Cannot trace the transaction code within a role

[Former Member]

Hello All,

We, in our project trying to trace out various transaction codes assigned to each of roles.

I have an issue tracing an transaction code FB60. When i searched in suim for transaction codes within the role, I could see FB60 listing in the results.

But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.

what went wrong here? Now i want to remove the transaction code from the role so that next time when i use suim it wont be listed in the results.

Kindly advice.

Regards,

Brahmeshwar Poloju

[jurjen_heeck]

> I have an issue tracing an transaction code FB60. When i searched in suim for transaction codes within the role, I could see FB60 listing in the results.

>

> But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.

>

> what went wrong here?

Actually nothing.

FB60 may well be in the field value for S_TCODE in the role's profile.

If this S_TCODE object was added menually you can take it out there. If not, you'll have to go into transatcion SU24 and go through the proposal values for all transactions which are in the role menu and see if you can find a proposal for S_TCODE containing FB60.

Edit this and afterwards go into your role again and re-read the authorization profile. It should now be gone.

[Former Member]

Follow the procedures as suggested above. In addition with it, the things were happened as the transaction was not added from menu in these roles. That's why it was not showing there..

Always add transaction from the menu. This is the standard procedures. By this way, this kind of problems can be avoided in future.

Regards,

Sandip.

[jurjen_heeck]

> Follow the procedures as suggested above.

Thank you

> Always add transaction from the menu. This is the standard procedures. By this way, this kind of problems can be avoided in future.

This isn't always true. Some transactions will bring in additional S_TCODE values when added to the menu. The content of the menu and the content of S_TCODE can differ, even when you only add transactions through the role menu.

[Former Member]

Hi,

But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.

Here the problem is that you won't get appropriate results by chking throught Pfcg-->Menu tab.

Always go by Suim >Role>Authorization object -->S_Tcode. It wil dispaly all the Roles and tcodes Exits in that.

Now i want to remove the transaction code from the role so that next time when i use suim it wont be listed in the results

.

1. Goto SUIM and select USER node, then select USERS BY COMPLEX SELECTION CRITERIA node then execute BY TRANSACTION AUTHORIZATION report then give the Tran. code and it will return you the number of users having that trans with relevatn details.

Follows these steps :-

- Go to SUIM .

- Choose Roles --> By Transaction assignment.

- Enter Transaction : "FB60"

- Choose execute.

- Double click on a role in which you want to remove "FB60" authorisation.

- Click on pen mark to change into change mode.

- Go to tab "Authorization"

- Choose change authorization data.

- Choose Utilities --> Technical names on .

- Choose > cross application authorization objects>

- Expand the selection for Object "s_tcode" , under the corresponding profile look the values maintained for "TCD" and remove value "FB60" from the list to eliminate the authorization.

- Don't forget to regenerate profiles.

Thanks

Ramakrishna.

[jurjen_heeck]

> - Expand the selection for Object "s_tcode" , under the corresponding profile look the values maintained for "TCD" and remove value "FB60" from the list to eliminate the authorization.

And what should he do if this object is read-only (standard)?

[Former Member]

Hi All,

Thanks for your help.

I could have very well deleted the unwanted tcode directly from S_TCODE, if it had existed there. I could see the tcode(FB60) neither in menu tab nor in S_TCODE. Somehow the suim results is listing FB60 for my role.

But what i observed was the profile of the roles is having few of the auth objects listed under this tcode. I checked su24 and the objects with proposal YES are present in the profile.

Is problem because of this? How should i proceed now?

Regards,

Brahmeshwar Poloju.

[jurjen_heeck]

I suggest you go to table AGR_1251 (tr SE16), select your role and the object S_TCODE and post the results here so we can have a look at its contents.

[Former Member]

HERE IS THE OUTPUT.

