topic Re: S_DEVELOP and ECATT in Application Development and Automation Discussions

S_DEVELOP and ECATT

Former Member — Tue, 18 May 2010 20:37:34 GMT

Hello All,

We have created ECATT roles for SD, MM, PP.. we name test scripts/configurations in certain format that, users should not have authorization to execute cross functional (ZPP_, ZSD_, ZMM_...)

In S_DEVELOP to meet above objective, I did:

ACTVT: 03/16/70

DEVCLASS: *

OBJNAME: ZPP_*

OBJTYPE: ECAT, ECSC

P_GROUP: *

Its not working user is failing authorization on (SU53):

OBJNAME: *

If make changes as SU53, it works but it does not meet objective to restrict by module.

Your thoughts experts?

Thanks

Re: S_DEVELOP and ECATT

Former Member — Tue, 18 May 2010 20:43:58 GMT

Against which ACTVT is the OBJNAME * failing?

If you are relying only on the trace, then '03' is a likely "red herring" in the screen programming to determine which test cases are visible to the user and what is possible.

Just hit F8 and see what happens despite the restrictions.

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 08:01:17 GMT

Hi,

I have below settings which works for me perfectly.

Activity 03, 16

Package *

Object name ZZ*

Object type SCAT

Authorization group ABAP/4 pro *

Please check if you are using the right object type. Make sure what it is asking for all fields in trace log (ST01) as well.

Regards,

Gowrinadh

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 13:20:00 GMT

Hello,

Its not failing on 'ACTVT' its failing on '_OBJNAME_', SU53 is saying user needs 'OBJNAME=*'. We cannot give this value as the user will able to excute all the scripts, objective is to restrict by business(MM, PP,..)

Gowri,

When I started first, I used same values as you but doesnt work. I did different trial runs like (ZPP_, ZPP, ZP*) nothing worked.

I looked in to ST01 analysis also, look same. ITs failing on OBJNAME= *, which we cannot give.

Your thoughts.

Thanks.

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 13:54:36 GMT

What I meant was OBJNAME = * in combination with which ACTVT value in the check?

This will tell us the coding location (used to modify the screen, determine a visible list, etc)...

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 14:02:23 GMT

Hi Julius - Got it! See below:

S_DEVELOP:(Failed ON)

ACTVT: 70

DEVCLASS: DUMMY

OBJNAME: *

OBJTYPE: ECAT

P_GROUP: Dummy

Current values in user role:

ACTVT: 03, 16, 70

DEVCLASS: *

OBJNAME: ZPP*

OBJTYPE: ECAT, ECSC, ECTC

P_GROUP: *

Thanks.

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 18:39:43 GMT

Experts could I dare to bribe you with something you like

Did not hear anything, so thought lets take a different route.

Thanks in advance.

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 19:34:07 GMT

> Experts could I dare to bribe you with something you like

Beers are on you?

That activity (70) is only used in SCAT and not SECATT, so you can ignore it. I am not sure why it is appearing in the trace (it doesn't in mine) but should not interfer with the activity 16 checks.

Try to remove the 70 completely and test to see whether the activity 16 appears? Just a guess, as it might still be some "compatibility" coding with the old CATT functions and existing roles to use them.

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 20:30:22 GMT

Oh Sure Julius! It will be my pleassure..ha..ha..

I will take a shot on your suggestion, but I am sure will see same thing in trace as when we created role we did not include act=70; we started with 03 and 06.

Other thing I want to add is:

-We created these new scripts using SECATT, I see above discussed issue when I am trying to run this scripts. It works absolutely fine when I assign '' for 'OBJNAME' field instead of specific values like ZPP, ZP* or full value.

-we are on ECC 6.0, if that helps.

Will let you know what I see.

Thanks.

Edited by: AJ on May 19, 2010 10:38 PM

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 20:43:59 GMT

Reconstructing the same thing and expecting different results is only possible accross release boundaries (and modifications).

Where are you in that respect?

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 20:57:30 GMT

This is what I see from the new test in SU53 screenshot:

ACTVT: 70

DEVCLASS: DUMMY

OBJNAME: ' '

OBJTYPE: ECAT

P_GROUP: DUMMY

ST01 output:

S_Develop RC=4 TCODE:SECATT; DEVCLASS= ; OBJTYPE= SCAT; OBJNAME= *; P_GROUP= ; ACTVT=16

Role authorizations does have:

ACTVT: 03, 16

DEVCLASS: *

OBJNAME: ZPP*

OBJTYPE: ECAT, ECSC, ECTC, SCAT

P_GROUP: *

Your thoughts.

Re: S_DEVELOP and ECATT

Former Member — Wed, 19 May 2010 21:22:43 GMT

Are you on 4.6C?

Even support on SDN is limited...

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 09:28:03 GMT

I have just tested in SCAT in SECATT as well. The trance shows same, user can't execute. Have you execute it completely in SECATT?

S_DEVELOP RC=4 OBJTYPE=ECTC;OBJNAME=

Z_MM_TEXT

;ACTVT=03;P_GROUP= ;DEVCLASS= ;

I have restricted in ZZ* in object type.

Regards,

Gowrinadh

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 13:24:16 GMT

Julius - we are on ECC 6.0

Gowrinadh - Thanks for checking on your side.

Its pretty strange! On your side, it show up as 'OBJNAME=Z_MM_Text'. However on my side it show up as 'OBJNAME=* and ' ', I dont know what is going on.

We created these scripts in SECATT and also trying to run in SECATT, I would have been attached if we had option to add attachments.

I think there is something else also tied up with authorization issue which is causing this mess.

Thanks.

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 19:04:44 GMT

Guys - Is this really tough question? I see no thoughts coming in, experts comon!

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 19:18:15 GMT

You have a custom programming (perhaps to force this authorization via an authority-check which is too strict?) and then made a screen-shot of the SU53 result and saved it in the MIME repository. You then created a screen variant for SU53 which then calls the MIME repository to display the screenshot and assigned it to the users.

If it is the underscore "_" then you deserve a beer for finding it, but other than that I give up. What's the answer?

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 20:17:23 GMT

Hey Julius - Things went above my head, will you please explain like step by step what should I look for?

Thanks Much.

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 20:34:33 GMT

Step-by-step: I don't know and can only guess from here because I cannot reconstruct it.

Please check in transaction SPAU whether there is anything registered there for SECATT?

What I meant by the previous post is that I give up, and can only guess now...

Cheers,

Julius

Re: S_DEVELOP and ECATT

Former Member — Thu, 20 May 2010 20:55:15 GMT

Thanks Anyways! I appreciate your suggestions.

Will look into SPAU and get back to you.

Re: S_DEVELOP and ECATT

Former Member — Fri, 12 Nov 2010 15:57:58 GMT

HI AJ,

Did you managed to resolve this issue?

I also received similar error in ST01.

Regards,

Atul