Authorization Object for specific screen in ABAP

[virendra_singhsomwanshi]

Hello Everybody

Greetings

I am new with authorization object. I know what are the steps to create it and use it. Currently i m working in a project in which there is a z transaction in which there are different option like Create, Change, 1st level approval and 2nd level approval. I want to give authorization of 'create and change' to one user and approval(1st and 2nd) to two different user. how can I achieve it?. what should be the approach?

Quick response will be highly appreciated.

Thanks and Regards

Virendra Singh Somwanshi

[virendra_singhsomwanshi]

Hello Virendra,

• Cooperate with your basis consultant and assign your authorization objects to roles and users through PFCG transaction.
• Use ABAP statement AUTORITY-CHECK in your program.

       Ex.

            AUTHORITY-CHECK OBJECT 'Zxxxxx'

         ID 'VKBUR' DUMMY

         ID 'SPART' FIELD WA_FINAL-SPART

         ID 'ACTVT' FIELD '03'.

         IF SY-SUBRC NE 0.

         MESSAGE 'NO AUTHORIZATION ' TYPE 'S'.

          ENDIF.

•      In your case the authority checking code should be  written  after button clicking event (Create/Change or Approval).

Regards,

Philip.

[Former Member]

This message was moderated.

[virendra_singhsomwanshi]

Thank for your quick response. Already checked this document. How should i use this document in my case?. In my case as soon as user double clicks on any botton(Create, change, Approval's) then there should be a check whether user is authorized or not?

Regards

Virendra Singh Somwanshi

[nabheetscn]

Hi Virendra

Just for your understanding if each user is assigned with corresponding authorization object. Then in the PAI of your screen for various create/change/approval stuff you can implement authority check object mentioning the same object and activity value to check if use has authorization or not. Based on it you can display the messages

Nabheet

[sivaganesh_krishnan]

hi virendra,

first create a tcode for your screen and search for "authorizing a tcode in sap" you will find many solutions for authorization object.

Let me give a link :

Hope this helps

Sivaganesh

[virendra_singhsomwanshi]

Thanks for the reply. My requirement is not based on tcode. In my case as soon as user double clicks on any botton(Create, change, Approval's) then there should be a check whether user is authorized or not?

[nabheetscn]

You will need to code it in PAI

[philipdavy]

Hello Virendra,

• Cooperate with your basis consultant and assign your authorization objects to roles and users through PFCG transaction.
• Use ABAP statement AUTORITY-CHECK in your program.

       Ex.

            AUTHORITY-CHECK OBJECT 'Zxxxxx'

         ID 'VKBUR' DUMMY

         ID 'SPART' FIELD WA_FINAL-SPART

         ID 'ACTVT' FIELD '03'.

         IF SY-SUBRC NE 0.

         MESSAGE 'NO AUTHORIZATION ' TYPE 'S'.

          ENDIF.

•      In your case the authority checking code should be  written  after button clicking event (Create/Change or Approval).

Regards,

Philip.

[virendra_singhsomwanshi]

For understanding and clarification : In my case i have to create 3 authorization object?.

1st for create and change which i need to assign to 'SD' user.

2nd 1st level approval: this i will assign to 'Logistics' and 'CFO' user

and 3rd 2nd level approval : this i ll assign to 'CFO'  user.  Correct me If my understanding is wrong. or this can be achieve by one authorization object also.

[nabheetscn]

You can create one auhtoization object no need to create three.

Create a data element with domain. Maintain individual value in domains as

01--> Create/Change

02--> First level

03--> Seconld level.

No need to create 3.

Nabheet

[philipdavy]

Hello Virendra,

Pay close attention to the Authority check statement syntax.

AUTHORITY-CHECK OBJECT auth_obj [FOR USER user]

                        ID id1 {FIELD val1}|DUMMY

                       [ID id2 {FIELD val2}|DUMMY]

                        ...

                       [ID id10 {FIELD val10}|DUMMY].

The above statement checks whether an authorization exists for the user master record of current user or the user specified. (user in this case) If FOR USER is mentioned the user is checked whose username is mentioned in user.

NB: If no FOR USER specified the current user name is checked.

Regards,

Philip.

[former_member187748]

Hi Virendra,

take help from Basis team,

and write your code as shown below, they will set activity create = 1, display = 2, change = 3.

and in PAI write your code as below, in place of SY-TCODE = VA01, you have to write your Z txn code

for which you wants authorization, recently i did it.

Your basis team will also create object, that is to bo put in place of 'ZPALNT'.

This will surely solve your issue.

IF SY-TCODE = 'VA01' .

     AUTHORITY-CHECK OBJECT 'Z_PLANT'

                                  ID 'ACTVT' FIELD '01'

                                id 'ACTVT' field '02'

                                id 'ACTVT' field '03'

                                  ID 'WERKS' FIELD VBAP-WERKS.

     IF SY-SUBRC EQ 0.

     ELSE.

MESSAGE 'YOU ARE NOT AUTHORISED FOR .......' TYPE 'E'.

*           ENDIF.

     ENDIF.

   ENDIF.

[virendra_singhsomwanshi]

Thanks everybody for your help, authorization object created. Closing this thread.