Authorization Objects : Preference * vs ' ' ?

[Former Member]

Dear all,

I have a question regarding order preference.

For instance:

- We create 2 roles role A and B

- Role A has assigned * (global authorization) to the field of the authorization object called X

- Role B has assigned ' ' (global denied) to the field of the same authorization object called X

- Role A and B assigned to user "SAP_TEST"

If the user SAP_TEST is doing an accion that needs the autorization object X, so, wich value has preference, * or ' '? In that case, the SAP system will deny all (' ') or accept all (*) ?

Looking forward to your reply.

Many thanks in advance!

Best regards,

AP

[Former Member]

Take a guess?

Tip: try test it before you use the 50:50 or audience joker .. 😉

Cheers,

Julius

[Former Member]

I'm trying to find an example for this case without success.

It was a theoretical question more than practical, if ' ' has preference than * .

Could you please help me?

Many thanks in advance.

Cheers

[jurjen_heeck]

Best let go of the term 'preference'. An authorization check will succeed if a role/profile with sufficient authorizations is found in the user master record.

[Former Member]

Agree

System will take the Union of all assigned roles.