Maintaining Authorization object thru ABAP code

[Former Member]

Hi All

We want to write a function to maintain Authorization object Activity and field value for an object.

we have Authorization object already created with fields, we want to maintain values for these fields for a user.

The idea is to manage job roles 2nd level authorization from a custom application (non SAP). Kindly advise how can we write ABAP code to achieve this.

Best Regards

Sidra Hasan

[Former Member]

Hi Hasan

If you look in SU21 how SAP stanadar does it and copy the same in your report. SAP standard does it in subroutine   suso_db_update_crea of include LSUSAF01. It uses few of the below mentioend FM

• SUSO_SET_FIELDS_FOR_TOBJ 
• SUSR_COMMEDITCHECK

Nabheet

[former_member209818]

Hi Hasan,

There are some BAPI's which handles the Role & Profile assignments for for a User.

Instead of Assignment of Authorization directly, you can create appropriate Profiles and can make use of these profiles to assign necessary roles. BAPIs which can be used are BAPI_USER_PROFILES_ASSIGN, OR BAPI_USER_ACTGROUPS_ASSIGN.

Hope this helps

- Harshad

[nabheetscn]

Hi Hasan

If you look in SU21 how SAP stanadar does it and copy the same in your report. SAP standard does it in subroutine   suso_db_update_crea of include LSUSAF01. It uses few of the below mentioend FM

• SUSO_SET_FIELDS_FOR_TOBJ 
• SUSR_COMMEDITCHECK

Nabheet

[Former Member]

Thanks Nabheet

Can you please more elaborate your solution?

How to achieve this?

I tried using "Recording" but so far it didnt appear to be successful.

Regards

Sidra

[nabheetscn]

Hi Hasan

If you want to assign authorizatiopn objects to user then you can use BAPI_USER_CHANGE apart from the one mentioned by Harshad or you want to maintain values in SU21 for an authorization object...?

Nabheet

[Former Member]

Hi Nabheet

I want to maintain values for authorization objects in a jobrole.

JobRole is already created and authorization objects are already there , i need to assign values to the field of auth objects.

[nabheetscn]

Hi Hasan

You can use the BAPI's mentioned by Harshad for doing the same

Nabheet

[Former Member]

Hi Nabheet

The problem is , I am already using BAPI_USER_ACTIVITYGRUOP_ASSIGN to assign the jobroles to the user, for each user we maintain a separate jobrole with specific values of auth object. We have to maintain the field values first in a jobrole then assign it to the user.

[nabheetscn]

Hi Hasan

For the first step you can use PRGN_1250_SAVE_AUTH_DATA. Just check function group PRGN it has lot of FM related to your need

Nabheet

[Former Member]

Many Thanks Nabheet

That should do the work but the problem is, i can not see any changes saved to the jobrole.

I used BAPI_TRANSACTION_COMMIT as well but no luck.

Do you have any idea of the parameters that are compulsory to change the jobrole?

I passed following parametrs.

Best Regards

[nabheetscn]

Hi Hasan

You have to call CALL FUNCTION 'PRGN_UPDATE_DATABASE' after this call.

Just do a simple where used list on this FM you will get the idea

Check class CL_ROLEMAN_AUTH method AUTH_DATA_SET or you can use this also

Nabheet

[Former Member]

Hi Nabheet

Up till now I am able to copy job role, assign job roles to users and maintain field values/authorization object values but I can not generate profile for the job role created thru copy function:

Here are my findings:

PRGN_COPY_AGR (to copy job role)

PRGN_1251_SAVE_FIELD_VALUES (to maintain authorization objects)

The problem I am facing is to generate profile (txn pfcg) and second when we assign a job role in SU01 and then perform User Comparison so as to activate the job role for user.

I have tried PRGN_PROFILE_GENERATOR and SUPRN_PROFILE_GENERATOR but didnt work.

Can you help me to achieve the above two tasks because without user comparison everything is just useless.

Regards

Sidra