Authorization Object and Authorization Group

[Former Member]

We have a situation where we want to restrict the Z-table access to the users using Table Maintenance Generators (TMG). The situation is that we have Z-Tables with data from every plant.We want to allow the users to directly Add/Modify/Delete the records of these tables. However what we want is that the user should be able to Add/Modify/Delete the records of his own plant only and not of other plants.

So if we have user1 belonging to plant "A" then he should be able to Add Modify Delete the records of plant "A" only and he shouldnt be able to change the records of Plant "B". How can we achieve this? I am guessing that this could be done via Authorization Objects. But how to assign the objects to a Table or a TMG? While creating a TMG it asks the option of adding an authorization group only and not Authorization object. Is there any way to assign an Authorization Group to an Authorization Object or Vice-versa?

[Former Member]

We have a situation where we want to restrict the Z-table access to the users using Table Maintenance Generators (TMG). The situation is that we have Z-Tables with data from every plant.We want to allow the users to directly Add/Modify/Delete the records of these tables. However what we want is that the user should be able to Add/Modify/Delete the records of his own plant only and not of other plants.

So if we have user1 belonging to plant "A" then he should be able to Add Modify Delete the records of plant "A" only and he shouldnt be able to change the records of Plant "B". How can we achieve this? I am guessing that this could be done via Authorization Objects. But how to assign the objects to a Table or a TMG? While creating a TMG it asks the option of adding an authorization group only and not Authorization object. Is there any way to assign an Authorization Group to an Authorization Object or Vice-versa?

[ThomasZloch]

The authorisation group of a table or view is linked to standard authorisation object S_TABU_DIS. However you can only control access for the whole table this way, not for a certain subset of rows.

Have a look at the various maintenance events of the TMG, that is where you would need to implement the program logic that checks e.g. plant level access. You would need to find or create an authorisation object for the plant level access as well, and include that in the users' roles.

Thomas

[former_member150968]

Hi Ankur,

It is very easy to achieve desired functionality. You just need to find suitable authorization object. You can find one from tcode 'SU21'. Once you get that, you can code in TMG events. There are events available which you can use to code for authority check. You can search SDN and you will find links to PDFs on how to achieve your desired functionality. If you don't find anything, reply back. I will provide you the code.

Regards,

Manish Sethia

[former_member282968]

Dear Ankur,

In the TMG screen goto system->status and copy the program.Goto SE38 and edit the program flow logic i.e, Add a new PAI module after the MODULE LISTE_BEFORE_LOOP.The new module can be added in the new include program.In this based on the user action which you can get from the SY-UCOMM you can validate placing your own code.

With regards,