OBJECT AUTH VARIANT FIELD LOW HIGH

S_TCODE T-DC84003900 TCD SCPE*

S_TCODE T-DC84003900 TCD SDD1* SE03

S_TCODE T-DC84003900 TCD SE07 SE16N

S_TCODE T-DC84003900 TCD SE17 SECQ*

S_TCODE T-DC84003900 TCD SEEF* SI24_12

S_TCODE T-DC84003900 TCD SI2414 SIBU

S_TCODE T-DC84003900 TCD SIC_* SLAT

S_TCODE T-DC84003900 TCD SLG0 SLIB_*

S_TCODE T-DC84003900 TCD SLIN SLXT

S_TCODE T-DC84003900 TCD SM30

S_TCODE T-DC84003900 TCD SM31 SM37

S_TCODE T-DC84003900 TCD SM50

S_TCODE T-DC84003900 TCD SM51

S_TCODE T-DC84003900 TCD SMAR* SMEZ

S_TCODE T-DC84003900 TCD SMTH* SNLS

S_TCODE T-DC84003900 TCD SNRO SO99

S_TCODE T-DC84003900 TCD SOACARRY* SOTR*

S_TCODE T-DC84003900 TCD SP02

S_TCODE T-DC84003900 TCD SCUS* SDCA*

S_TCODE T-DC84003900 TCD /* DA_*

S_TCODE T-DC84003900 TCD DC* PFCF*

S_TCODE T-DC84003900 TCD PFD* RYZ*

S_TCODE T-DC84003900 TCD RZZ* SAIM*

S_TCODE T-DC84003900 TCD SAIO* SAK*

S_TCODE T-DC84003900 TCD SAM* SAPTE*

S_TCODE T-DC84003900 TCD SARJZ* SARTN*

S_TCODE T-DC84003900 TCD SASAPCATT SBEA

S_TCODE T-DC84003900 TCD SBI* SC2_*

S_TCODE T-DC84003900 TCD SCA* SCBZ*

S_TCODE T-DC84003900 TCD SCDO SCI*

S_TCODE T-DC84003900 TCD SCTS* SCU3

S_TCODE T-DC84003900 TCD SWF_TR* SYNT

S_TCODE T-DC84003900 TCD SZG* TRBS

S_TCODE T-DC84003900 TCD TRCM* UR_M*

S_TCODE T-DC84003900 TCD USRM* _Z*

S_TCODE T-DC84003900 TCD SWF_CN* SWF_RE

S_TCODE T-DC84003900 TCD SPEC* SPERS*

S_TCODE T-DC84003900 TCD SPP* SPROJE

S_TCODE T-DC84003900 TCD SQ00 SRT*

S_TCODE T-DC84003900 TCD SSC SSDZ*

S_TCODE T-DC84003900 TCD SST0 ST05*

S_TCODE T-DC84003900 TCD ST14 ST62

S_TCODE T-DC84003900 TCD STCU STKZ*

S_TCODE T-DC84003900 TCD SV* SWF_BA

S_TCODE T-DC84003900 TCD SURAD SURVEY

S_TCODE T-DC84003900 TCD SU50 SU52

S_TCODE T-DC84003900 TCD SU3

S_TCODE T-DC84003900 TCD SU2

S_TCODE T-DC84003900 TCD SU0

S_TCODE T-DC84003900 TCD STS* STYLE*

Regards

[Former Member]

