Company code authority check

[Former Member]

Hi

we have created ZTTL01 table maintenance view. Should not allow unauthorized company code to update/create or display.

I searched thru forums and collected below points. but could not test it successfully.

Authorization object (Z_XXX_BUK) was created.But <Permitted activities> Button is not available in display authorization object(SU21) to see what are the activities are permitted.

In su01 for my user no roles or profiles are defined.

To do

Trying to write below code in PBO and PAI flow logic of ZCHECK_BUK table for screen 01

PBO & PAI
*First statement
Module Authorictycheck.

module Authoritycheck
  LOOP AT EXTRACT.
    AUTHORITY-CHECK OBJECT 'ZCHECK_BUK'
                        ID 'ACTVT' FIELD '01,02,03'
                        ID 'BUKRS' FIELD ZTTL01-BUKRS.
    IF sy-subrc <> 0.
      MESSAGE e000(zrpt) WITH 'You do not have the authorization to'
    EXIT.                          'access Bukrs'extract-bukrs.
    ENDIF.
  ENDLOOP.
endmodule

Can i use above code in PBO and PAI to check change of company code?

I am sharing role and profile created by other user, which allows only company code 'A10'.

How to test this now?

se11->Utilities->table contents create should not allow me to input A11 or other company codes? pls confirm.

Regards

Chandra

[Former Member]

Hi

we have created ZTTL01 table maintenance view. Should not allow unauthorized company code to update/create or display.

I searched thru forums and collected below points. but could not test it successfully.

Authorization object (Z_XXX_BUK) was created.But <Permitted activities> Button is not available in display authorization object(SU21) to see what are the activities are permitted.

In su01 for my user no roles or profiles are defined.

To do

Trying to write below code in PBO and PAI flow logic of ZCHECK_BUK table for screen 01

PBO & PAI
*First statement
Module Authorictycheck.

module Authoritycheck
  LOOP AT EXTRACT.
    AUTHORITY-CHECK OBJECT 'ZCHECK_BUK'
                        ID 'ACTVT' FIELD '01,02,03'
                        ID 'BUKRS' FIELD ZTTL01-BUKRS.
    IF sy-subrc <> 0.
      MESSAGE e000(zrpt) WITH 'You do not have the authorization to'
    EXIT.                          'access Bukrs'extract-bukrs.
    ENDIF.
  ENDLOOP.
endmodule

Can i use above code in PBO and PAI to check change of company code?

I am sharing role and profile created by other user, which allows only company code 'A10'.

How to test this now?

se11->Utilities->table contents create should not allow me to input A11 or other company codes? pls confirm.

Regards

Chandra

[franois_henrotte]

go to transaction SE54 and input your table name

go to menu Environment / Events

activate change mode

put a new entry for event 05 (creating a new entry) and put some name for your form routine

hit enter, then an icon will appear on the button next to the name of form routine

click on this button it will allow you to create the routine in the program for view maintenance

there you put your code in order to do the authority check and refuse the record if needed

[Former Member]

Hi Franchios

Thanks for your reply.

Does the event creation is the aternatve method to check the company code authorization?

Above auhoriztaion check inside LOOP at PBO is not required in case of Event usage?

Plsconfirm

regards

Chandra

[SuhaSaha]

> Does the event creation is the aternatve method to check the company code authorization?
> Above auhoriztaion check inside LOOP at PBO is not required in case of Event usage?

If the TMG is re-generated your code will be lost, so try not to modify the PBO module in the TMG directly.

You should put your Authorization check in the Event 01 & not on Event 05. This will ensure that the check is performed whenever the data is saved to the DB.

BR,

Suhas

[Former Member]

Hi

Thanks for your reply.

My requirement is user should not view or update/create the Company code defined in Authorization code.

If i write Event05, it will be fired only when you try to save the record right? but he will be seeing all the company codes right?

I tried inserting below code at event 05, why its givnig error

AUTHORITY-CHECK OBJECT 'Z_XXXXX_BUK'

ID 'BUKRS' FIELD ZXXXX-bukrs. .

IF sy-subrc <> 0.

MESSAGE E105(ZSCM01).

ENDIF.

ERROR :

Include LZXXF01

Statement is not accessible.

pls correct me.

Regards

[Former Member]

I understand using event is benefitted rather than using PBO code change.

Above requirement can be solved using event?

I cannot see any event to hide unauthorized company codes?

ofcourse i can use event01 for before saving the record.

Does any additional code has to be done apart from above code?

Regards

[SuhaSaha]

I cannot see any event to hide unauthorized company codes?

Ofcourse there is

[Event AA: Instead of the Standard Data Read Routine|http://help.sap.com/saphelp_nw04s/helpdata/en/91/ca9f56a9d111d1a5690000e82deaaa/content.htm]

Event AA: LOOP on the table TOTAL & remove the records for which the user has no view authority.

