topic Re: SAP Security - User Buffer Behavior in Application Development and Automation Discussions

SAP Security - User Buffer Behavior

former_member993829 — Fri, 12 Oct 2018 23:52:39 GMT

I am trying to determine what auth object values will be checked for a user with multiple roles and authorizations assigned to them. I have an example below;

User JDOE has the following example access roles and authorizations.

Role 1:

T-Code: SM30

Auth Object: S_TABU_DIS

Activity: 02

Auth Group: ABC

Role 2:

T-Code: SM30

Auth Object: S_TABU_DIS

Activity: 03

Auth Group: *

Question - When this user JDOE executes SM30, will they have Activity 02 over ALL Auth Groups or just 02 over Auth Group ABC?

I would greatly appreciate a response.

Thank You!

Re: SAP Security - User Buffer Behavior

Colleen — Sat, 13 Oct 2018 07:35:54 GMT

they will only have ACTVT 02 to the Auth Group ABC. SAP doesn't merge the fields together in the buffer. User buffer does not care which role the authorisation comes from but it does evaluate each authorisations as a whole.

Re: SAP Security - User Buffer Behavior

sri_g4 — Fri, 26 Oct 2018 17:34:50 GMT

These are 2 separate instances of S_TABU_DIS and would not merge

Re: SAP Security - User Buffer Behavior

Bernhard_SAP — Tue, 04 Dec 2018 10:55:56 GMT

So it is important to understand, what is meant by 'authorization'. When users/admins talk about authorizations, they often mean something different compared to what the system means....

Technically speaking (from the codumentation):

quote

Entry in the user master record as part of an authorization profile . An authorization consists of fully specified or generic values for the authorization fields of an authorization object. The combination defines which activities a user can use to access which data. Authorizations are generated using the profile generator from role management tool (transaction PFCG) and can also be displayed using transaction code SU03.

unquote

Therefore - as Colleen has stated: each assigned 'authorization' is treated seperately and the authority-check checks the assigned authorizations for an object one by one with the values provided in the abap coding, until a positive result is found or all assigned authorizations have been checked w/o success (failed authority-check)

brgds, Bernhard