topic Re: Restricting Tcode using Roles in Application Development and Automation Discussions

Restricting Tcode using Roles

former_member184624 — Mon, 23 Feb 2015 06:57:16 GMT

Dear BW Experts,

I want to create a role to restrict of accessing TCODE : STMS_IMPORT and STMS in Production system. I can able to create a role by adding S_TCODE. While creating the role, inclusion is available but exclution is not available. I want to create a role by restricting tcode STMS and STMS_import. How to achieve this. Please help.

Thanks.

Re: Restricting Tcode using Roles

Loed — Mon, 23 Feb 2015 07:49:32 GMT

Hi Jalina,

Currently, what is the role of the user you are referring? Why don't you edit his or copy his current role and remove the STMS_IMPORT and STMS in S_TCODE?

Regards,

Loed

Re: Restricting Tcode using Roles

former_member184624 — Mon, 23 Feb 2015 13:11:01 GMT

HI,

Thanks for the reply. For the Current role, I have given access to all Tcode. I just want to restrict STMS_IMPORT. I cannot include all the TCODES in the current role. Please suggest.

Thanks.

Re: Restricting Tcode using Roles

Former Member — Mon, 23 Feb 2015 13:37:43 GMT

Hi Jalina,

You can try below option.

Thanks,

Shakthi Raj Natarajan

Re: Restricting Tcode using Roles

Former Member — Tue, 24 Feb 2015 04:03:17 GMT

This is a Basis/Security question and should ideally be posted in that SCN space. Security folks are better placed to answer this.

Re: Restricting Tcode using Roles

Former Member — Tue, 24 Feb 2015 06:34:18 GMT

Hi Jalina,

I wonder why would you even give access to all T codes in S_TCode, which is quite dangerous. Instead, try giving access to those T codes which is required by the user. And in case the user needs access to some critical transactions, then you may either suggest the user to use FF ID or may be you can give him/her access on temporary basis. I do not see a point in adding '*' in S_Tcode. Also I dont think it is SOX complaint.

Regards,

Mohamed Fazil

Re: Restricting Tcode using Roles

Former Member — Sat, 28 Feb 2015 13:58:24 GMT

All transaction codes in production !! You might to review the security design and give them what is needed versus give all and then restrict on few.

Re: Restricting Tcode using Roles

Colleen — Thu, 05 Mar 2015 07:17:04 GMT

Hi Jalina

but exclution is not available

SAP Security role authorisation concept does not cater for exclusion values or ranges

If you are not a security person, I recommend you look at the ADM940 or help.sap.com for Authorisations Concept or discuss your requirements with your Security contact.

Regards

Colleen