Walter,
In adding to Michael's comments, please let us know which tcode(s) you're utilizing this auth object with. Our company uses ICWeb which can be a bear to troubleshoot ICWeb auth failures. If you're also using ICWeb, creating a trace (ST01) for all auth object checks, RFC calls, and HTTP calls will help (i.e. log one user from time of login to auth failure). If there's no auth failure when the user attempts the task, look at the trace data at the time of login (when their user master buffer is loaded).
To help dissect trace data in CRM, I've found reviewing the UI_COMP components in table CRMC_UI_COMP_IP (Inbound Plug Definition), to be invaluable to understanding trace failures and components within a security role that allows this access. I've also found that by adding a menu button (for example Contract Management), allows change access even though all security auth objects are set to display only (i.e. there might be a RFC or program being called, or configuration that's allowing change access).
Any who, hopefully this info helps.
Cheers,
Greg
Bluesky
