Authorization Object Error

[Former Member]

Hi All,

I added an object M_MATE_WRK in the master role and generated the profile for derived role as well.

The necessary derived roles have the object now.

When user runs a custom t-code which needs this object the su53 still shows that access for M_MATE_WRK is missing.

I ran a trace to see which object is actually missing and even the trace showz the same object.

Can any one please help me understand why this object is not reflecting in user profile.

Regards,

Yasmin

[Colleen]

Have you checked su56 of the user to see they have the value in their profile? If not run pfud for the roles you updated.

[Former Member]

Perform the user master comparison(Tcode PFUD) on the specified roles and then ask the user to check,

Regards,

Laxman

[Former Member]

check the missing authorization values are same.

Asad

[Former Member]

Hi Yasmin kazi,

1. Check whether user reached 312 profiles in USR04 table. if yes then remove some unwanted role to fix this issue.

2. Check the Role validity period for that user in which the missing authorization object is available 

3,Run System trace to find out what exact authorization object is missing. whether it has been assigned to user. and check that role authorization tab color yellow or green.

Regards

Kiran.S

[Former Member]

Hi Kiran

I have more than 1000 profiles assigned against my id but there is no authorization object error. Is it that important? If Yes why?

Regards

Saurabh

[Former Member]

Hi Saurabh,

As per SAP standards, user won’t get more than 312 profiles directly. May be your user id should have reference id. We can provide more than 312 profiles to a reference user.

Regards,

Anusha

[Former Member]

Hi Anusha

That i know, but I myself having more than 1000 profiles assigned w/o any reference user.

Regards

Saurabh

[Colleen]

Why do you have so many?

It depends on what has been loaded into your user buffer

[Former Member]

That is not possible, unless you modified the system and then it does not work when transporting and the table syncs which are needed for compatibility.

Based on your other question today about transport problems I safely assume that you modified the check on the limit (thinking that UST04 will play along) but you actually created a big mess in the USR* tables.

You must show this thread to your manager or customer, and ask them to then open a support message on SMP. SAP will bill it as consulting and not support to fix the problem if you modified the check in SU01.

ps: if a role design needs more than 312 profiles then there is a concept problem. Actually if there are more than 10 then there is a consolidation opportunity to build rob roles. You cannot manage 1000 roles per user, so you found what you were looking for....

[Former Member]

Hi Saurabh,

Could please let me know from where your are checking the number of profile assigned to your user id ?  From Table USR04 ?

Regards

Kiran.S

[Former Member]

Hi Kiran

It is now resolved. Table was UST04 not USR04.

Regards

Saurabh