topic Re: block particular access in Application Development and Automation Discussions

block particular access

Former Member — Fri, 15 Jun 2007 04:48:02 GMT

the user have SAP_ALL and SAP_NEW profile.

but i want to block particular client in scc4.

i mean they not able to edit the client

how to do ?

need help

Message was edited by:

Lee green

Re: block particular access

Former Member — Fri, 15 Jun 2007 04:55:39 GMT

Hi,

I think you need to create a Z role in <b>PFCG</b> which blocks the access of transaction code <b>SCC4</b> and then assign this role to the users.

Regards,

Sowmya

Re: block particular access

Former Member — Fri, 15 Jun 2007 04:57:40 GMT

Re: block particular access

Former Member — Fri, 15 Jun 2007 05:37:39 GMT

Hi Lee,

It is impossible, even if you block the access to the transaction to SCC4 through other role, they will get the authorization from SAP_ALL profile.SAP also doesnot recommend to give SAP_ALL and SAP_NEW to the users.First remove these profiles from the users and give them a new set of roles based on their functionality.

Regards,

Bharath

Re: block particular access

Former Member — Fri, 15 Jun 2007 06:05:25 GMT

First create a z role in PFCG

Go to Authorization tab -> click on change authorization tab -> do not select any of the templates

Next click on the menu item Edit -> insert authorizations-> from profile

Enter SAP_ALL

This will insert the authorization object corresponding to SAP_ALL profile

Repeat the same procedure for the profile SAP_NEW

Next step is to find the authorization object corresponding to transaction SCC4 using tc SU22

Inactivate the authorization object corresponding to SCC4 in PFCG.

I think this might work but it is a long and tedious process

Regards,

Sowmya

Re: block particular access

Former Member — Fri, 15 Jun 2007 06:59:41 GMT

Simply do not give SAP_ALL to anyone, only use roles created with PFCG!!!

Re: block particular access

manohar_kappala2 — Fri, 15 Jun 2007 17:34:28 GMT

Hi,

If you want to give access to SAP_ALL and SAP_NEW and still want to control his access to SCC4, perhaps its not possible because whatever restriction u put in can be changed by this user.

For example lets say u have created a role based on SAP_ALL and SAP_NEW and removed tcode SCC4 and related objects from the role and assign it to user.

Now once u logon using the ID with that role he can go to PFCG and undo the changes u have done.

And adding to this there are more than one tcode which works the same way as PFCG but having different name and also there are many backdoors to move accross.

So in short what ever action u take to control that access can be undone by user with SAP_ALL and SAP_NEW...

Hope this helps

Manohar