Authorization for generic object services - GOS - payroll data

[Former Member]

Is there anyway to restrict what people see via GOS? I can't see any authorisations behind it except S_OC_ROLE. Seem users can view payroll details of a workflow agent in the workflow logs(view with technical details). Its a wild shot that an end user will find this information in the container tab but it look like a massive security flaw.

I will be interested to know if others have the same problem and how they resolved it.

Thanks

[Former Member]

anyone else come across this problem?

[Bernhard_SAP]

Hello Savo,

please have a look at SAP note 491271.

b.rgds, Bernhard

[Former Member]

This issue relates to authorisations. Depending on infotypes available to the user, they will be able to view data relating to the info type.

I will now have to review all authorisations to ensure there is no unauthorised access.