topic Re: TCode per department and user in Application Development and Automation Discussions

TCode per department and user

ekekakos — Mon, 22 Jan 2018 09:11:44 GMT

Hello to everyone.

I have a strange request from the business. They want a report where they give a tcode or tcodes and the program will check which department has this/these and which users.

OK, I have found a couple of tables like AGR_TCODES (Assignment of roles to Tcodes), AGR_USERS (Assignment of roles to users) and USER_ADDR (Users by address data) to find what I want.

My question is: if a user has access to a tcode that it does not belong to one of his role, how can we catch this?

For example: I have access to VA03 but none of my roles is connected to this tcode.

Is there any way to catch this?

Thanks in advance

Elias

Re: TCode per department and user

Former Member — Mon, 22 Jan 2018 09:56:57 GMT

A very useful tool to track usage of transaction: ST03N and STAD. This transaction can report on different levels how often a specific transaction is used and by which users. This can be handy in determining authorization profiles after Golive. It can also be used by Big Brother to check whether end user testing has really taken place.

If you want to write your own probram, you can trace ST03n and find where the data stores

Re: TCode per department and user

ekekakos — Mon, 22 Jan 2018 11:08:55 GMT

Thanks Steve for your answer. I already have created a report which reads the audit logs and display the tcodes that users run.

But the business is asking sth more. I hope that their request is understandable.

Thanks again

Re: TCode per department and user

pokrakam — Mon, 22 Jan 2018 13:36:54 GMT

Sounds like SUIM should already provide what you're after, or am I missing something?

Re: TCode per department and user

Jelena_Perfiljeva — Mon, 22 Jan 2018 19:22:57 GMT

My thoughts exactly.

If a transaction is not in the roles then it must be in a profile, I guess. There were some buttons in SUIM to show the profile assignment, I believe, although never really used them.

Re: TCode per department and user

Former Member — Tue, 23 Jan 2018 02:22:34 GMT

I think SUIM should be able to provide that detail to you.
When you search for Va03 you would see some of Standard roles or the custom roles assigned and then compare with the roles and profiles assigned to your User ID

Im attaching 2 screenshots of how Ichecked which role has that Tcode and list of roles accesible by my ID

Lastly you can also ask Security to activate trace or check in SU53 what all authorisations you have if that helps you to identify more

From creating a report for all users SUIM is the best place

Re: TCode per department and user

ekekakos — Fri, 26 Jan 2018 11:23:06 GMT

Finally, I found the solution to what I was looking for. Here is the selection:

SELECT DISTINCT a~von e~ttext d~department d~bname d~name_first
                  d~name_last d~name_textc c~profile
      INTO CORRESPONDING FIELDS OF TABLE gt_tcode_per_dprtm_usr
    FROM ust12 AS a
      INNER JOIN ust10s AS b
        ON  a~auth = b~auth AND
            a~objct = b~objct AND
            a~aktps = b~aktps
      INNER JOIN ust04 AS c
        ON b~profn = c~profile
      INNER JOIN user_addr AS d
        ON c~bname = d~bname
      INNER JOIN tstct AS e
        ON e~tcode = a~von
    WHERE a~objct = 'S_TCODE' AND
          a~von   IN so_tcode AND
          e~sprsl = 'G'.

I want to thank all of you for your answers.

Re: TCode per department and user

RaymondGiuseppi — Fri, 26 Jan 2018 11:59:20 GMT

You could also look in your system for table UST10C for composite profiles.