topic Re: authorization for report / dynamic selection in Application Development and Automation Discussions

authorization for report / dynamic selection

ralf_offermann — Tue, 27 Oct 2009 09:07:37 GMT

Good morning,

i got a request to implement and authority based on values of the dynamic selection in reports.

For example: The report S_ALR_87012093 (RFKUML00) needs to be authorized only for a few Account groups, defined by a role. I found an authority obejct (F_LFA1_GRP) for this, but this is not checked in the underlying ABAP.

Is there any possibility to limit the report to Account group "1000" for example without copying and modifying the source?

I have tried to add the authority object to the transaction with SU24, but this is still not checked.

regards

Ralf

Re: authorization for report / dynamic selection

Former Member — Tue, 27 Oct 2009 10:04:59 GMT

Hi,

Did you add F_LFA1_GRP under S_ALR_87012093 in su24? What is the check indicator for this object?

Check indicator should be CHECK for auth check to happen for this object.

pls let us know.

Regards,

Brahmeshwar

Re: authorization for report / dynamic selection

Former Member — Tue, 27 Oct 2009 10:43:03 GMT

Hi,

I can see two possibilities here.

1. Create a custom transaction or report which defaults the account group to 1000.

2. Create a variant transaction by making the account group field to read only with fixed value as 1000. Search this forum for

this, you will find lot of threads and how to guides.

P.S Adding an entry in SU24 doesn't perform a check in the source code.

Regards,

Gowrinadh C

Re: authorization for report / dynamic selection

ralf_offermann — Tue, 27 Oct 2009 11:02:00 GMT

Hi,

@Brahmeshwar: yes, i added F_LFA1_GRP under S_ALR_87012093 in su24. But this only adds an entry into USOBT_C and does not really result in any authority-check in the transaction.

The requester told me, that there must be a global setting, where you can edit authority checks on field names in a report. I could not believe that, but he sounded really persuasive.

@Gowrinadh: Thanks, i think, i will try your second hint.

regards

Ralf

Re: authorization for report / dynamic selection

ralf_offermann — Tue, 27 Oct 2009 12:49:31 GMT

Still have a problem. I tried creating a variant transaction with SHD0, but the error "Variants are possible only for dialog transactions." comes up, because it is already a transaction variant.. This is well known in the forum and other users advise to use the "real" used transaction.

SE93 tells me, that S_ALR_87012093 is a "transaction with parameters". It starts the start-report with option Report=RFKUML00.

How can i do a varaint transaction for that report? Do i have to create a varaint transaction for SA38?

regards

Ralf

Re: authorization for report / dynamic selection

sdipanjan — Tue, 27 Oct 2009 15:27:14 GMT

> How can i do a varaint transaction for that report? Do i have to create a varaint transaction for SA38?

There is one guide available on this.. hope this may help. Let me know if you have any query.

[Creation and Use of Variant Transaction|http://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/uuid/40d1443e-0184-2c10-c68d-c612f771fe6f]

Regards,

Dipanjan

Re: authorization for report / dynamic selection

ralf_offermann — Wed, 28 Oct 2009 09:54:32 GMT

I already found that guide, but it doesn't work for S_ALR_87012093.

If i enter that as a transaction in SHD0, the error "Variants are possible only for dialog transactions." comes up. And other threads explain why.

If i try to create a transaction variant for SA38 starting the report, that will be OK, but then there is no possibilty to maintain anything in the dynamic selection.

I have tried to create a new transaction code like S_ALR_87012093, with a default variant, where the fileds are filled and locked, but this doesn't fulfil the request, because the user is able to select another variant and overwrite the settings.

Any other hints?

best regards

Ralf