topic Re: Not able to restrict users from using SU01 in Application Development and Automation Discussions

Not able to restrict users from using SU01

Former Member — Fri, 28 Mar 2008 22:38:40 GMT

Hi ALL,

We are working on roles related to SECURITY ADMINISTRATOR.

The role has been given a transaction SU01D and not SU01.

But the users are able to enter into SU01 through SUIM.

I will illustrate this situation more:

SUIM->USERS->BY LOGON DATE AND PASSWORD CHANGE

Then I entered the user id.Executed.

From the result, I was able to enter into su01 .i.e was able to use the change button of su01.

Please tell me how do I restrict this situation.?

Reagrds,

Ajit.

Re: Not able to restrict users from using SU01

Former Member — Fri, 28 Mar 2008 23:25:31 GMT

Access to user administration is not only limited to SU01.

Most likely, the threads of this search term will explain why the users can access the transaction screens of user administration: https://forums.sdn.sap.com/search.jspa?objID=f208&dateRange=all&numResults=15&rankBy=10001&threadID=&q=SU01_NAV

Whether the user can complete the transaction is a different story... for that you need to use the application authorization objects (S_USER* objects are a good start - see transaction SU21 for more infos on the application security concept for these objects)

Cheers,

Julius

PS: A troublesom object is S_USER_GRP, because it is important. When the user ID does not have a user group assigned, then the effectivness of this authorization object is weak, which can impact your security (depending on the access of the user without an authorization group)...

Re: Not able to restrict users from using SU01

Former Member — Fri, 28 Mar 2008 23:44:52 GMT

Hi Ajit,

SU01 has an explicit authority check statement for 'SU01'

CALL FUNCTION 'AUTHORITY_CHECK_TCODE'

TCODE = 'SU01'

The user needs to have access to SU01 to enter it. Unless this check is suppressed in SE97. Did you trace to check if S_TCODE is being checked?

Thank you

Abhishek

Re: Not able to restrict users from using SU01

Former Member — Sat, 29 Mar 2008 00:10:58 GMT

HI Abhisheck,

My interpretation of the question is, as stated: Not able to restrict users from using SU01.

Using a transaction (and completing it) is distinctly different to starting any user management related functionality, as there are many entry points... I don't think that I know them all

SU01 has some special features specific to SU01, but user management security in SAP for me has a focus on "can the transaction be completed, almost regardless of the context (sy-fields, and S_TCODE)?"

Cheers,

Julius

Re: Not able to restrict users from using SU01

Former Member — Sat, 29 Mar 2008 01:45:13 GMT

Hi Julius,

I am with you. Reaching it, and completing it are 2 different things.

Was just curious how the authority check got suppressed. So many entry points..... maybe I though this could just be another new one

Anyway, have a great weekend ahead 😛

Thank you

Abhishek

Re: Not able to restrict users from using SU01

Former Member — Sun, 30 Mar 2008 21:24:59 GMT

Hi,

Based on the description, the user is in transaction SU01_NAV, not SU01.

Cheers,

Julius