topic Re: Company code authority check in Application Development and Automation Discussions

Company code authority check

Former Member — Thu, 08 Sep 2011 06:17:43 GMT

we have created ZTTL01 table maintenance view. Should not allow unauthorized company code to update/create or display.

I searched thru forums and collected below points. but could not test it successfully.

Authorization object (Z_XXX_BUK) was created.But <Permitted activities> Button is not available in display authorization object(SU21) to see what are the activities are permitted.

In su01 for my user no roles or profiles are defined.

To do

Trying to write below code in PBO and PAI flow logic of ZCHECK_BUK table for screen 01

PBO & PAI
*First statement
Module Authorictycheck.

module Authoritycheck
  LOOP AT EXTRACT.
    AUTHORITY-CHECK OBJECT 'ZCHECK_BUK'
                        ID 'ACTVT' FIELD '01,02,03'
                        ID 'BUKRS' FIELD ZTTL01-BUKRS.
    IF sy-subrc <> 0.
      MESSAGE e000(zrpt) WITH 'You do not have the authorization to'
    EXIT.                          'access Bukrs'extract-bukrs.
    ENDIF.
  ENDLOOP.
endmodule

Can i use above code in PBO and PAI to check change of company code?

I am sharing role and profile created by other user, which allows only company code 'A10'.

How to test this now?

se11->Utilities->table contents create should not allow me to input A11 or other company codes? pls confirm.

Regards

Chandra

Re: Company code authority check

franois_henrotte — Thu, 08 Sep 2011 09:38:45 GMT

go to transaction SE54 and input your table name

go to menu Environment / Events

activate change mode

put a new entry for event 05 (creating a new entry) and put some name for your form routine

hit enter, then an icon will appear on the button next to the name of form routine

click on this button it will allow you to create the routine in the program for view maintenance

there you put your code in order to do the authority check and refuse the record if needed

Re: Company code authority check

franois_henrotte — Thu, 08 Sep 2011 09:46:37 GMT

duplicate

Re: Company code authority check

franois_henrotte — Thu, 08 Sep 2011 09:46:41 GMT

duplicate

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 05:14:30 GMT

Hi Franchios

Thanks for your reply.

Does the event creation is the aternatve method to check the company code authorization?

Above auhoriztaion check inside LOOP at PBO is not required in case of Event usage?

Plsconfirm

regards

Chandra

Re: Company code authority check

SuhaSaha — Fri, 09 Sep 2011 05:35:32 GMT


> Does the event creation is the aternatve method to check the company code authorization?
> Above auhoriztaion check inside LOOP at PBO is not required in case of Event usage?

If the TMG is re-generated your code will be lost, so try not to modify the PBO module in the TMG directly.

You should put your Authorization check in the Event 01 & not on Event 05. This will ensure that the check is performed whenever the data is saved to the DB.

BR,

Suhas

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 06:44:53 GMT

Thanks for your reply.

My requirement is user should not view or update/create the Company code defined in Authorization code.

If i write Event05, it will be fired only when you try to save the record right? but he will be seeing all the company codes right?

I tried inserting below code at event 05, why its givnig error

AUTHORITY-CHECK OBJECT 'Z_XXXXX_BUK'

ID 'BUKRS' FIELD ZXXXX-bukrs. .

IF sy-subrc <> 0.

MESSAGE E105(ZSCM01).

ENDIF.

ERROR :

Include LZXXF01

Statement is not accessible.

pls correct me.

Regards

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 08:15:26 GMT

I understand using event is benefitted rather than using PBO code change.

Above requirement can be solved using event?

I cannot see any event to hide unauthorized company codes?

ofcourse i can use event01 for before saving the record.

Does any additional code has to be done apart from above code?

Regards

Re: Company code authority check

SuhaSaha — Fri, 09 Sep 2011 08:52:32 GMT

I cannot see any event to hide unauthorized company codes?

Ofcourse there is

[Event AA: Instead of the Standard Data Read Routine|http://help.sap.com/saphelp_nw04s/helpdata/en/91/ca9f56a9d111d1a5690000e82deaaa/content.htm]

Event AA: LOOP on the table TOTAL & remove the records for which the user has no view authority.

Event 01: If the user tries to create/update/delete the record, check the authority based on the CoCd. If the user is not authorised, then issue a message, set SY-SUBRC to "non-zero" value & set VIM_ABORT_SAVING to 'X'.

Hope this helps.

BR,

Suhas

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 09:09:08 GMT

Hello Suhas

Can you pls guide me little more

I included below code in include LZXXF01. but gives error.

and gives dump.

