Authorization checking in BAPI

[Former Member]

Hi,

I put in authorization checking for the 'Material group 1' field of a SD document. With this, only authorized users are allowed to change this field while other users without the authorization will not be allowed to change it. When i tested the authorization in VA02, it works fine. I was able to change it as i has been assigned with the required role/profile. On ther other hand, the other user without the role/profile was not able to change the field using VA02. I did another test using a Z program that calls 'BAPI_SALESORDER_CHANGE'. The Z program will change the 'Material group 1' field using 'BAPI_SALESORDER_CHANGE'. My initial thought was me with the required role/profile when running the Z program, will be able to change the field while the other user without the required role/profile will not be able to change it when running the Z program. However, the result shows that both users (with/without the role/profile) was also able to change the field using the Z program. Is there anyway to control the BAPI so that it works the same as in VA02? Thanks much for your advice.

[Former Member]

Hi,

In your program before calling BAPI, use function module AUTHORITY_CHECK_PROG , or use AUTHORITY_CHECK based on requirement.

Regards,

Ravi

[Former Member]

GK.

the authorization what you have set is on the screen, that wont work with BAPI.

you want restriction for the BAPI as well, then do the check by FM AUTHORITY_CHECK before the BAPI call.

[Former Member]

Hi,

It depends on where exactly you have placed the authority check.

If you have placed in any of the user exits , then yes the same code would be implemented even through BAPI.

The other option would be to place the authority check in the Z Program before making a call to the BAPI.

Thanks and Regards,

Sriranjani Chimakurthy.

[Former Member]

Hi Sriranjani,

Yes, i added the authorization checking in 'USEREXIT_FIELD_MODIFICATION' in MV45AFZZ but it won't work in BAPI call. Is there anything that i have done wrong in the below codes :- (Thanks)

WHEN 'VBAP-MVGR1'.

• Proceed further if user is changing the SO

IF sy-tcode = 'VA02'.

• Verify if the user has authorization to change 'MVGR1 - Material group 1' field

AUTHORITY-CHECK OBJECT 'Z_MVGR1'

ID 'ACTVT' FIELD '02' "Change access

ID 'ZMVGR1' DUMMY.

• If the user has authorization, open the field for editing

IF sy-subrc = 0.

screen-input = '1'.

• If the user does not have authorization, grey off the field and disallow for editing

ELSE.

screen-input = '0'.

ENDIF.

MODIFY SCREEN.

ENDIF.

[Former Member]

In your coding change

IF sy-tcode = 'VA02'.

to

IF T180-TRTYP = 'V'.

Then your coding will also work with BAPI. Try putting a break point before the If clause and execute the BAPI, you can see it yourself.

SAP will set T180-TRTYP = 'H' for create, = 'V' for change and = 'A' for display.

T180-TRTYP is a SAP recommended field to be used in user exits to know if the document is being created, changed or displayed

If sy-tcode = 'VA02' will not work with BAPI as you are actually not executing transaction VA02.

Also just disabling screen fields for input will not have affect on the BAPI call.

You would need to ensure it through separate coding

[Former Member]

GK,

just write the code before the BAPI call, that should do the trick for you.

[Former Member]

Hi Vishnu, thanks for your guidance. I tried your method but it did not work as well. I placed a break-point at the beginning of 'USEREXIT_FIELD_MODIFICATION' in MV45AFZZ. It seems like during the BAPI call, it did not enter this user exit at all.

[Former Member]

Thanks Soumyaprakash ... I think this would be the only solution ....