topic Automate PFCG process in Application Development and Automation Discussions

Automate PFCG process

dan_spitzig — Mon, 25 Aug 2025 16:17:11 GMT

Hi Experts,

To prepare for S4HANA, I am trying to cleanup our roles. Specifically, I am trying to write ABAP code to automate the PFCG process to change manually added transaction codes (AGR_1251-OBJECT = 'S_TCODE' and AGR-1251-MODIFIED = 'U') to Menu transaction codes. Rather than adding the transactions to the Menu, I want to use the Authorization Default (in PFCG, Menu->Transaction->Authorization Default) so that there is no changes to the users' menus.

I have found CL_PFCG_MENU_MODIFY->MENU_ADD_TRANSACTION, but this adds it to the users' menu.

Does anyone know how to do this with class-methods or function modules.

Re: Automate PFCG process

FabioPagoti — Mon, 25 Aug 2025 20:50:31 GMT

I suspect you are trying to avoid this class somehow because you are not able to create an object using `CREATE OBJECT` or `NEW` as this class has a "private constructor" (create private as part of the class declaration)

That means that only the class itself can create objects of its type. That is the well-known Factory class pattern.

In this case the method which allows you get a new instance of this class is `RETRIEVE_FOR_UPDATE`.

Basically call this method beforehand and grab the `ER_ROLE` parameter inside a reference. Then you use this reference to call `MENU_ADD_TRANSACTION`

Re: Automate PFCG process

dan_spitzig — Mon, 25 Aug 2025 21:08:19 GMT

I am currently using that method, but by using that method, it shows up in the users' menus. That's what we are trying to avoid, because it will cause mass confusion. When we add transactions to a role using the Authorization Default in PFCG, it does not show up in users' menus, which is what I am trying to duplicate. I am going to try method MENU_ADD_SERVICE, because when I look in AGR_HIER, the Report field says Service rather than a transaction code. Do you have any experience with this?

Re: Automate PFCG process

FabioPagoti — Mon, 25 Aug 2025 23:31:57 GMT

So this has nothing to do with this method being an instance method and your need to use a class-methods or function module.

If you don't want the menu to be changes then method `MENU_ADD_TRANSACTION` is clearly not the option regardless how the method was defined.

Could you please share an example of what you have and what is the desired output?

Re: Automate PFCG process

dan_spitzig — Tue, 26 Aug 2025 12:51:24 GMT

No, it has nothing to do with the method call. I have that working successfully. It correctly shows up in the Role Menu in PFCG, but it also shows up in the user's SAP GUI menu. This is snippet of code used to accomplish that:

* Add the T-Code to the User Role

l_tcode = 'SE16'.
    CALL METHOD l_class->menu_add_transaction
      EXPORTING
*       iv_target_id            =
        iv_tcode  = l_tcode
*       iv_first_node_in_folder = 'X'
*       iv_node_text            =
      IMPORTING
*       ev_new_object_id        =
        et_return = l_rettab.

* Save and Unlock the User Role
  CALL METHOD l_class->save
      IMPORTING
        et_return = l_rettab.

* Regenerate the Role
  CALL FUNCTION 'PRGN_AUTO_GENERATE_PROFILE_NEW'
    EXPORTING
      activity_group       = p_role
*     PROFILE_NAME         =
*     PROFILE_TEXT         =
*     NO_DIALOG            = 'X'
*     REBUILD_AUTH_DATA    = 'X'
      org_levels_with_star = 'X'
*     ORG_LEVELS_WITH_STAR =
*     FILL_EMPTY_FIELDS_WITH_STAR         = 'X'
*     TEMPLATE             =
*     CHECK_PROFGEN_TABLES =
*     GENERATE_PROFILE     = 'X'
*     AUTHORITY_CHECK_PFCG =
*     REQUEST              =
* IMPORTING
*     NEW_REQUEST          =
    TABLES
      return               = l_rettab
*     MANUAL_AUTHS         =
*     OBJCTS_EXCL          =
* EXCEPTIONS
*     ACTIVITY_GROUP_DOES_NOT_EXIST       = 1
*     ACTIVITY_GROUP_ENQUEUED             = 2
*     PROFILE_NAME_EXISTS  = 3
*     PROFILE_NOT_IN_NAMESPACE            = 4
*     NO_AUTH_FOR_PROF_CREATION           = 5
*     NO_AUTH_FOR_ROLE_CHANGE             = 6
*     NO_AUTH_FOR_AUTH_MAINT              = 7
*     NO_AUTH_FOR_GEN      = 8
*     NO_AUTHS             = 9
*     OPEN_AUTHS           = 10
*     TOO_MANY_AUTHS       = 11
*     PROFGEN_TABLES_NOT_UPDATED          = 12
*     ERROR_WHEN_GENERATING_PROFILE       = 13
*     OTHERS               = 14.

I removed the error checking, etc. so only relevant code is displayed. This works:

However, although I don't have the credentials to log on with that user, the role will also show up here in the SAP Menu, which is what we want to avoid.

Re: Automate PFCG process

dan_spitzig — Tue, 26 Aug 2025 13:57:33 GMT

In PFCG, the standard way of adding a transaction is by going to the Menu tab, click on Transaction dropdown and selecting "Transaction", which looks like what the MENU_ADD_TRANSACTION method seems to do.

What I am trying to simulate in ABAP is adding a transaction via Menu tab, click on Transaction dropdown, and select "Authorization Default" rather than "Transaction".

Re: Automate PFCG process

dan_spitzig — Tue, 26 Aug 2025 16:23:55 GMT

To add a transaction to the Role Menu, you can use CL_PFCG_MENU_MODIFY->MENU_ADD_TRANSACTION. This will be displayed the user's SAP Menu in SAP GUI. However, I did not want it to appear in the user's SAP Menu in SAP GUI.

SOLUTION is to use CL_PFCG_MENU_MODIFY->MENU_ADD_SERVICE. It works like a charm!

Re: Automate PFCG process

dan_spitzig — Thu, 04 Sep 2025 13:03:10 GMT

Using the MENU_ADD_SERVICE does what i need it to. I added SE16 to the Role Menu as 'Authorization Default'.

I generate the profile using function module PRGN_AUTO_GENERATE_PROFILE_NEW , and I have to set the ORG_LEVEL_WITH_STAR flag to 'X' to avoid a popup box saying Org Levels are unassigned. After generating the profile, a lot of unwanted authorizations get added to the Role Menu, which we want to change to 'Inactive'. I do direct table updates to tables AGR_1250 and AGR_1251 to set the DELETED fields to 'X'. I know this is not recommended, but I can't find a method/function module that does it. After setting these fields, the profile looks as it should in PFCG.

When the user logs on, and uses SE16, they should be able to open the Transaction, but not be able to view the contents any tables. As it turns out, they now have full access to SE16, with all tables available to them. I tried to regenerate the Profile after the direct table updates to AGR_1250 and AGR_1251, but that results in the S_TBAU_DIS and S_TABU_NAM authorizations changed from 'Inactive' to 'Active'.

Does anyone have an ideas on how to accomplish this?