Authorization in MIRO

[Former Member]

Hi,

An user has a problem in MIRO when she selects Withholding Tax option, an error ocurred The message number is ZZ 506, and the message text said: The center profit is different from business partner.

When the user executes SU53, it shows a request to M_RECH_WRK object, but it requests a profit center RS24, but it value doesn´t correspond to the user. The user has the object with the correct values.

The invoice which is working doesn´t correspond to the value RS24.

Other user works with the same invoice in the MIRO and he works fine and he can execute the invoice verification.

I compared both users and apparently both have the same authorization.

I executed a st01 trace to the user, but I didn´t get anydata.

Anyone knows regarding this problem?

Thanks

Fabi

[Former Member]

> An user has a problem in MIRO when she selects Withholding Tax option, an error ocurred The message number is ZZ 506, and the message text said: The center profit is different from business partner.

That sounds like a custom message, so there perhaps is custom code in a customer exit raising this message.

A validation that the profit center does not match the business partner would not appear in SU53, unless authority was checked to permit authorized exceptions.

Another possibility is that developers sometimes use custom tables to define who is authorized for what and who not... (bad idea!)... so if this user is new then perhaps they have not been added to the table....

Cheers,

Julius

[Former Member]

Is there an table where I can check the custom message?

I tried with the transaction SE91, but I don´t have authorization for that?

What do you advice me?

I must check with an abaper or MM-FI Consultant?

Thanks in advance.

Fabiola

[Former Member]

Either use table T100, or even better would be to select the message via the "Other Object..." menu option in transactions SE80, SE38, SE93, etc etc etc....

Note that the message might be a generic one... so the message text would be in the coding.

> I must check with an abaper or MM-FI Consultant?

Either or both. The MM-FI functional person should at the very least know about this, if it is infact the explanation for the message...

If you have access to transaction CMOD, you could also explore there to find the activated exits.

Let us know what you find..

Cheers,

Julius

[Former Member]

Julius,

I checked in the T100 table, and I found the following:

Table : T100

Displayed fields: 4 of 4 Fixed columns: 3 List width 0250

SPRSL ARBGB MSGNR TEXT

P ZZ 506 Pos & tem centro & que não coincide com a divisão &, favor corrigir.

S ZZ 506 Pos & tiene centro & que no coincide con la división &, favor de corregir

So, such as you mentioned before, this is a custom message.

Next, I checked in the SE93 transaction, I put MIRO, and select other object, in class message put ZZ, and I found the 506 message.

Message

506

Message short text

Pos & tiene centro & que no coincide con la división &, favor de corregir

So, I selected the message line, and clicked the Where-used list, and appeared a ZXM08U34

program, I selected the program and showed me the ABAP line:

184 MESSAGE e506(zz) WITH p_drseg-ebelp p_drseg-werks i_rbkpv-gsber.

I selected the line mentioned above, and I could see the program, if you read spanish, you could check that the country requested a validation between business area and the profit center.

So, Could I assume that the error is not a authorization error?

I wait your comments regarding that.

Thanks.

************************************************************************

• Validación a solicitud Venezuela, valida que el centro del pedido *

• coincida con la división de la verificación de facturas en la transa-*

• cción MIRO. *

************************************************************************

SELECT land1p INTO tuname FROM ztcxp001 WHERE usname = sy-uname

AND tcodep = 'V'.

ENDSELECT.

IF sy-subrc <> 0 OR tuname <> 'XXX'.

IMPORT msgee FROM MEMORY ID 'MsgeeX'.

IF msgee = '506' AND sy-ucomm <> 'BU' AND sy-ucomm <> 'YES'.

msgee = '000'.

EXPORT msgee TO MEMORY ID 'MsgeeX'.

ELSE.

SELECT SINGLE land1p INTO pais

FROM ztcxp001 WHERE land1p = pais AND

usname = 'CTRO-DIV' AND

tcodep = 'MIRO'.

IF sy-subrc = 0.

band = 1.

LOOP AT ti_drseg INTO p_drseg.

IF sy-msgid = 'ZZ' AND sy-msgno = '506' AND sy-ucomm <> 'BU'

AND sy-ucomm <> 'YES'.

band = 1.

ELSEIF i_rbkpv-gsber <> ''.

SELECT werks

FROM zmmit044

INTO zwerks

WHERE gsber EQ i_rbkpv-gsber AND

werks EQ p_drseg-werks.

ENDSELECT.

IF sy-subrc <> 0.

band = 0.

EXIT.

ENDIF.

ENDIF.

ENDLOOP.

IF band = 0.

msgee = 506.

EXPORT msgee TO MEMORY ID 'MsgeeX'.

MESSAGE e506(zz) WITH p_drseg-ebelp p_drseg-werks i_rbkpv-gsber.

ENDIF.

ENDIF.

ENDIF.

ENDIF.

[Former Member]

> SELECT land1p INTO tuname FROM ztcxp001 WHERE usname = sy-uname

> AND tcodep = 'V'.

>

>

> ENDSELECT.

> IF sy-subrc <> 0 OR tuname <> 'XXX'.

> IMPORT msgee FROM MEMORY ID 'MsgeeX'.

Yip.... That looks like a validation user exit (possibly not intended for MIRO at all) raising an error message which has nothing to do with the authority (role authorizations) of the user...

...unless your user ID is 'XXX'....

For an immediate solution, contact your functional consultant / developer and ask them to correct the settings in this table "ztcxp001" so that the user can work - if that is what the exit intended...

In the long run, try to avoid using exits in this way. It is not transparent to the authorizations team, and security folks will normally have a problem with it as well... as you have experienced.

If an auditor found that, they might hardcode 'XXX' and 'CTRO-DIV' into an audit report...

Hope that helps,

Julius

[Former Member]

Hi Julius,

The problem was resolved, the user was added to the table, and she could post invoice.

Thank you for your great helpful.

Best Regards...

Fabiola.