Authority check

[Former Member]

hi guys,

need your help. I'm working on a module pool where there are two pushbuttons - SAVE and commit.

The client wants that a certain group of users should have access to SAVE date and a certain group should have access to both i.e. SAVE and COMMIT data. I just cannot understand how to do this or what alternative to suggest the client.

Can you'll please help me out. Its very urgent. please reply as early as possible..

Points will be awarded generously for useful answers.

[Former Member]

hi guys,

need your help. I'm working on a module pool where there are two pushbuttons - SAVE and commit.

The client wants that a certain group of users should have access to SAVE date and a certain group should have access to both i.e. SAVE and COMMIT data. I just cannot understand how to do this or what alternative to suggest the client.

Can you'll please help me out. Its very urgent. please reply as early as possible..

Points will be awarded generously for useful answers.

[Former Member]

HI,

the best way is to use authority-check only.

follow the link for authority check

http://help.sap.com/saphelp_nw04/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm

rgds,

bharat.

[RaymondGiuseppi]

You should create an authorization object and check it via AUTHORITY-CHECK in your PBO to exclude unauthorized function code from the status.

<a href="http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCCCMUSR/BCCCMUSR.pdf">Users and Roles (BC-CCM-USR)</a>

Regards

[JozsefSzikszai]

hi p347633,

you have to create a Z... auth object and assign it for the users, let's say the ones who only can save give them value 1, the others (who can do both), value 2.

Now you check the this authority object in your program. If a user has this object with value 2, than you allow him both pushbuttons, if a user has only value 1, than you remove the COMMIT pushbutton.

hope this helps

ec

[Former Member]

Hi eric,

thanks for the answer buddy.

One more question - how to create the Authority object? Can u give me the steps???????

Please its quite urgent.

Thanks

[RaymondGiuseppi]

Assigning an Authorization Object to an Object Class Locate the document in its SAP Library structure

Each authorization object must be assigned to an object class when it is created.

Choose Tools ® ABAP Workbench ® Development ® Other tools ® Authorization objects ® Objects. You can also create authorization objects in the Object Navigator (SE80).

Creating / Choosing Object Classes

The system displays a list of existing object classes.

Object classes are organized according to the components of the system.

Before you can create a new object, you must define the object class for the component in which you are working. The objects are not overwritten when you install new releases.

You can also define your own object classes. If you do so, select class names that begin with Y or Z to avoid conflicts with SAP names.

Creating an Object

Enter a unique object name and the fields that belong to the object. Object names must begin with the letter Y or Z in accordance with the naming convention for customer-specific objects.

You can enter up to ten authorization fields in an object definition. You must also enter a description of the object and create documentation for it.

Ensure that the object definition matches the AUTHORITY-CHECK calls that refer to the object.

Regards

[JozsefSzikszai]

hi p347633,

to create an auth object: start SE80 and click on Edit Object. On the More tabs select Auth... object (about in the middle of the list), add a name (Z...) and click on Create (beow).

that's it

ec

[Former Member]

Hi Eric,

But where to specify the activity??? Please be a bit elaborate.

[RaymondGiuseppi]

There is documentation available here in SDN : <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c">Authorization Objects – A Simple Guide</a>

Regards

[former_member189629]

Hi,

The SAP authorization concept protects transactions, programs, and services in SAP systems from unauthorized access. On the basis of the authorization concept, the administrator assigns authorizations to the users that determine which actions a user can execute in the SAP System, after he or she has logged on to the system and authenticated himself or herself.

To access business objects or execute SAP transactions, a user requires corresponding authorizations, as business objects or transactions are protected by authorization objects. The authorizations represent instances of generic authorization objects and are defined depending on the activity and responsibilities of the employee. The authorizations are combined in an authorization profile that is associated with a role. The user administrators then assign the corresponding roles using the user master record, so that the user can use the appropriate transactions for his or her tasks.

Chk these linx

http://help.sap.com/saphelp_nw2004s/helpdata/en/52/671285439b11d1896f0000e8322d00/content.htm

http://help.sap.com/saphelp_bw21c/helpdata/en/52/6712ac439b11d1896f0000e8322d00/frameset.htm

http://sap.ittoolbox.com/groups/technical-functional/sap-r3-basis/please-how-to-create-an-authorizat...

Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.

If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.

This means you have to allocate an authorization object in the definition of the transaction.

For example:

program an AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT <authorization object>

ID <authority field 1> FIELD <field value 1>.

ID <authority field 2> FIELD <field value 2>.

...

ID <authority-field n> FIELD <field value n>.

The OBJECT parameter specifies the authorization object.

The ID parameter specifies an authorization field (in the authorization object).

The FIELD parameter specifies a value for the authorization field.

The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.

Use T/Code SE80 to Create Authorization object.

You can assign Authorization object to a transaction.

Use T/code SE93 and --> Create Ztransation --> Add your authorization object in "Authorization object" field.

Who ever want to execute this transaction must have the authorizations as you have mentioned in ur authorization object.

Authorization groups are created in SE54.

authorization object are assigned to dataelements

wheres are authoriz groups are assigned to tables

Reward if helpful,

Karthik

[Former Member]

In the PBO check for authority using AUTHORITY-CHECK OBJECT <authorisation object> statement. Now according to the sy-subrc value, do a loop at screen and disable or enable the button accordingly. Hope this helped.

[Former Member]

In the PBO , check the authority for the user using AUTHORITY-CHECK OBJECT 'OBJECT_NAME' and acc to that exclude the addn btn's by using PF-STATUS EXCLUDE.

[Former Member]

The ABAP side is easy enough but what are the business rules that determine which group of users get to do which? Technically, for "group A" you could either disable one of the buttons during PBO, or validate against it in PAI... then it's just the case of determining which group the current user falls into...

Typically an "authority-check" is the way to go, but you could (for example) have 2 different Tcodes pointing to the same module pool, e.g. ZX_ALL and ZX_SOME, and test sy-tcode when determining which buttons are allowed... then some users would be given ZX_ALL and the others just ZX_SOME.

Jonathan

[vallamuthu_madheswaran2]

Hi,

i think, the certain group of users have client number & user name.

try the following.

<b>in pbo</b>

if sy-mandt = '070' and sy-uname = 'name'.

give err message 'ur not autorized'.

endif.

Thanks & Regards

Message was edited by:

vallamuthu madheswaran

[Former Member]

Hi,

Create a Authorization object with activity 01,02,03,06, stop the users by action taken and values....display all the icons to the users.....

If the hint is useful… Say thanks by reward….

Regards,

Prabhu Rajesh