Event 01: If the user tries to create/update/delete the record, check the authority based on the CoCd. If the user is not authorised, then issue a message, set SY-SUBRC to "non-zero" value & set VIM_ABORT_SAVING to 'X'.

Hope this helps.

BR,

Suhas

[Former Member]

Hello Suhas

Can you pls guide me little more

I included below code in include LZXXF01. but gives error.

and gives dump.

AUTHORITY-CHECK OBJECT 'Z_XXXXX_BUK'

ID 'BUKRS' FIELD ZXXXX-bukrs. "Table name is ZXXXX

IF sy-subrc 0.

MESSAGE E105(ZSCM01).

ENDIF.

ERROR :

Include LZXXF01

Statement is not accessible.

pls correct me.

[Former Member]

Hi

WHen i created Event 01. It asks for new Include name and i created new include under my view function group.

Now i wonder how to write the code inside the include. because whathever i write i cannot activate independently

I afraid if i activate all functiongroup again could give some generation problem.

I just wrote one below code to check <Ztable>-Bukrs field with authority check.

But give error....what should i do now pls advice.

Regards

[Former Member]

Hi

I am able to achieve the event 01 option and its working fine.

But EventAA, i am not able to get it.

WHich table should i have to LOOP it?

I cannot see anytable by name TOTAL....in my program.

Pls confirm.

Regards

Chandra

[Former Member]

Hi

I have two issues now.

1)I have records in ZXXX table, but when i see in SM30 the records are empty.

what could be the reason?

2)Like Suhas said, I want to loop the table and remove the corresponding records.

But which table should i loop? either table controll or Extract table?

Can you pls shed light on this.

Regards

Chandra

[SuhaSaha]

Hello Chandra,

1)I have records in ZXXX table, but when i see in SM30 the records are empty. what could be the reason?

Put the break-point in the subroutine which handles Event AA & debug. I think that may be the Auth. Check is failing & the records are being removed. Did you call the subroutine FORM TABLE_GET_DATA in your event AA, this will populate the table TOTAL.

 want to loop the table and remove the corresponding records. But which table should i loop? either table controll or Extract table?

If you're handling the Event 01, then it should be something like LOOP on TOTAL & READ EXTRACT. There's code snippet provided in the SAP documentation for Event 01 which you can refer while building your code.

BR,

Suhas

[Former Member]

Hi Suhas

Regarding 1) It works when i remove the FORM routine assinged for EVENTS.

Thanks for ur input.

Regarding 2)When the user displays record in SM30 for a table, he must not be able to see the company code AD01.

To achieve this can i use EVENT AA?

I create FORM routine <hide_cocode> in EVENT AA and store at include LZXXXXF01.

FORM ZHIDE_COCODE.

DATA: F_INDEX LIKE SY-TABIX."Index to note the lines found"

LOOP AT TOTAL.

READ TABLE EXTRACT WITH KEY <vim_xtotal_key>.

IF SY-SUBRC EQ 0.

F_INDEX = SY-TABIX.

ELSE.

CLEAR F_INDEX.

ENDIF. "(make desired changes to the line TOTAL)

MODIFY TOTAL.

CHECK F_INDEX GT 0.

EXTRACT = TOTAL.

MODIFY EXTRACT INDEX F_INDEX.

*ENDIF.

ENDLOOP.

SY-SUBRC = 0.

ENDFORM.

I made break point at line LOOP at Total. and executed SM30 and clicked Display button.

Sorry Code stops here and table TOTAL has flat line structure of empty.Loop at total is skipping

what should be done now?

Regards

Chandra

[SuhaSaha]

Hello,

You've to add the SAP defined sub-routine table_get_data to read the from the table.

FORM zhide_cocode.
  DATA: f_index LIKE sy-tabix."Index to note the lines found"

  PERFORM table_get_data. "Fetch the table data --> Add this line

  LOOP AT total.
    READ TABLE extract WITH KEY <vim_xtotal_key>.
    IF sy-subrc EQ 0.
      f_index = sy-tabix.
    ELSE.
      CLEAR f_index.
    ENDIF. "(make desired changes to the line TOTAL)
    MODIFY total.
    CHECK f_index GT 0.
    extract = total.
    MODIFY extract INDEX f_index.
*ENDIF.
  ENDLOOP.
  sy-subrc = 0.
ENDFORM.                    "ZHIDE_COCODE

Hope you're clear.

BR,

Suhas

[Former Member]

Hi Suhas

Thanks for your reply.

It works..

Regards

Chandra

[franois_henrotte]

duplicate

[franois_henrotte]

duplicate