topic Re: Assign Authorization Using ABAP in Application Development and Automation Discussions

Assign Authorization Using ABAP

former_member375795 — Wed, 26 Mar 2014 17:06:13 GMT

I create one zprogram2 , but user not having a authorization to use , but that program is not used by user directly , means that zprogram2 is call by another zprogram1 , So I need to give authorization in the zprogram1 to use zprogram2

Is it any function module to give authorization at run time .

Re: Assign Authorization Using ABAP

Former Member — Wed, 26 Mar 2014 17:31:20 GMT

This message was moderated.

Re: Assign Authorization Using ABAP

ThangaPrakash — Wed, 26 Mar 2014 18:03:37 GMT

Hello Siva,

You would be having a transaction code assigned to program2. Do a authority check on that transaction before submitting program2 inside program1.

ex: program2 is assigned to transaction code TCODE2.

Inside program1 do like below.

AUTHORITY-CHECK OBJECT 'S_TCODE'

ID 'TCD' FIELD 'TCODE2'.

IF sy-subrc <> 0.

MESSAGE <No authority to transaction>

ENDIF.

SUBMIT program2.......

Regards,

Re: Assign Authorization Using ABAP

kmoore007 — Wed, 26 Mar 2014 18:48:29 GMT

You should run an authorization trace, or your Basis person should, as you execute the report and see what authorization objects are missing on his profile. You can also use t-code SU53 after he executes.

Re: Assign Authorization Using ABAP

Former Member — Wed, 26 Mar 2014 19:27:13 GMT

Hi Alok,

You can't give a authorization to user while executing the program. What you can do is add a authorization check before the second program is executed/submitted from first one.

You can use AUTHORITY-CHECK OBJECT 'S_TCODE' to check the authorization for the Transaction of second program and also if there is anything specific security is used in second program (like plant/ legal entity) then that need to validated in first program before you/user submit second one.

To know why it is failing for any user you can check SU53 and ask your security team to provide that access/security object to that user. So that he gets the correct object in his role to execute that program.

Thanks.

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 06:08:09 GMT

If i give permanent authorization to them there is no use of my program .

Please Tell me any function module through which i assign that authorization .

Re: Assign Authorization Using ABAP

ThangaPrakash — Thu, 27 Mar 2014 06:27:00 GMT

Hello Alok,

Did you check the above suggestion given by me.

Regards,

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 08:21:57 GMT

Yes

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 08:22:28 GMT

This message was moderated.

Re: Assign Authorization Using ABAP

nabheetscn — Thu, 27 Mar 2014 08:26:32 GMT

Alok What exactly you want to achieve

Re: Assign Authorization Using ABAP

nabheetscn — Thu, 27 Mar 2014 08:29:14 GMT

it is not a proper way...It is big security risk...Imagine you gave some one auhtorization but due to some reason it was not removed back..Imagine because of a silly mistake wrong authorization was given

Nabheet

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 08:48:14 GMT

SIR

After execution of statement reset the or delete the assign authorization if there is assign of authorization than there is way to remove the assign authorization also Sir

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 09:51:08 GMT

Run time assign authorization .using function module .

Re: Assign Authorization Using ABAP

matt — Thu, 27 Mar 2014 09:54:03 GMT

Assigning authorisations at runtime is possible, but extremely inadvisable unless you are guided by a security expert. It's also quite complicated to program.

To answer your question; there is no function module that allows you to assign authorisations at runtime.

If you explain exactly what you are trying to achieve and why, then it might be possible to help you.

Re: Assign Authorization Using ABAP

matt — Thu, 27 Mar 2014 09:54:37 GMT

Simply repeating that mantra will get you nowhere. You need to explain the context.

Re: Assign Authorization Using ABAP

Former Member — Thu, 27 Mar 2014 09:56:45 GMT

What you describe is the solution you have defined, and I'm getting the impression from the replies so far that is neither advisable or achievable.

I expect what Nabheet is looking to focus on is the requirements here, the situation that you are in that makes you think adding temporary authorisation at runtime is the solution.

In your original question you talk about zprogram2 and zprogram1, if you explained better what these programs do and why, all of these people who are trying to help you will be better placed to give you meaingful suggestions.

Regards,

Nick

Re: Assign Authorization Using ABAP

former_member375795 — Thu, 27 Mar 2014 10:06:43 GMT

Dear Sir ,

I am having one program i.e zlogin after some other program are call on the basis according to there ID's but I am not able to give authorization to the other program which is called by zlogin if i give authorization to that program which is called by after zlogin then any one go to directly to that program so I am unable to control .

Scenario

zlogin 2 records .

id tcode

a1 mm01

a2 mm02

so i want to give authorization of mm01 after zlogin only , if they call directly mm01 then give error no authorization.

Re: Assign Authorization Using ABAP

former_member187748 — Thu, 27 Mar 2014 10:19:39 GMT

Hi all,

i am little bit strucked because i am not getting that if a user id has no authorization at all for particular Tcode, can we assign it through any programs, means as we are restricting it at global level can we able to provide authorization for local level.

Hoping any fruitful information from experts..........

Re: Assign Authorization Using ABAP

nabheetscn — Thu, 27 Mar 2014 10:22:41 GMT

Your requirement is you have a custom program in which you have an internal table with tcode and user id...now you want the user id to give dynamic authorization..? Who is executing this custom report?

Not clear

Re: Assign Authorization Using ABAP

matt — Thu, 27 Mar 2014 10:38:27 GMT

It looks like he wants to be able to call MM01 (for example) from this program, but the user be unable to call MM01 directly. This is achievable by disallowing the transaction code "MM01" via roles, assigning all other material management create authorisations.

As far as I can see, this is an authorisation concept issue, not a programming issue.