topic Re: can this bapi replace with fm in Application Development and Automation Discussions

can this bapi replace with fm

Former Member — Thu, 26 Mar 2015 10:08:04 GMT

Hi Friends

In one of the old program to update storage location and other data BDCs were getting used but due to very slow performance it get replaced with

BAPI ' BAPI_MATERIAL_SAVEDATA ' but issue with this bapi is , only user is getting 'No Authorization for this transaction ' rest we all able to upload data , but client not ready to give any other access to the user and want us to handle this at program level only ,

few options I got are ,

1) SU24 can help to suppress auth checks but not acceptable and good idea for long run ,

,2) FM - > CALL_TRANSACTION_FROM_TABLE

3) FM - > C160_TRANSACTION_CALL

but these all above not advisable as se37 access need to provide ,

finally one option suggested to replace this BAPI with FM ' MATERIAL_MAINTAIN_DARK ' not sure it will work or not am starting working on this .

mean time does any body have any other suggestion or best option .

Regards

Meeta

Re: can this bapi replace with fm

matt — Thu, 26 Mar 2015 10:14:52 GMT

What is the authorisation object that is triggering the no authorisation message? Use SU53 for this information.

As a general principle, if a user needs an authorisation to do a task for which there is a business requirement, they are given the authorisation. Presumably there is a business requirement, so the authorisation concept should be updated.

Use of unreleased function modules is not supported by SAP; so it is not a good idea.

I would return to the client and tell them the options are

1) Modify the authorisation concept - fully supported by SAP

2) Suppress via SU24 - which will cause a massive stink if the client has an external security audit

3) Use unreleased function modules which are not supported by SAP

Then see what their response is. Usually a business requirement trumps everything, and suddenly option 1) becomes acceptable.

Re: can this bapi replace with fm

Former Member — Thu, 26 Mar 2015 17:51:25 GMT

Moderator message: this solution is not recommended. See Paul Bakker's response below.

Although I completely agree with Matt, there is an option that I found recently. I would not comment whether its is right or wrong to use this approach in your case but our requirement was a little different where, in order to allow a certain functionality a lot of authorizations were to be allowed. In order to over come this issue:

Add the below code:

***************************** set the user ********************

concatenate 'WORKFLOW_LOCAL' sy-mandt to destination separated by space.

***************************** set the user ********************

Then call the function using the above destination. This sets the user as WORKFLOW which will have a better authorization.

CALL FUNCTION 'XYZ' destination lv_dest.

Inputs are most welcome.

Thanks,

Vikram.M

Message was edited by: Matthew Billingham

Re: can this bapi replace with fm

paul_bakker2 — Fri, 27 Mar 2015 05:54:15 GMT

Vikram,

Have you actually tried that yourself? I ask because I can see some factual errors in your post. It won't work as it stands.

And if it did somehow work, you would be effectively circumventing all authorisations in the system as well as performing updates under another user's name (ie the workflow system user). If anyone tried that at my company they would be terminated immediately.

So have you actually done this?

cheers

Paul

Re: can this bapi replace with fm

matt — Fri, 27 Mar 2015 05:59:52 GMT

Exactly. The correct way is the fix the authorisations.

Re: can this bapi replace with fm

Colleen — Fri, 27 Mar 2015 07:15:43 GMT

solutions proposed like the one above also call out why systems user accounts should be restricted and not assigned SAP_ALL

Re: can this bapi replace with fm

Former Member — Fri, 27 Mar 2015 09:24:13 GMT

Hi Thanks to all for your valuable inputs ,

Actually these below options are possible for this BAPI error ,

1) To add authorization object for all the “maintenance status” to user’s role.

> 2) Program modification

> Ignore the error message for authorization.

> 3) Program modification

> Submit another program by using user: UC4BATCH in order to avoid an authorization error

> 4) Program modification

> Somehow, avoid passing the authorization values for unnecessary “maintenance status”

but they very first want to know if option 4 can we an solution or not ? as user was able to update using BDC before code change ( replace bdc with bapi ) ,, as other options they need to give more access .

we updating same data only through BAPI. But, does this BAPI always require the authorization for all the maintenance status?

