topic Re: creating an authorization object in Application Development and Automation Discussions

creating an authorization object

Former Member — Wed, 06 Jun 2007 08:39:10 GMT

hello all,

i have a requirment where i need to create a new authorization object by company code, lockbox source and destination.

i dont have any idea about creating authorization object, can any one please tell me procedure to do this.

Thanks,

raju N

Re: creating an authorization object

Former Member — Wed, 06 Jun 2007 08:41:06 GMT

SU21/2.

Regards

Peram

Re: creating an authorization object

Former Member — Wed, 06 Jun 2007 08:43:15 GMT

use txn SU20/SU21/SU53

AUTHORITY-CHECK OBJECT object

ID name1 FIELD f1

ID name2 FIELD f2

...

ID name10 FIELD f10.

Effect

Explanation of IDs:

object

Field which contains the name of the object for which the authorization is to be checked.

name1 ...

Fields which contain the names of the

name10

authorization fields defined in the object.

f1 ...

Fields which contain the values for which the

f10

authorization is to be checked.

AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).

You must specify all authorizations for an object and a also a value for each ID (or DUMMY).

The system checks the values for the IDs by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.

If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.

If the return code value in SY-SUBRC is 0, the user has the required authorization and may continue.

The return code value changes according to the different error scenarios. The return code values have the following meaning:

User has no authorization in the SAP System for such an action. If necessary, change the user master record.

Too many parameters (fields, values). Maximum allowed is 10.

Specified object not maintained in the user master record.

No profile entered in the user master record.

The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.

Incorrect structure for user master record.

If the return code value is 8 or 24, inform the person responsible for the program. If the return code value is 4, 12, 16 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP because authorizations have probably been destroyed.

Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.

Note

Instead of ID name FIELD f, you can also write ID name DUMMY. This means that no check is performed for the field concerned.

The check can only be performed on CHAR fields. All other field types result in 'unauthorized'.

Example

Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:

Table OBJ: Definition of authorization object

M_EINF_WRK

ACTVT

WERKS

Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations

M_EINF_WRK_BERECH1

ACTVT 01-03

WERKS 0001-0003 .

can display and change plants within the Purchasing and Materials Management areas.

Such a user would thus pass the checks

AUTHORITY-CHECK OBJECT 'M_EINF_WRK'

ID 'WERKS' FIELD '0002'

ID 'ACTVT' FIELD '02'.

AUTHORITY-CHECK OBJECT 'M_EINF_WRK'

ID 'WERKS' DUMMY

ID 'ACTVT' FIELD '01':

but would fail the check

AUTHORITY-CHECK OBJECT 'M_EINF_WRK'

ID 'WERKS' FIELD '0005'

ID 'ACTVT' FIELD '04'.

To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK.

Regards,

Seema.

Re: creating an authorization object

Former Member — Wed, 06 Jun 2007 08:44:25 GMT

Hi Raju,

Authorization object is created in tcode SU21. And authorization fields are created in SU20.

For each authorization object, we insert a number of fields. If the field for which we want to create authoriztion is not there, we create that field in SU20.

Eg : F_BKPF_BLA is an authorization object which has two fields, authorization group(BRGRU) and activity(ACTVT). Using this authorization object, you determine with which document type line items can be posted and processed.

Authorizations are created for this object giving the value permitted for each field

eg authorization 1 - S_AUTH_1

activity - 01
BRGRU - authorization group

Users have this authorization can perform activity 01, that is creating.

authorization S_AUTH_2

*activity - 01, 02, 03.

BRGRU - authorization group

Users having this authorization can perform activities 01, 02 and 03, that is create, change and display.

A profile is created to store the authorizations and transactions allowed for a particular user(by defining the role). This is done using transaction PFCG. And this profile name is maintained in the user record for each user.

When the user logins, the user record is checked.

Every time an action is taken by the user, an authority-check command must be called in the program

AUTHORITY-CHECK OBJECT 'F_BKPF_BLA'

ID 'BRGRU' FIELD T003-BRGRU

ID 'ACTVT' FIELD '03'.

Now, for this particular login, if an authorization for the given value is present, the transaction is accepted. Else the check fails and the action will not be allowed for the user.

For eg, if authorization S_AUTH_1 is there in the profile for that user, then this is allowed. But if only S_AUTH_2 is there, then the check fails.

Thanks.