topic Re: End user needs SU01 to update authorization limits for users in Application Development and Automation Discussions

End user needs SU01 to update authorization limits for users

Former Member — Wed, 31 Mar 2010 05:48:50 GMT

Hello Gurus,

The end user needs SU01 to update authorization limits for users by going into the personilsation tab and giving approval limits. As this is a critical security tcode. Please let me know if there is any alternative for SU01 or Is there any other way of restricting SU01.

Thank you !

Regard's,

Salman

Re: End user needs SU01 to update authorization limits for users

Former Member — Tue, 06 Apr 2010 12:36:59 GMT

Hi,

In the Authorization Role Check- S_USER_AGR

there is an option for changing the Activity...

Enable the ones which are needed for the user to restrict the end users access.

Feel free to get back,

Thanks and Regards

Jaianandh V

Re: End user needs SU01 to update authorization limits for users

mvoros — Wed, 07 Apr 2010 06:48:06 GMT

Hi,

you can't add an authorization to your users just to extend validity interval of already assigned roles. If you really need this functionality then you can develop your own simple transaction to modify validity intervals for user's roles. There is BAPI for role assignment.

Could you tell us your motivation for your requirement? Maybe there is another solution.

Cheers

Re: End user needs SU01 to update authorization limits for users

Former Member — Wed, 07 Apr 2010 12:26:09 GMT

if i get you right you want end-user to change the validity date of roles,

i t think this is a severe security hazard, never let end user change any thing in rols assignments

Re: End user needs SU01 to update authorization limits for users

Former Member — Wed, 07 Apr 2010 14:43:20 GMT

Can't it be set by Security administrators? Have you considered any problems in doing so? If user's can set their own limit, I don't see any point in having the limit at all

Regards,

Gowrinadh

Re: End user needs SU01 to update authorization limits for users

Former Member — Wed, 07 Apr 2010 15:46:56 GMT

Salman,

Is there a reason why you wouldnt want to use the "Personalization" settings on the Security Roles instead. You can create derived roles for specific set of values on the limits.

Thanks.

Matt