topic Re: Restrict access to only one program in Application Development and Automation Discussions

Restrict access to only one program

Former Member — Thu, 13 Dec 2007 10:18:58 GMT

Hi all,

I need to generate a role which restrict users access only to execute one Z program in SA38.

Can someone let me know if there's a specific authorization object ?

Many thanks,

Re: Restrict access to only one program

Former Member — Thu, 13 Dec 2007 11:06:38 GMT

Creata a custom TRX for teh program and assign that to a role.

This is not the only, but the most secure solution, as one should not allow access to SA/SE38 in prodcution

Re: Restrict access to only one program

Former Member — Thu, 13 Dec 2007 12:42:54 GMT

Thank you but do you think there's another way to do that ?

Re: Restrict access to only one program

Former Member — Thu, 13 Dec 2007 13:44:50 GMT

In PFCG you can assign a program to the role menu & SAP will generate a tcode for it.

Some may suggest putting an auth group on the program and controlling by giving access to only that auth group in object S_PROGRAM. Unfortunately your user will still be able to execute 10's of thousands of other executable programs which are not assigned to auth groups. Even though there are security checks in most of the dangerous ones, it's not worth it in my opinion.

All said & done I would take Auke's approach as that is accepted "best practice" in this area.