OBJECT AUTH VARIANT FIELD LOW HIGH MODIFIED

S_TCODE T-DC84003900 TCD SCPE* U

S_TCODE T-DC84003900 TCD SDD1* SE03 U

S_TCODE T-DC84003900 TCD SE07 SE16N U

S_TCODE T-DC84003900 TCD SE17 SECQ* U

S_TCODE T-DC84003900 TCD SEEF* SI24_12 U

S_TCODE T-DC84003900 TCD SI2414 SIBU U

S_TCODE T-DC84003900 TCD SIC_* SLAT U

S_TCODE T-DC84003900 TCD SLG0 SLIB_* U

S_TCODE T-DC84003900 TCD SLIN SLXT U

S_TCODE T-DC84003900 TCD SM30 U

S_TCODE T-DC84003900 TCD SM31 SM37 U

S_TCODE T-DC84003900 TCD SM50 U

S_TCODE T-DC84003900 TCD SM51 U

S_TCODE T-DC84003900 TCD SMAR* SMEZ U

S_TCODE T-DC84003900 TCD SMTH* SNLS U

S_TCODE T-DC84003900 TCD SNRO SO99 U

S_TCODE T-DC84003900 TCD SOACARRY* SOTR* U

S_TCODE T-DC84003900 TCD SP02 U

S_TCODE T-DC84003900 TCD SCUS* SDCA* U

S_TCODE T-DC84003900 TCD /* DA_* U

S_TCODE T-DC84003900 TCD DC* PFCF* U

S_TCODE T-DC84003900 TCD PFD* RYZ* U

S_TCODE T-DC84003900 TCD RZZ* SAIM* U

S_TCODE T-DC84003900 TCD SAIO* SAK* U

S_TCODE T-DC84003900 TCD SAM* SAPTE* U

S_TCODE T-DC84003900 TCD SARJZ* SARTN* U

S_TCODE T-DC84003900 TCD SASAPCATT SBEA U

S_TCODE T-DC84003900 TCD SBI* SC2_* U

S_TCODE T-DC84003900 TCD SCA* SCBZ* U

S_TCODE T-DC84003900 TCD SCDO SCI* U

S_TCODE T-DC84003900 TCD SCTS* SCU3 U

S_TCODE T-DC84003900 TCD SWF_TR* SYNT U

S_TCODE T-DC84003900 TCD SZG* TRBS U

S_TCODE T-DC84003900 TCD TRCM* UR_M* U

S_TCODE T-DC84003900 TCD USRM* _Z* U

S_TCODE T-DC84003900 TCD SWF_CN* SWF_RE* U

S_TCODE T-DC84003900 TCD SPEC* SPERS* U

S_TCODE T-DC84003900 TCD SPP* SPROJECT U

S_TCODE T-DC84003900 TCD SQ00 SRT* U

S_TCODE T-DC84003900 TCD SSC SSDZ* U

S_TCODE T-DC84003900 TCD SST0 ST05* U

S_TCODE T-DC84003900 TCD ST14 ST62 U

S_TCODE T-DC84003900 TCD STCU STKZ* U

S_TCODE T-DC84003900 TCD SV* SWF_BAM* U

S_TCODE T-DC84003900 TCD SURAD SURVEY* U

S_TCODE T-DC84003900 TCD SU50 SU52 U

S_TCODE T-DC84003900 TCD SU3 U

S_TCODE T-DC84003900 TCD SU2 U

S_TCODE T-DC84003900 TCD SU0 U

S_TCODE T-DC84003900 TCD STS* STYLE* U

[jurjen_heeck]

This is the range you need to modify:

> S_TCODE T-DC84003900 TCD DC* PFCF* U

FB60 lies within the range DC* - PFCF* so you'll have to split it into two lines to exclude FB60:

S_TCODE T-DC84003900 TCD DC* FB59 U

S_TCODE T-DC84003900 TCD FB61 PFCF* U

Having said that, roles with S_TCODE ranges like this one are usually the result of bad design and implementation. The huge, and probabely growing, number of ranges proves that this role needs a lot of effort to keep it working......

This one will keep haunting you.

[Former Member]

>

> 
> Having said that, roles with S_TCODE ranges like this one are usually the result of bad design and implementation. The huge, and probabely growing, number of ranges proves that this role needs a lot of effort to keep it working......
> 
> This one will keep haunting you.

Agreed, removal of FB60 will do little compared to what that role can likely do (or contribute towards).

[Former Member]

Thanks Heeck for your analysis

[jurjen_heeck]

> Thanks Heeck for your analysis

That's my last name, but you're welcome

Jurjen