topic Re: SE38 Authorization by Exclusions in Application Development and Automation Discussions

SE38 Authorization by Exclusions

shane_kelly2 — Mon, 25 Sep 2017 19:38:15 GMT

I would like to create an authorization group for t-code SE38 - that excludes a handful of programs.

so for example it would give the user access to all SE38 reports - except the few listed.

Re: SE38 Authorization by Exclusions

Colleen — Tue, 26 Sep 2017 03:07:39 GMT

Hi Shane

Each program would need to be in auth group. Read up on S_PROGRAM/S_PROGNAM authorisations

It might be more pain than worth. If you change auth groups on standard programs then you might have issues with your security access and have to go through to update SU24 for impacted transactions

Generally, avoiding SE38 being granted to users in production and then build custom transactions when you want to provide access as you won't know if you have excluded all critical/risk programs that you need to.

Regards

Colleen

Re: SE38 Authorization by Exclusions

shane_kelly2 — Tue, 26 Sep 2017 15:35:09 GMT

normally - I agree - except I'm the system administrator - so I need SE38. But our auditors don't want me running two specific programs that could delete audit logs. I'm not sure how else to do that.

Re: SE38 Authorization by Exclusions

Colleen — Tue, 26 Sep 2017 16:58:05 GMT

You could test running those programs to see if s_dataset for actvt 06 is also checked and make sure not assigned as extra check

Re: SE38 Authorization by Exclusions

Rizwan9697 — Wed, 11 Oct 2017 15:34:09 GMT

SE38 is very powerful Tcode, as you able to modify any program, Please go with SA38.

Give SA38
Map all programs to a Authorization groups
its a one time activity but will secure all standard and custom programs as well.