Change user id at runtime

[Former Member]

Hi experts,

I have a report that needs to be run in background. I need to change the user who runs this report at runtime with some ABAP code as per the requirement. I was wondering if any of you have encountered this before. pls. advise

thanks in advance..

Liz

[Former Member]

Hi experts,

I have a report that needs to be run in background. I need to change the user who runs this report at runtime with some ABAP code as per the requirement. I was wondering if any of you have encountered this before. pls. advise

thanks in advance..

Liz

[Former Member]

Generally, this sounds like a bad idea. A user with limited authorizations could run the report and have greater access than allowed.

But I think I have seen this sort of question before. If you search the forum, you will likely turn something up.

Rob

[Former Member]

Hi,

There is an authorisation object S_BTCH_NAM which is checked if you try to run a background job as another user, so there is some control around this.

But it's worth searching for this, it's a fairly common scenario.

Regards,

Nick

[Former Member]

Hello Rob and Nick,

Thanks for your replies. We realise the security issues connected with this approach.

All,

I came across a potential way to do this - You could create a background job within your program and submit this job under another user id. THis would be the only way.

I am not sure how to achieve the above. Can someone please advise.

Thanks & Regards,

Liz

[RichHeilman]

Try this.

DATA:   l_valid type c,
        ls_params LIKE pri_params,
        i_user TYPE sy-uname,
        l_jobcount LIKE tbtcjob-jobcount,
        l_jobname  LIKE tbtcjob-jobname.

* Get Print Parameters
  CALL FUNCTION 'GET_PRINT_PARAMETERS'
    EXPORTING
      no_dialog      = 'X'
    IMPORTING
      valid          = l_valid
      out_parameters = ls_params.

* Open Job
  l_jobname = 'ZTHIS_JOB'.
  CALL FUNCTION 'JOB_OPEN'
    EXPORTING
      jobname  = l_jobname
    IMPORTING
      jobcount = l_jobcount.

* Submit report to job

  i_user = 'THISUSER'.  "<- supply other user here.

  SUBMIT zsubmitted_program
       VIA JOB     l_jobname
           NUMBER  l_jobcount
           USER    i_user
       TO SAP-SPOOL WITHOUT SPOOL DYNPRO
           SPOOL PARAMETERS ls_params
              AND RETURN.

* Schedule and close job.
  CALL FUNCTION 'JOB_CLOSE'
    EXPORTING
      jobcount  = l_jobcount
      jobname   = l_jobname
      strtimmed = 'X'.

Regards,

RIch Heilman

[Former Member]

Hi Rich,

Thanks for your help. I have another question here. I am going to run a standard report in the background and specify the user as per the code specified by you.

My doubt is that I need to pass some values to the selection screen of the report I am going to run in background. I can pass this in as a variant and give it while defining my batch job. However my issue is that the values to be passed to the report will only be known at runtime. Thus I am not sure how to proceed. Is there a method to specify the values to passed to this report at runtime while we run it in backgnd ?

Please advise.

Thanks for your replies in advance, Liz

Edited by: Liz.... on Mar 22, 2010 7:55 PM

[RichHeilman]

Yes, you can use a selection table. Something like this.

.....

DATA: lt_par_tab TYPE TABLE OF rsparams,
      ls_par_tab LIKE LINE OF lt_par_tab.

* Add two values to s select option
CLEAR ls_par_tab.
ls_par_tab-selname = 'S_MATNR'.  "<--- Name of select-option in screen
ls_par_tab-kind    = 'S'.
ls_par_tab-sign    = 'I'.
ls_par_tab-option  = 'EQ'.
ls_par_tab-low     = 'A_VALUE'.
APPEND ls_par_tab TO lt_par_tab.

CLEAR ls_par_tab.
ls_par_tab-selname = 'S_MATNR'.  "<--- Name of select-option in screen
ls_par_tab-kind    = 'S'.
ls_par_tab-sign    = 'I'.
ls_par_tab-option  = 'EQ'.
ls_par_tab-low     = 'B_VALUE'.
APPEND ls_par_tab TO lt_par_tab.

* Add a value to a parameter
CLEAR ls_par_tab.
ls_par_tab-selname = 'P_WERKS'.  "<--- Name of parameter in screen
ls_par_tab-kind    = 'P'.
ls_par_tab-sign    = 'I'.
ls_par_tab-option  = 'EQ'.
ls_par_tab-low     = 'C_VALUE'.
APPEND ls_par_tab TO lt_par_tab.

SUBMIT zsubmitted_program
     VIA JOB     l_jobname
         NUMBER  l_jobcount
         USER    i_user
     WITH SELECTION-TABLE lt_par_tab   "<-- Pass the selection table here.
     TO SAP-SPOOL WITHOUT SPOOL DYNPRO
         SPOOL PARAMETERS ls_params
            AND RETURN.

