Authorization Check

[Former Member]

What is Authorization check? Is there any standard program for Authorization Check. Plz tell me as I am in urgent need.

[Former Member]

Hi,

refer

https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/9000821b-666a-2910-499a-aaffde14...

Hope this solves your purpose.

Award points if it helps.

-Gaurang

[Former Member]

Hi

In general different users will be given different authorizations based on their role in the orgn.

We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.

USe SUIM and SU21 T codes for this.

Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.

If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.

This means you have to allocate an authorization object in the definition of the transaction.

For example:

program an AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT <authorization object>

ID <authority field 1> FIELD <field value 1>.

ID <authority field 2> FIELD <field value 2>.

...

ID <authority-field n> FIELD <field value n>.

The OBJECT parameter specifies the authorization object.

The ID parameter specifies an authorization field (in the authorization object).

The FIELD parameter specifies a value for the authorization field.

The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.

http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm

To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.

Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.

You program the authorization check using the ABAP statement AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'

ID 'ACTVT' FIELD '02'

ID 'CUSTTYPE' FIELD 'B'.

IF SY-SUBRC <> 0.

MESSAGE E...

ENDIF.

'S_TRVL_BKS' is a auth. object

ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.

The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.

This Authorization concept is somewhat linked with BASIS people.

As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.

Take the help of the basis Guy and create and use.

Reward points if useful

Regards

Anji

[Former Member]

Hi,

To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.

The following actions are subject to authorization checks that are performed before the start of a program or table maintenance and which the SAP applications cannot avoid:

• Starting SAP transactions (authorization object S_TCODE)

• Starting reports (authorization object S_PROGRAM)

• Calling RFC function modules (authorization object S_RFC)

• Table maintenance with generic tools (S_TABU_DIS)

Checking at Program Level with AUTHORITY-CHECK

Applications use the ABAP statement AUTHORITY-CHECK, which is inserted in the source code of the program, to check whether users have the appropriate authorization and whether these authorizations are suitably defined; that is, whether the user administrator has assigned the values required for the fields by the programmer. In this way, you can also protect transactions that are called indirectly by other programs.

AUTHORITY-CHECK searches profiles specified in the user master record to see whether the user has authorization for the authorization object specified in the AUTHORITY-CHECK. If one of the authorizations found matches the required values, the check is successful.

You program the authorization check using the ABAP statement AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'

ID 'ACTVT' FIELD '02'

ID 'CUSTTYPE' FIELD 'B'.

IF SY-SUBRC <> 0.

MESSAGE E...

ENDIF.

The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.

rgds

Deepak

[Former Member]

Hai,

To do this, the programmer should create authorization fields (ACTVT and CUSTTYPE) and assign for each field defined the value to be checked (02, B). Authorization fields are created under Tools ® ABAP Workbench ® Development ® Other tools ® Authorization objects ® Fields (transaction SU20).

Programmers should also create an authorization object (here S_TRVL_BKS) and assign the authorization object to an object class.

Authorization fields are created under Tools ® ABAP Workbench ® Development ® Other tools ® Authorization objects ® Objects (transaction SU21). Authorization objects can also be created in the Object Navigator (transaction SE80).

You program the authorization check using the ABAP statement AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'

ID 'ACTVT' FIELD '02'

ID 'CUSTTYPE' FIELD 'B'.

IF SY-SUBRC <> 0.

MESSAGE E...

ENDIF.

The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.

When this happens, the system checks the authorization profiles in the user’s master record for the appropriate authorization object (S_TRVL_BKS). If the authorization is found and it contains the correct values, the check is successful.

The system administrator has defined the following authorizations for the authorization object S_TRVL_BKS:

· S_TRVL_CUS1 with the following values:

• for customer type ( CUSTTYPE field) and

03 for activity (field: ACTVT).

Users with this authorization can display all customer bookings (activity 03 = display).

· S_TRVL_CUS2 with the following values:

B for customer type ( CUSTTYPE) and

02 for activity (ACTVT).

Users with this authorization can change all business customers (activity 02 = change).

When assigning profiles, the system administrator gave different authorizations to different users.

User Miller has been assigned a profile containing both of these authorizations (S_TRVL_CUS1 and S_TRVL_CUS2). Miller can therefore change bookings for business customers.

User Meyers on the other hand, is only authorized to display the records (S_TRVL_CUS1) and therefore cannot change bookings.

For Authorization Check Program go thru the following Link,

https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/9000821b-666a-2910-499a-aaffde14...

Regards,

Padmam.