AUTHORITY-CHECK OBJECT 'Z_XXXXX_BUK'

ID 'BUKRS' FIELD ZXXXX-bukrs. "Table name is ZXXXX

IF sy-subrc 0.

MESSAGE E105(ZSCM01).

ENDIF.

ERROR :

Include LZXXF01

Statement is not accessible.

pls correct me.

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 10:18:48 GMT

WHen i created Event 01. It asks for new Include name and i created new include under my view function group.

Now i wonder how to write the code inside the include. because whathever i write i cannot activate independently

I afraid if i activate all functiongroup again could give some generation problem.

I just wrote one below code to check <Ztable>-Bukrs field with authority check.

But give error....what should i do now pls advice.

Regards

Re: Company code authority check

Former Member — Fri, 09 Sep 2011 10:54:52 GMT

I am able to achieve the event 01 option and its working fine.

But EventAA, i am not able to get it.

WHich table should i have to LOOP it?

I cannot see anytable by name TOTAL....in my program.

Pls confirm.

Regards

Chandra

Re: Company code authority check

Former Member — Wed, 14 Sep 2011 02:54:52 GMT

I have two issues now.

1)I have records in ZXXX table, but when i see in SM30 the records are empty.

what could be the reason?

2)Like Suhas said, I want to loop the table and remove the corresponding records.

But which table should i loop? either table controll or Extract table?

Can you pls shed light on this.

Regards

Chandra

Re: Company code authority check

SuhaSaha — Wed, 14 Sep 2011 03:17:26 GMT

Hello Chandra,

1)I have records in ZXXX table, but when i see in SM30 the records are empty. what could be the reason?

Put the break-point in the subroutine which handles Event AA & debug. I think that may be the Auth. Check is failing & the records are being removed. Did you call the subroutine FORM TABLE_GET_DATA in your event AA, this will populate the table TOTAL.

 want to loop the table and remove the corresponding records. But which table should i loop? either table controll or Extract table?

If you're handling the Event 01, then it should be something like LOOP on TOTAL & READ EXTRACT. There's code snippet provided in the SAP documentation for Event 01 which you can refer while building your code.

BR,

Suhas

Re: Company code authority check

Former Member — Wed, 14 Sep 2011 07:55:43 GMT

Hi Suhas

Regarding 1) It works when i remove the FORM routine assinged for EVENTS.

Thanks for ur input.

Regarding 2)When the user displays record in SM30 for a table, he must not be able to see the company code AD01.

To achieve this can i use EVENT AA?

I create FORM routine <hide_cocode> in EVENT AA and store at include LZXXXXF01.

FORM ZHIDE_COCODE.

DATA: F_INDEX LIKE SY-TABIX."Index to note the lines found"

LOOP AT TOTAL.

READ TABLE EXTRACT WITH KEY <vim_xtotal_key>.

IF SY-SUBRC EQ 0.

F_INDEX = SY-TABIX.

ELSE.

CLEAR F_INDEX.

ENDIF. "(make desired changes to the line TOTAL)

MODIFY TOTAL.

CHECK F_INDEX GT 0.

EXTRACT = TOTAL.

MODIFY EXTRACT INDEX F_INDEX.

*ENDIF.

ENDLOOP.

SY-SUBRC = 0.

ENDFORM.

I made break point at line LOOP at Total. and executed SM30 and clicked Display button.

Sorry Code stops here and table TOTAL has flat line structure of empty.Loop at total is skipping

what should be done now?

Regards

Chandra

Re: Company code authority check

SuhaSaha — Wed, 14 Sep 2011 09:02:03 GMT

Hello,

You've to add the SAP defined sub-routine table_get_data to read the from the table.

FORM zhide_cocode.
  DATA: f_index LIKE sy-tabix."Index to note the lines found"

  PERFORM table_get_data. "Fetch the table data --> Add this line

  LOOP AT total.
    READ TABLE extract WITH KEY <vim_xtotal_key>.
    IF sy-subrc EQ 0.
      f_index = sy-tabix.
    ELSE.
      CLEAR f_index.
    ENDIF. "(make desired changes to the line TOTAL)
    MODIFY total.
    CHECK f_index GT 0.
    extract = total.
    MODIFY extract INDEX f_index.
*ENDIF.
  ENDLOOP.
  sy-subrc = 0.
ENDFORM.                    "ZHIDE_COCODE

Hope you're clear.

BR,

Suhas

Re: Company code authority check

Former Member — Fri, 16 Sep 2011 03:57:50 GMT

Hi Suhas

Thanks for your reply.

It works..

Regards

Chandra