All Authorisation Objects used in a Transaction

[Former Member]

Hello mates,

when i take a look at the Transaction SU24, i see a list of Transactions and "all" Authorisation Objects related to them if they would be maintained by the developer.

But not all Authorisation objects are maintained there.

Now i want to write a Report, which is able to find all Authorisation Objects related to a Transaction, so i can easily compare with the entries in the SU24. It would be a huge effort to search for all the Authority Checks in a bunch of coding and assign them to a Transaction in SU24 manually.

I tried searching for the string 'AUTHORITY-CHECK' via rs_abap_source_scan, but i only get the object+ line reference in which the Authority check takes place, not the Transaction.

Can you tell me a how i can do this.

Thank you in advance

Emre

[Former Member]

Hello mates,

when i take a look at the Transaction SU24, i see a list of Transactions and "all" Authorisation Objects related to them if they would be maintained by the developer.

But not all Authorisation objects are maintained there.

Now i want to write a Report, which is able to find all Authorisation Objects related to a Transaction, so i can easily compare with the entries in the SU24. It would be a huge effort to search for all the Authority Checks in a bunch of coding and assign them to a Transaction in SU24 manually.

I tried searching for the string 'AUTHORITY-CHECK' via rs_abap_source_scan, but i only get the object+ line reference in which the Authority check takes place, not the Transaction.

Can you tell me a how i can do this.

Thank you in advance

Emre

[Former Member]

Hi Emre,

Have you tried looking at the USOBT and USOBX tables?

The USOBT table lists the auth objects which are associated with the Tcode (name field) while the USOBX lists the object which are maintained and have auth checks happen. The ones marked Y in OKFLAG have default auth check happen while ones with X are maintained through su24 for auth check

Hope this helps you get your report going,

Geoffery

[RaymondGiuseppi]

USOB* tables are the tables maintained by SU24.

But I fear the OP wants the actual whole list of authority check a transaction can call. This is hardly realist as any dynamic call has to be "manually" analyzed those dynamic call can be generated by some Customizing, original conception of transaction, even some BAdI/Enhancement, etc.

Regards,

Raymond

[bbalci]

Hi Emre,

In a transaction , with CALL FUNCTION statements different functions ( so different main programs )

can be used.

it means a transaction is not related to only one program and called functions can change by the time,

and also functions / objects can be used dynamically ,

so u can not directly find all authorization objects belong to a program / transaction.

I recommend you to use transaction ST01 to trace used authority objects by that transaction.

With this method,

u can't have a program directly giving you all authorization objects u need

and u have to run every transaction u need once,

but anyway it can be helpful,

Regards,
Bulent

[Former Member]

Hello,

Thank you guys for the answers. I see, that my Intention is hard to realize in combination with transactions. To bad.

If i can't find a way to do this, i will only search within programs or packages to compile a list of every Authority Check used in them, so i get an overview. Am i right, that i can use  the program RS_ABAP_SOURCE_SCAN for this issue?

Regards,

Emre

[bbalci]

Hi Emre,

Yes I used program RS_ABAP_SOURCE_SCAN  many times as background job for different requirements,   it can give u an idea.

have a nice day.

[nabheetscn]

We have in fact faced this issue during upgrade, where new authority checks were implemented as part of upgrade. Introduction of new authority check statements actually create disaster and end user will not have the authorization. RS_ABAP_SOURCE_SCAN was used to at least compare what all new statements have been introduced.

Identifying which tcodes they will impact is something which is till open I believe a tool here will be of awesome help to determine which tcode does this change impacts!

Thanks

Nabheet

[matt]

Perhaps rephrased this question could be asked (and answered) in Security.

[nabheetscn]

Thanks for the advice as always..Posted the question.

http://scn.sap.com/thread/3855169