topic Re: How to Restrict specific repository objects ? in Application Development and Automation Discussions

How to Restrict specific repository objects ?

ahmed_ibrahim2 — Mon, 25 Jul 2016 11:41:15 GMT

Dear collegues ,

hope every thing is OK

actually i am trying to prevent some Developers accessing or viewing specific objects "developed programs".

how to exclude specific programs from accessing by specific developers ?

Ahmed

Former Member — Mon, 25 Jul 2016 13:42:10 GMT

Hi, You can do this through authorization object S_DEVELOP.

ahmed_ibrahim2 — Tue, 26 Jul 2016 06:50:50 GMT

then , how to exclude the programs ?!, actually it is just 10 Developed programs i don't want to be accessed by all developers .

ravikirandvr — Tue, 26 Jul 2016 08:12:06 GMT

Firstly, secure the programs by assigning the authorization group. This would usually done by the developers during program creation.

Defined authorization groups are listed in table in TPGP.

You can review the existing authorization group assigned to a program using table TRDIR.

To assign programs to authorization group, you can use report RSCSAUTH.

Based on your requirement you can restrict using authorization objects S_PROGRAM and/or S_DEVELOP.

Following thread may also provide you more insights: https://scn.sap.com/thread/778538

ahmed_ibrahim2 — Tue, 26 Jul 2016 10:31:45 GMT

thanks Ravikiran

good idea , done with programs , but, how can we assign authorization group to Function module

ravikirandvr — Tue, 26 Jul 2016 11:49:59 GMT

For Function Module, we need to consider for function group and not authorization group.

Access to execute function module can be provided using Authorization object - S_DEVELOP.

OBJTYPE: FUGR

OBJNAME: <Function module's function group name>

P_GROUP: *

ACTVT: 16

For more details on S_DEVELOP please refer to SAP Library

To find out function modules of a function group, please refer to existing thread

Bernhard_SAP — Tue, 26 Jul 2016 12:09:35 GMT

don't forget to remove the authorization for debug/replace from your developers.Otherwise they can bypass the checks... 😉

Bernhard