topic Re: Authority Check in Application Development and Automation Discussions

Authority Check

Former Member — Wed, 23 Jul 2008 12:00:30 GMT

new plant / do the authority check / save result in buffer table

AUTHORITY-CHECK OBJECT 'M_MSEG_WMB'

ID 'ACTVT' FIELD actvt03

ID 'WERKS' FIELD L_F_WERKS.

what does this code mean and how we implement authority check.

Re: Authority Check

peter_ruiz2 — Wed, 23 Jul 2008 12:05:33 GMT

hi Ankesh,

this code checks if the user has the needed authorizations for object 'M_MSEG_WMB'.

regards,

Peter

Re: Authority Check

Former Member — Wed, 23 Jul 2008 12:05:56 GMT

This code is used to check authorization for plant.

Check following links for info......

http://members.tripod.com/sap_abap/authorit.htm

http://www.sapdb.info/authority-check-abap-keyword-a-day/

Edited by: Nil on Jul 23, 2008 5:40 PM

Re: Authority Check

Former Member — Wed, 23 Jul 2008 12:07:00 GMT

hi check this simple example with syntax..

...

AUTHORITY-CHECK OBJECT auth_obj [FOR USER user]

ID id1 {FIELD val1}|DUMMY

[ID id2 {FIELD val2}|DUMMY]

[ID id10 {FIELD val10}|DUMMY].

AUTHORITY-CHECK OBJECT 'S_CARRID'

ID 'CARRID' FIELD carr

ID 'ACTVT' FIELD '03'.

Re: Authority Check

Former Member — Wed, 23 Jul 2008 12:08:12 GMT

Hi,

this is for Company code. if the user doesnt have the authorization for the specified company code then the SUBRC after the AUTHORITY-CHECK OBJECT 'V_AKKP_ART' will be 4.

FORM AUTHORITY_CHECK .

DATA : LT_VIAUFKS TYPE TI_VIAUFKS1.

FIELD-SYMBOLS : <FL_VIAUFKS> TYPE TY_VIAUFKS1.

SELECT BUKRS FROM T001

INTO TABLE LT_VIAUFKS

WHERE BUKRS IN S_BUKRS.

IF SY-SUBRC NE 0.

ENDIF.

IF SY-SUBRC = 0.

LOOP AT LT_VIAUFKS ASSIGNING <FL_VIAUFKS>.

AUTHORITY-CHECK OBJECT 'V_AKKP_ART'

ID 'AKKTP' DUMMY

ID 'AKKRT' DUMMY

ID 'BUKRS' FIELD <FL_VIAUFKS>-BUKRS

ID 'ACTVT' FIELD '03'.

IF SY-SUBRC <> 0.

MESSAGE E999 WITH TEXT-026 <FL_VIAUFKS>-BUKRS.

ENDIF.

ENDLOOP.

ELSE.

MESSAGE E999 WITH TEXT-015 TEXT-024.

ENDIF.

Regards,

Rajasekhar Reddy.

Re: Authority Check

Former Member — Wed, 23 Jul 2008 12:09:53 GMT

Hi,

check this code,

AUTHORITY-CHECK

Basic form

AUTHORITY-CHECK OBJECT object

ID name1 FIELD f1

ID name2 FIELD f2

u2026

ID name10 FIELD f10.

Effect

Explanation of IDs:

object Field which contains the name of the object for which the authorization is to be checked.

name1 u2026 Fields which contain the names of the name10 authorization fields defined in the object.

f1 u2026 Fields which contain the values for which the f10 authorization is to be checked.

AUTHORITY-CHECK checks for one object whether the user has an authorization that contains all values of f (see SAP authorization concept).

You must specify all authorizations for an object and a also a value for each ID (or DUMMY ).

The system checks the values for the ID s by AND-ing them together, i.e. all values must be part of an authorization assigned to the user.

If a user has several authorizations for an object, the values are OR-ed together. This means that if the CHECK finds all the specified values in one authorization, the user can proceed. Only if none of the authorizations for a user contains all the required values is the user rejected.

If the return code SY-SUBRC = 0, the user has the required authorization and may continue.

The return code is modified to suit the different error scenarios. The return code values have the following meaning:

4 User has no authorization in the SAP System for such an action. If necessary, change the user master record.

8 Too many parameters (fields, values). Maximum allowed is 10.

12 Specified object not maintained in the user master record.

16 No profile entered in the user master record.

24 The field names of the check call do not match those of an authorization. Either the authorization or the call is incorrect.

28 Incorrect structure for user master record.

32 Incorrect structure for user master record.

36 Incorrect structure for user master record.

If the return code value is 8 or possibly 24, inform the person responsible for the program. If the return code value is 4, 12, 15 or 24, consult your system administrator if you think you should have the relevant authorization. In the case of errors 28 to 36, contact SAP, since authorizations have probably been destroyed.

Individual authorizations are assigned to users in their respective user profiles, i.e. they are grouped together in profiles which are stored in the user master record.

Note

Instead of ID name FIELD f , you can also write ID name DUMMY . This means that no check is performed for the field concerned.

The check can only be performed on CHAR fields. All other field types result in u2018unauthorizedu2019.

Example

Check whether the user is authorized for a particular plant. In this case, the following authorization object applies:

Table OBJ : Definition of authorization object

M_EINF_WRK

ACTVT

WERKS

Here, M_EINF_WRK is the object name, whilst ACTVT and WERKS are authorization fields. For example, a user with the authorizations

M_EINF_WRK_BERECH1

ACTVT 01-03

WERKS 0001-0003 .

can display and change plants within the Purchasing and Materials Management areas.

Such a user would thus pass the checks

AUTHORITY-CHECK OBJECT u2018M_EINF_WRKu2019

ID u2018WERKSu2019 FIELD u20180002u2032

ID u2018ACTVTu2019 FIELD u201802u2032.

AUTHORITY-CHECK OBJECT u2018M_EINF_WRKu2019

ID u2018WERKSu2019 DUMMY

ID u2018ACTVTu2019 FIELD u201801u2032:

but would fail the check

AUTHORITY-CHECK OBJECT u2018M_EINF_WRKu2019

ID u2018WERKSu2019 FIELD u20180005u2032

ID u2018ACTVTu2019 FIELD u201804u2032.

To suppress unnecessary authorization checks or to carry out checks before the user has entered all the values, use DUMMY - as in this example. You can confirm the authorization later with another AUTHORITY-CHECK .