 2009 08:21:31 GMT

there's nothing to guess. this has nothing to do with SAP authorisations. this is on DBA-level - access to SQL when logged on in the SAP system is always done with user db2<dbsid>. so, check your DB-schema, groups, levels etc or go to your DBA and have her do so.

RaHuL, may i suggest that you phrase your topic subjects in a more 'meaningful' way in the future? like 'how to limit transaction DBACOCKPIT to display when it comes to SQL' or somesuch? thank you in advance.

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 11:09:18 GMT

Rahul,

what makes you think I will give you a different answer on SAPFans (to the very same question of today)?

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 11:55:21 GMT

Mylène Dorias

Just thought there would be more smarter people on that forum than you...

If you donot wish to reply , keep your mouth shut and let others help...

Unwanted comments are not appreciated...

Thanks,

RaHuL...

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 12:24:53 GMT

Now now... Mylene did add a smiley... and you didn't...

Perhaps this is because you think you are invisible in the internet? Huh?

Anyway, I have been looking into this and if you do not tell us your release and SP level (at least) then we cannot help you.

That is a general rule for asking questions, and in this case a necessary information.

Cheers,

Julius

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 12:40:25 GMT

Hi,

+One More in the forum...+

Can i curse you/use bad words and add a smiley at the end? If it is OK with you then let me know?

We are on SAP ECC 6.0 with Oracle 10 and Solaris 10 Kernel Release 700 [185] ...

Are any more inputs required?

I would appreciate only relevant answers

Thanks,

RaHuL..

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 12:57:14 GMT

Dear Vijay Mehta from Reliance, Thane Belapur Road, KoparKhairane (Mumbai)

India,

What's your SAP_BASIS level (see transaction SPAM -> installed support packs).

Cheers,

Julius

Re: Restrict Authorization

Former Member — Thu, 19 Nov 2009 13:30:44 GMT

I guess you are going to be more polite in future, or even completely quiet yourself?

Anyway, if your SP level is below 17, then see method CHECK_TABLES of class CL_ORA_SRV_JSEL - otherwise, see method OKCODE_PARSE_AND_EXECUTE of class CL_ORA_ACTION_SQLC.

* local system: if the user has the permission to display table contents like
* in transaction SE16 (authority object S_TABU_DIS), the SQL Command Editor
* will also allow to show the table contents.
* remote system: on a remote system, the check is done according to the original
* rules. If table-owner is 'SYS' or 'PULIC', the contents will be displayed,
* otherwise the table contents will not be displayed. On a remote system the
* Authority Check can not be executed. Therefore we have a different behaviour
* in this case than running the SQL Command Editor on a local system.
    IF ( ( me->g_dbcon = 'DEFAULT' ) OR ( me->g_dbcon IS INITIAL ) ).
*...local system
      AUTHORITY-CHECK OBJECT 'S_TABU_DIS'
                      ID 'ACTVT' FIELD '03'
                      ID 'DICBERCLS' FIELD ''.
      IF ( sy-subrc <> 0 ).                    "no authorization
        e_rc = 1.
      ELSE.
        e_rc = 0.
      ENDIF.

You will find this when you actually run the statement, unless it is an external DBCON connection.. in which case it is closed and nothing is displayed here.

So I would say that Mylene is correct, and there is a bit of an application authorization check made once the connection information to the DB table is known (even if it is only as strong as the one in debugging SE16). Obviously you need to be more carefull of S_ADMI_FCD PADM or ST0R or ST0M to get in there in the first place...

Cheers,

Julius