Question Re: Cross-application Authorization PFCG in Technology Q&A

Cross-application Authorization PFCG

Former Member — Fri, 26 Feb 2021 07:27:16 GMT

My company has created the "Z role" for allowing users to post back period and link with Authorization group used for maintaining at OB52.

I want to know when I create the Authorization role if I inactivate "Transaction Code Check at Transaction Start" (below Cross-application Authorization Objects) which assign only FB01 right now what does it mean?

pls help

Thank you

Re: Cross-application Authorization PFCG

KatiNonhebel — Fri, 26 Feb 2021 07:28:57 GMT

Thank you for visiting SAP Community to get answers to your questions.

The more details you provide, the more likely it is that members will be able to respond.
I recommend that you familiarize yourself with our Q&A Tutorial: https://developers.sap.com/tutorials/community-qa.html, as it provides tips for preparing questions that draw responses from our members.
Should you wish, you can revise your question by selecting Actions, then Edit.By adding a picture to your profile you encourage readers to respond:https://www.youtube.com/watch?v=46bt1juWUUM

Many thanks!
Keep in mind, when you receive an answer that was helpful to you, accept it as best answer.

Good Luck

Kati - SAP Community Moderator

Re: Cross-application Authorization PFCG

alessandr0 — Mon, 08 Mar 2021 16:29:19 GMT

Hi Keshi,

this is a very basic question of how SAP Security works. ADM945 would be the appropriate training for that. The start authorization for transactions is S_TCODE (along with TSTCA authorizations). If you deactivate S_TCODE (that contains FB01), the user cannot run FB01 any longer. Start authorizations are checked when entering a transaction. If you don't have the start authorizations, you will get the error message "You are not authorized for transaction FB01".

Regards, Alessandro