topic Re: Authorization Object and Authorization Group in Application Development and Automation Discussions

Authorization Object and Authorization Group

Former Member — Fri, 04 May 2012 12:46:41 GMT

We have a situation where we want to restrict the Z-table access to the users using Table Maintenance Generators (TMG). The situation is that we have Z-Tables with data from every plant.We want to allow the users to directly Add/Modify/Delete the records of these tables. However what we want is that the user should be able to Add/Modify/Delete the records of his own plant only and not of other plants.

So if we have user1 belonging to plant "A" then he should be able to Add Modify Delete the records of plant "A" only and he shouldnt be able to change the records of Plant "B". How can we achieve this? I am guessing that this could be done via Authorization Objects. But how to assign the objects to a Table or a TMG? While creating a TMG it asks the option of adding an authorization group only and not Authorization object. Is there any way to assign an Authorization Group to an Authorization Object or Vice-versa?

Re: Authorization Object and Authorization Group

ThomasZloch — Fri, 04 May 2012 13:16:24 GMT

The authorisation group of a table or view is linked to standard authorisation object S_TABU_DIS. However you can only control access for the whole table this way, not for a certain subset of rows.

Have a look at the various maintenance events of the TMG, that is where you would need to implement the program logic that checks e.g. plant level access. You would need to find or create an authorisation object for the plant level access as well, and include that in the users' roles.

Thomas

Re: Authorization Object and Authorization Group

former_member150968 — Fri, 04 May 2012 17:59:57 GMT

Hi Ankur,

It is very easy to achieve desired functionality. You just need to find suitable authorization object. You can find one from tcode 'SU21'. Once you get that, you can code in TMG events. There are events available which you can use to code for authority check. You can search SDN and you will find links to PDFs on how to achieve your desired functionality. If you don't find anything, reply back. I will provide you the code.

Regards,

Manish Sethia

Re: Authorization Object and Authorization Group

former_member282968 — Sat, 05 May 2012 13:19:36 GMT

Dear Ankur,

In the TMG screen goto system->status and copy the program.Goto SE38 and edit the program flow logic i.e, Add a new PAI module after the MODULE LISTE_BEFORE_LOOP.The new module can be added in the new include program.In this based on the user action which you can get from the SY-UCOMM you can validate placing your own code.

With regards,