Re: can this bapi replace with fm

matt — Fri, 27 Mar 2015 10:27:38 GMT

It becomes clearer. It seems then that the BAPI doesn't properly apply the users authorisations. It should check that the user has the authorisation to change at least what they have authority to change.

Maybe the way forward would be to raise a call with SAP asking for the BAPI to be updated? (This is what I did when a support pack enlarged the scope of a BAPI, but that required the users to suddenly have the authorisation to do all the enlarged scope - I did get a response and a fix quite quickly).

However, I've search this site (which is what you should have done first of all) and it seems this is a common problem. One poster suggests that although you get the error message - the change is made. If that is the case, then just ignore the error message.

Re: can this bapi replace with fm

Former Member — Fri, 27 Mar 2015 14:00:04 GMT

Paul,

I cannot agree more on what you have stated. It is true that it overwrites the authorization and in order to over come the same the actual program in which this was coded was controlled by proper authorization.

fortunately this is not something that I coded but came across whIle I was making changes.

The idea was not to encourage others using this option. I never knew some thing like this would work before I came across this recently.

Thanks,

Vikram

Re: can this bapi replace with fm

matt — Fri, 27 Mar 2015 15:38:30 GMT

The reason why this should never be done is that it subverts the whole authorisation concept. It might not just land a programmer who used it in serious trouble, but it would also land any regulated industry in trouble. Imagine a company where the person creating new customers, new purchased orders and approving invoices...

Re: can this bapi replace with fm

Former Member — Mon, 30 Mar 2015 18:53:31 GMT

Hi Friends

Thanks for your valuable suggestions , but still they want to first try level best for all possible options without giving any role / access as their simple query is using BDC user was able to update then

same they expecting with this BAPI as well . 😞

This issue is still open ad am getting suggestions like to copy this BAPI into custome one BAPI_MATERIAL_SAVEDATA into Z Bapi and make try to look option if authorization message can be skipped . but am not sure this will success or not or its good suggestion .?

Regards

Meeta

Re: can this bapi replace with fm

Jelena_Perfiljeva — Mon, 30 Mar 2015 21:39:47 GMT

Matt already correctly pointed out above that if BAPI does not handle authorization checks correctly then the right thing to do is to ask SAP to fix it (by opening an incident).

You could easily do an authorization trace (ST01) with the old program (or just standard transaction) and then with the BAPI. Then look at the differences and if there seems to be excessive authorizations required by BAPI then it's perfectly reasonable to ask SAP what the heck.

Any other "creative" solution will be either a violation of the authorization concept or a redundancy that someone will have to address at later time, just like now you're trying to replace BDC with something better. At the same time countless other developers will continue having the same issue because no one thought about solving the root cause.

Re: can this bapi replace with fm

matt — Tue, 31 Mar 2015 06:03:44 GMT

Copying a standard function module (or BAPI) is nearly always a really bad idea. You don't benefit from any fixes through service packs, and, worst case (I've seen it happen), the copy might stop working due to changes elsewhere - necessitating a re-clone.

Finally, if you create your own code to update standard SAP tables (which is what your copy would effectively be) then that if something goes wrong, SAP will not fix your database without charging significant sums of money.

Re: can this bapi replace with fm

Former Member — Tue, 31 Mar 2015 09:36:26 GMT

I got this another link relevant

but am not sure .if its correct way

Re: can this bapi replace with fm

Jelena_Perfiljeva — Tue, 31 Mar 2015 13:09:31 GMT

[banging my head on the desk] Is there some issue with opening an incident with SAP? They don't bite (usually).

What do you think about the solution in the linked post? If it was acceptable in your case to run the program in a background job then we probably wouldn't be having this discussion. Just thinking.

Re: can this bapi replace with fm

matt — Tue, 31 Mar 2015 13:32:19 GMT

There would only be an issue if the SAP system in question wasn't licensed. So it can't be that.

Re: can this bapi replace with fm

Former Member — Tue, 31 Mar 2015 18:24:19 GMT

Sorry as am under pressure to check maximum possibility to handle this at program level,

But now I have raised this to SAP ,