topic Authorization for generic object services - GOS - payroll data in Application Development and Automation Discussions

Authorization for generic object services - GOS - payroll data

Former Member — Wed, 15 Jun 2011 14:31:49 GMT

Is there anyway to restrict what people see via GOS? I can't see any authorisations behind it except S_OC_ROLE. Seem users can view payroll details of a workflow agent in the workflow logs(view with technical details). Its a wild shot that an end user will find this information in the container tab but it look like a massive security flaw.

I will be interested to know if others have the same problem and how they resolved it.

Thanks

Re: Authorization for generic object services - GOS - payroll data

Former Member — Thu, 16 Jun 2011 10:24:58 GMT

anyone else come across this problem?

Re: Authorization for generic object services - GOS - payroll data

Bernhard_SAP — Thu, 16 Jun 2011 10:57:22 GMT

Hello Savo,

please have a look at SAP note 491271.

b.rgds, Bernhard

Re: Authorization for generic object services - GOS - payroll data

Former Member — Fri, 01 Jul 2011 15:03:23 GMT

This issue relates to authorisations. Depending on infotypes available to the user, they will be able to view data relating to the info type.

I will now have to review all authorisations to ensure there is no unauthorised access.