Not able to restrict users from using SU01

[Former Member]

Hi ALL,

We are working on roles related to SECURITY ADMINISTRATOR.

The role has been given a transaction SU01D and not SU01.

But the users are able to enter into SU01 through SUIM.

I will illustrate this situation more:

SUIM->USERS->BY LOGON DATE AND PASSWORD CHANGE

Then I entered the user id.Executed.

From the result, I was able to enter into su01 .i.e was able to use the change button of su01.

Please tell me how do I restrict this situation.?

Reagrds,

Ajit.

[Former Member]

Hi ALL,

We are working on roles related to SECURITY ADMINISTRATOR.

The role has been given a transaction SU01D and not SU01.

But the users are able to enter into SU01 through SUIM.

I will illustrate this situation more:

SUIM->USERS->BY LOGON DATE AND PASSWORD CHANGE

Then I entered the user id.Executed.

From the result, I was able to enter into su01 .i.e was able to use the change button of su01.

Please tell me how do I restrict this situation.?

Reagrds,

Ajit.

[Former Member]

Access to user administration is not only limited to SU01.

Most likely, the threads of this search term will explain why the users can access the transaction screens of user administration: https://forums.sdn.sap.com/search.jspa?objID=f208&dateRange=all&numResults=15&rankBy=10001&threadID=...

Whether the user can complete the transaction is a different story... for that you need to use the application authorization objects (S_USER* objects are a good start - see transaction SU21 for more infos on the application security concept for these objects)

Cheers,

Julius

PS: A troublesom object is S_USER_GRP, because it is important. When the user ID does not have a user group assigned, then the effectivness of this authorization object is weak, which can impact your security (depending on the access of the user without an authorization group)...

[Former Member]

Hi Ajit,

SU01 has an explicit authority check statement for 'SU01'

CALL FUNCTION 'AUTHORITY_CHECK_TCODE'

TCODE = 'SU01'

The user needs to have access to SU01 to enter it. Unless this check is suppressed in SE97. Did you trace to check if S_TCODE is being checked?

Thank you

Abhishek

[Former Member]

HI Abhisheck,

My interpretation of the question is, as stated: Not able to restrict users from using SU01.

Using a transaction (and completing it) is distinctly different to starting any user management related functionality, as there are many entry points... I don't think that I know them all

SU01 has some special features specific to SU01, but user management security in SAP for me has a focus on "can the transaction be completed, almost regardless of the context (sy-fields, and S_TCODE)?"

Cheers,

Julius

[Former Member]

Hi Julius,

I am with you. Reaching it, and completing it are 2 different things.

Was just curious how the authority check got suppressed. So many entry points..... maybe I though this could just be another new one

Anyway, have a great weekend ahead 😛

Thank you

Abhishek

[Former Member]

Hi,

Based on the description, the user is in transaction SU01_NAV, not SU01.

Cheers,

Julius