topic Re: Authority check on Tcode in Application Development and Automation Discussions

Authority check on Tcode

Former Member — Wed, 23 Apr 2008 10:38:47 GMT

Hello Experts,

Please can any one tell me, how does the code behave in the below situation.

AUTHORITY-CHECK OBJECT 'S_TCODE'

ID 'TCD' FIELD 'ZSCHECK'

Here am checking whether the user has access to this Tcode 'Zscheck.' what happens if the user has Z*(partial wild card) or *(wildcard char's) in his role.

Does the user is allowed to access the TCode or rejected?

Thanks In advance.

Also how to do the Authorization-check at the table level.

(table-maintenance) ??

Re: Authority check on Tcode

Sm1tje — Wed, 23 Apr 2008 10:54:33 GMT

if user has Z* than he (probably) has authorization for all Z-transactions.

At table maintenance level you can check for transaction code SM30, which means he can't do any 'customizing'. If this is not what you want, create a transaction for your maintenance table in SE93 and check for this transaction code.

Re: Authority check on Tcode

ThomasZloch — Wed, 23 Apr 2008 11:03:37 GMT

Hi,

I don't see a need to check S_TCODE authorization explicitely, as it is always being checked by the system whenever you start a transaction.

Yes, Z* allows any Z-transaction, whereas * allows all transactions.

The authorization on table level is checked via S_TABU_DIS for an authorization group, which can be assigned in the table maintenance generator (SE54 or via SE11).

Cheers

Thomas

Re: Authority check on Tcode

Former Member — Wed, 23 Apr 2008 13:58:45 GMT

Please can you be more specific, how the do the authority check on Ztable (restrict the user to maintain the data).

Re: Authority check on Tcode

Former Member — Wed, 23 Apr 2008 14:11:40 GMT

hi this is done through the authorisation group in the z table i think..

go to se11--~~>utilities~~->table maintainace generator~~>aurtorisation group~~--> aurtorisation object..

regards,

venkat

Re: Authority check on Tcode

ThomasZloch — Wed, 23 Apr 2008 19:42:50 GMT

You assign an authorization group to a table as Venkat and I described above.

Then only users who have authorization object S_TABU_DIS with that authorization group and the respective activity (display and/or change) in their roles/profiles can access the table.

Does this clarify?

Greetings

Thomas