topic Re: Regarding Authorization object in Application Development and Automation Discussions

Regarding Authorization object

Former Member — Wed, 04 Dec 2013 05:32:20 GMT

Hello Every one,

I have a custom report and it needs to have authorizations. it means that only few users should be able to execute the report.

I am following the below path. Please let me know, if my approach is wrong or not a best practice.

I went to SU20 created a authorization field ztrxn with data-element as tcode.

Went to SU21 created an authorization object Z_AUTH_OBJ1, and assigned the above field to it.

In PFCG, i am trying to assign this authorization object to the user profile.

After this i am planning to use this auth-object created in the SU21 as below code snippet.

AUTHORITY-CHECK OBJECT 'Z_AUTH_OBJ1'

ID 'ACTVT' FIELD '02'

ID 'CUSTTYPE' FIELD 'B'.

IF SY-SUBRC <> 0.

MESSAGE E...

ENDIF.

1) How do i make use of the ACTVT and CUSTTYPE fields ?

2) What is the authorization field 'ztrxn' created above ?

Thank you.

Re: Regarding Authorization object

koolspy_ultimate — Wed, 04 Dec 2013 05:37:24 GMT

hi,

You need to maintain the assignments of authorization objects in tcode: SU24.

ztrxn (as you mentioned above) is the field name used inside authorization objects.

Regards,

Madhumahesh.

Re: Regarding Authorization object

Former Member — Wed, 04 Dec 2013 06:09:14 GMT

ACTVT field points what kind of authority you want to check for, 02 indicates that you are checking to make sure that the user has been granted the authority to change.

CUSTTYPE field is for only certain CUSTTYPE's have the ACTVT = 02 setup which means only certain user will have the authority to change.

When the statement you have given is executed, this statement will check the configuration of authorization object 'S_TRVL_BKS' to see if the current user has the authority to change for CUSTTYPE = B. If the user does have the authority to change the sy-subrc will be zero, else it will be non-zero, in which case a message will be shown.

Re: Regarding Authorization object

nabheetscn — Wed, 04 Dec 2013 06:32:45 GMT

Hi Chandra

Basically here you want to check whether use has change/display/create etc (ACTVT) for CUSTYPE values

Read F1 documentation for this

Nabheet

Re: Regarding Authorization object

ThomasZloch — Wed, 04 Dec 2013 08:48:44 GMT

You should always check first whether there is really a need for a new authorisation object. Most simpler tasks can be solved by using existing objects.

What exactly needs to be checked in your scenario? For simple may execute/may not execute scenarios, look at the authorisation groups in the program attributes, which is linked to S_PROGRAM (and S_DEVELOP) authorisation objects. Study the online documentation of these objects, also speak to your system and/or security administrator.

Thomas