Question Re: How to create authorization checking with Tcode in Technology Q&A

How to create authorization checking with Tcode

suityan98 — Fri, 12 Aug 2022 07:07:14 GMT

How to create authorization checking with tcode? I have tried many ways like creating transaction ZSDI_DRIVER_INFO and ZSDR_DRIVER_INFO during in tcode se80 and assigned the authorization object (F_BKPF_BUK) to the respective tcode.

But nothing change, even when testing I try to insert data not in authorization, It still allows the user to save. I am new in SAP ABAP. Hopefully can get some advice on this...

MODULE USER_COMMAND_0100 INPUT.

  CASE ok_code.
    WHEN 'CONFIRM' .
      

      IF gv_bukrs IS INITIAL
        OR gv_icno IS INITIAL
        OR gv_status IS INITIAL.

        MESSAGE 'Please fill in field required.' type 'E'.
        CALL SCREEN '0100'.

      ENDIF.
      PERFORM check_data.
    WHEN 'QUERY'.
      CALL SCREEN '0200'.
    WHEN 'UPDATE'.
      IF gv_bukrs IS INITIAL
        OR gv_icno IS INITIAL
        OR gv_status IS INITIAL.

        MESSAGE 'Please fill in field required.' type 'E'.
        CALL SCREEN '0100'.
      ENDIF.
      PERFORM check_data2.

    WHEN 'EXIT'.
      LEAVE TO SCREEN 0.
  ENDCASE.

Re: How to create authorization checking with Tcode

venkateswaran_k — Fri, 12 Aug 2022 07:12:23 GMT

Hi suityan98

Execute the t-code with the user who does not have this authorization.

If you are testing, you might have the sap_all authorization.

Re: How to create authorization checking with Tcode

venkateswaran_k — Fri, 12 Aug 2022 07:24:42 GMT

Hi suityan98

You may add the following code in the USER_COMMAND_0100 ( as per your requirement )

CALL FUNCTION 'ISHMED_READ_USER_AUTH'
    EXPORTING
      i_user        = sy-uname
      i_object      = 'F_BKPF_BUK'
    TABLES
      t_authorities = i_authorization
    EXCEPTIONS
      read_error    = 1
      OTHERS        = 2.

READ TABLE i_authorization INTO wa_authorization WITH KEY objct = 'F_BKPF_BUK' 
                                                          actvt = 'A' 
                                                          field = 'ACTVT' 
                                                          von = '*'.
  IF sy-subrc NE 0.
    MESSAGE 'You are not authorized' DISPLAY LIKE 'E'.
  ENDIF.

NoteWhile testing as mentioned above, test with user who does not have this authorization.Regards,Venkat

Re: How to create authorization checking with Tcode

suityan98 — Fri, 12 Aug 2022 07:48:01 GMT

not able to call this function, how can i know the others possible function that I can use?

Re: How to create authorization checking with Tcode

RaymondGiuseppi — Tue, 16 Aug 2022 15:51:53 GMT

From your requirement I understand that you have to code some AUTHORITY-CHECK statements in your code such as

  AUTHORITY-CHECK OBJECT 'F_BKPF_BUK'
           ID 'BUKRS' FIELD gv_bukrs
           ID 'ACTVT' FIELD '03'. " display/query
* For activity value, double-click on authorization object for list of values
* examples:
* 02  Update
* 03  Query
* 10  Confirm, etc.
  IF sy-subrc <> 0.
* Implement a suitable exception handling here
  ENDIF.

Adding the authorization object to the transaction definition will only trigger a check at start of transaction with the values you also provided to this transaction (click on 'values' from SE93 screen)