topic Re: SU53 authorization checks in Application Development and Automation Discussions

SU53 authorization checks

former_member206377 — Thu, 11 Feb 2010 14:11:46 GMT

Hi all,

I have a query regarding SU53. Suppose I have executed a prog/tcode in the system to whcih i do not have authorization, then on checking SU53 , the authorization fail will be displayed. So the next time if I execute a different program to which I do not have authorization again, will the first authority fail message not be displayed, or will still be displayed along with the new one?

In short i want to know that if there is no authorization for 2 or more different objects ,will all of them be displayed or only the latest one?

Thanks ,

Vasuki

Re: SU53 authorization checks

vinod_vemuru2 — Thu, 11 Feb 2010 14:16:13 GMT

Hi,

SU53 shows only the latest authorization check.

Check with your BASIS team. They have the userwise tracker i hope to see what transactions they have executed in a given timeframe.

Thanks,

Vinod.

Re: SU53 authorization checks

former_member206377 — Thu, 11 Feb 2010 14:23:19 GMT

Hi Vinod,

Thanks a lot for your response.

Any table or any other way by which we can determine about the other authorization failure?

Re: SU53 authorization checks

Former Member — Thu, 11 Feb 2010 14:32:51 GMT

HI Vasuki ,

You can try with Tcode SUIM.

Here you have a facility to check the transactions executable by user

Lot of options are available here to check the authorizations in various dimentions.

Hope this will help you.

Regards,

Nikhil

Re: SU53 authorization checks

vinod_vemuru2 — Thu, 11 Feb 2010 14:40:43 GMT

Hi,

Not sure if there is a direct table. Because, this trace data is stored in buffer but not in database tables. We can use unix system calls to read this data. You can check the logic used in program SAPMS01GN.

Thanks,

Vinod.

Re: SU53 authorization checks

former_member206377 — Fri, 12 Feb 2010 05:11:17 GMT

Hi Vinod and Nikhil,

When I execute the application, I get an authorization fail message in SU53 and i dont get the required output. But when the functional owner is testing my application, he too does'nt get the required output but he doesn't get any authorization fail message after the execution too.

Now I am wondering whether it is an issue with authorization. But if it was not, then why is this authorization message showing up? ANy thoughts about the issue?

Re: SU53 authorization checks

former_member194669 — Fri, 12 Feb 2010 05:14:32 GMT

you need compare yours & fun consultants auth for that object thru program RSUSR002

a®

Re: SU53 authorization checks

mvoros — Fri, 12 Feb 2010 05:29:02 GMT

Hi,

there is no such a table which stores all failed authorization checks. The standard tool which is used by security consultant for authorization debugging is ST01 - System trace. You can activate a trace for authorization checks only. You can also limit a trace to particular program or user. In this case you will see all authorizations checks (positive as well as negative).

Cheers

Re: SU53 authorization checks

Former Member — Sat, 20 Feb 2010 19:41:35 GMT

> In short i want to know that if there is no authorization for 2 or more different objects ,will all of them be displayed or only the latest one?

Only and always the last one. This also includes ANY checks in navigation after an authorization message is raised (e.g. you click a popup away...) and also ONLY the last check performed in a complex authority-check construct (screen modifications based on authorizations). Transaction SM37 is a good example of this.

But keep your hopes up... SU53N is on it's way and would be able to do that which you have described and more...:-)

Cheers,

Julius

Re: SU53 authorization checks

mvoros — Sun, 21 Feb 2010 00:11:21 GMT

 
> But keep your hopes up... SU53N is on it's way and would be able to do that which you have described and more...:-)

Julius,

Do you know if SU53N well be part of enhancement pack 2 for Netweaver?

Thanks

Re: SU53 authorization checks

Former Member — Sun, 21 Feb 2010 00:37:36 GMT

Hi Martin,

It is still in development, so I don't know when it will be available. Some folks from application areas also wanted to add their wishes (e.g. automatically finding the appropriate role for the missing authorization...). I only know that it was approved and that kernel changes are required.

For more infos see:

[Display multiple authority-checks, source code location and return & reason-codes when analyzing users|http://wiki.sdn.sap.com/wiki/pages/viewpage.action?pageId=85000831] (please add comments if you wish)

and

(this is the only known case of ponits-gaming on SDN which has led to an approved development request

Cheers,

Julius