topic Re: Authorization Check in Application Development and Automation Discussions

Authorization Check

Former Member — Fri, 16 Feb 2007 01:54:05 GMT

Hi SDN's,

I am asked to do some authorisation checks on one of the Z Tcode. I am given the Auth Object Name and am asked to implement in my ABAP Code for the ZTcode.

What am i supposed to do?

Since that i have never done this before, Plz help me.

Thanks

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:14:50 GMT

Hi,

You need to add code similar to the below one in your Z report:

authority-check object 'Z_PLNT_AUT'

id 'ACTVT' field '03'

id 'WERKS' field i_auth_werks-werks.

if sy-subrc ne 0 .

message e398(00) with

'User' sy-uname 'not authorised for Plant : ' i_auth_werks-werks.

endif.

Thanks.

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:29:47 GMT

Hi Rahul,

Thnk u for the reply,

lets consider my example. my Z tcode is not allowed for few users with diff company codes. so the auth obj given to me is doing that.

but i am doing another thing similar in my module pool PBO

i select the same from USR05 table and validate it against the PARID value having BUK ie the comp code

if sy-subrc ne 0 then i am giving an error msg

is this similar to the auth obj which i am asked to do

Regards

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:34:52 GMT

When you create the Z-tcode there is a field to enter the authorization object.

Display your z-transaction (SE93) and look for the field below your program name/selection screen/variant/.

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:37:48 GMT

Usha,

Both the validations are different...

The one you have used in the Module Pool checks the Parameter Value Set for an User. If users have authorization for setting the parameters in their USER Profile, they can change this value.

Best would be to you AUTHORITY-CHECK command.

Thanks.

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:43:08 GMT

Hi Sam,

Does this mean that we need nothing to do in our ABAP even after assigning the Auth Obj in SE93

I suppose not, as we need to give an error msg to the user.

So i had a check on the auth obj using auth check statemtn in the PBO. this shud be correct right?

Regards

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:44:16 GMT

Thnx Rahul,

one last thing the auth check which i am supposed to do shud be done in the PBO of the screen right?

Plz correct me if i am wrong

Regards

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:46:55 GMT

No Usha,

This should be in the PAI, as in the PBO event you won't have the Company Code for which user is executing the transaction.

Right?

Thanks.

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:49:05 GMT

I default the Comp Code in the PBO itself.

So shud be OK right?

Regards

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:51:09 GMT

You mean user can not change this Company Code? If so, it will work. But am surprised as how are you defaulting the CO code?

I mean, how are you getting (selecting) this default Company code?

Message was edited by:

Rahul Patni

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:53:50 GMT

Based on the SAP User ID i get if from USR05 and default it and the user can not change it.

Regards

Pratyusha

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:57:00 GMT

Have you given authorization to the user to set parameter values in User Profiles?

If yes, then this check is fine. Or else I doubt how is this going to help.......?

Thanks

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 02:58:45 GMT

I dont understand. if you are given an auth object and asked to restrict your t-code against it then why do you need to make additional check in your code? if there user does not have the authorization object in his/her role, then it will restricted automatically.

Re: Authorization Check

Former Member — Fri, 16 Feb 2007 03:08:56 GMT

HI,

Write code like this,

data: tcode like sy-tcode.

tcode = sy-tcode.

AUTHORITY-CHECK OBJECT 'P_TCODE'

ID 'TCD' FIELD TCODE.

if sy-subrc <> 0.

message error.

exit.

endif.

Regards

Subramanian