topic Re: Basic Security Question in Application Development and Automation Discussions

Basic Security Question

former_member759680 — Wed, 19 Mar 2008 11:39:51 GMT

Tcode - ME21N

Object - M_BEST_BSA

Activity - 04(Print)

Tcode - ME9F

Object - M_BEST_BSA

Activity - 03(Display)

Now, one user has both these Tcodes through different Roles.

the User is able to Print(Activity 04) using Tcode ME9F.

But he should only have Activity 03 for ME9F.

Why is this happening?

Please help me if I can restrict ME9F to display only.

Thanks.

Re: Basic Security Question

Former Member — Wed, 19 Mar 2008 11:53:47 GMT

Authorisation sets are additive.

SAP is looking for M_BEST_BSA, actvt=04 and it doesn't care where it gets it from as long as the check is satisfied.

M_BEST_BSA, actvt=04 & M_BEST_BSA, actvt=03 (and their respective doc types) will both be in the user buffer and available for all checks against those value sets.

Without customisation you will not be able to provide this restriction unless you remove actvt=04

Re: Basic Security Question

former_member759680 — Wed, 09 Jul 2008 04:32:10 GMT

Thanks everyone