Field level authorization...

[Former Member]

Hello Gurus,

I am working on field level authorization.

I have created a authorization field in SU20 tranaction. The field name is ZDEPRT, Data element is ZDPT and table ZTABLE.

Also created authorization object for this field in SU21.

This authorization Object is assigned to a role whwre I maintain the fields for data element ZDPT for which user can view the data. This role is assigned to a user.

Now, in a custom report data is selected from ZTABLE and displayed. It displays data for all the values of field even if I resticted that field with only ceratin values.

The database select was indeed done on the one which was used while creating SU20 entry.

Can someone throw some light ?

Regards,

Rajesh.

[mvoros]

Hi,

you can define authorization fields in the transaction SU20 and then use these fields in the authorization objects in the transaction SU21. The check table in SU20 has the following meaning (SAP documentation)

If desired, enter a check table for the possible entries. For more information about check tables, see  Connection to the Check Table. The connection provides possible field values. Values ranges can also be defined using the domain with which a field is associated.

It means that you restrict values accepted by authorization object. It does not mean that you restrict displaying of values in the check table.

So if you want to restrict your query, you need to loop over the table and check for each line if the user has authorization for that value.

Cheers