....

Regards,

Rich Heilman

[Former Member]

Hi Rich,

I think I am very close to getting my issue resolved all thanks to you. I have refered your above post to do my coding. My issue is that when I execute the report -> zsubmitted_program directly I get the desired result. When I execute it with the code you have mentioned (via job and giving the user id and selection screen parameters) the report -zsubmitted_program doesnt get called at all for some reason. I also tried SM36 ->Creating a job with this report as step and assigning user and a variant. Still the zsubmitted_program doesnt get executed. Any suggestions ? Appreciate your help! Best Regards, Liz

Here is the code -

// DATA declararations //

// selection screen parameters

• Add a value to a parameter

CLEAR ls_par_tab.

ls_par_tab-selname = 'COUNTER'. "<--- Name of parameter in screen

ls_par_tab-kind = 'P'.

ls_par_tab-sign = 'I'.

ls_par_tab-option = 'EQ'.

ls_par_tab-low = 'this value'.

APPEND ls_par_tab TO lt_par_tab.

• Get Print Parameters

CALL FUNCTION 'GET_PRINT_PARAMETERS'

EXPORTING

no_dialog = 'X'

IMPORTING

valid = l_valid

out_parameters = ls_params.

l_jobname = 'ZTest'.

CALL FUNCTION 'JOB_OPEN'

EXPORTING

jobname = l_jobname

IMPORTING

jobcount = l_jobcount

EXCEPTIONS

cant_create_job = 1

invalid_job_data = 2

jobname_missing = 3

OTHERS = 4.

IF sy-subrc NE 0.

WRITE: SY-SUBRC.

ENDIF.

IF SY-SUBRC = 0.

• Submit report to job

i_user = 'this user'.

SUBMIT zsubmitted_program

VIA JOB l_jobname

NUMBER l_jobcount

USER i_user

WITH SELECTION-TABLE lt_par_tab "<-- Pass the selection table here.

TO SAP-SPOOL WITHOUT SPOOL DYNPRO

SPOOL PARAMETERS ls_params

AND RETURN.

• Schedule and close job.

CALL FUNCTION 'JOB_CLOSE'

EXPORTING

jobcount = l_jobcount

jobname = l_jobname

strtimmed = 'X'

EXCEPTIONS

cant_start_immediate = 1

invalid_startdate = 2

jobname_missing = 3

job_close_failed = 4

job_nosteps = 5

job_notex = 6

lock_failed = 7

OTHERS = 8.

IF sy-subrc <> 0.

WRITE: SY-SUBRC.

ENDIF.

ENDIF.

[RichHeilman]

Well, for one thing, I think the user must be a valid user in the system. "this_user" is probably not a valid user.

l_user = 'this user'.

Fill l_user with a valid user name,.

Regards,

Rich Heilman

[Former Member]

Hi Rich,

I gave 'this user' as an example only. I am populating it with a valid user in my program. I am un-sure whats going wrong where. When I set up a job in SM36 with this report as a step or when I submit this report as a job in another program, the report does not get called/executed.

Pls. advise.

Thanks & Regards, Liz

[Former Member]

You need to decide what you want to achieve here...

If the report is scheduled in the step of the job already, just specifiy the user name in the jobstep definition (subject to your authorizations for the object mentioned by Nick - at the time of scheduling the job). Then release the job. No further coding required nor foreign users in the program itself.

If there are authorization-checks in the program itself and you want these to be performed against a different user ID than the person executing the report or the user ID in the job step, then you should heed Rob's comment, as it is not reliable. For example, the user might not be logged on for some time and not have any authorizations loaded into the user buffer.

But it can be done:

AUTHORITY-CHECK OBJECT 'F_BKPF_BUK' FOR USER 'that user'
          ID 'ACTVT' FIELD '02'
          etc...

        IF sy-subrc NE 0.

But you must be very carefull with this, as the ability of the caller to influence where 'that user' value is coming from is NOT a good idea!

It will also deprive you of the ability to regularly reset the user buffer.

Additionally, you also cannot do this for all authorization objects (e.g. S_PROGRAM at the start of your report) and some checks are within the ABAP statements themselves, so they are always against sy-uname and not FOR USER.

Very delicate and even questionable use-case.

Cheers,

Julius

[Former Member]

Hello,

My issue is solved. As pointed out, it was a user authorization issue. Thank you so much for all your help!

Best Regards, Liz

[Former Member]

Hi,

Using the SUBMIT method VIA JOB, how do I programatically get the results of the execution (which SAP tables)? Not just the job log, but the messages from the ZSUBMITTED_PROGRAM. For example, if this program is reporting processing status (S, E, W, A)?

Thanks,

Huntr