topic Re: checking authorization of a tcode// in Application Development and Automation Discussions

checking authorization of a tcode//

Former Member — Thu, 18 Oct 2007 12:17:24 GMT

can i check the authorization objects of a tcode?

i want to assign a user with only a tcode not with the full role.

is there any way that i cud asssign a user with a tcode only with out creating a new role, cud i view some how what particular authorization a tcode is using

thanks

akshat

Re: checking authorization of a tcode//

Former Member — Thu, 18 Oct 2007 14:31:26 GMT

You can only assign the tcode to the user by giving them a role with it in or creating a new role containing that t-code. There is no other way.

If you want to view the authorisations for a t-code you can get a rough idea by looking in tx SU24 for the entries corresponding to that t-code.

More accurately, use tx ST01 to do a system trace on the tx and that will tell you which objects and values have been checked for the tx & data that you ran

Re: checking authorization of a tcode//

Former Member — Fri, 19 Oct 2007 08:46:13 GMT

Hi,

::::can i check the authorization objects of a tcode?

Check tables USOBT and USOBT_C via se11.

Regards

Re: checking authorization of a tcode//

koehntopp — Fri, 19 Oct 2007 10:20:13 GMT

Akshat,

are you sure that's a good idea...?

First of all - use SU24 to check the objects that are defined for the TCode. Additionally, an authoritzations trace with ST01 will give you certainty.

If you add the TCode manually, you lose that connection. I..e, when you remove the TCode, the user might still have the objects, and these may be harmful in conjunction with a different TCode, meaning that the user will have access to stuff you don't want him to.

We recommend assigning transactions only via the menu, and maintaining SU24 properly.

Kind regards,

Frank.

Re: checking authorization of a tcode//

Former Member — Tue, 23 Oct 2007 13:22:28 GMT

Hi,

I do not know why you want to do this, adding a transaction without a role. It is possible that you create a profile ( mind not a role and a profile), but you should not do that. Su24 give the sap proposed information about transaction, objects and values for the fields. If you really want just a profile, let me know. You can make a role, add the transaction and delete or make all the objects inactive that you can, generate this and add the role to the user.

have fun

Jan van Roest