otherizations checks

[Former Member]

what is otherization checks?

dose the select command checks any otherizations checks?

Regards,

swathi.

[Former Member]

Hi,

User Authorization Checks

Definition

The authorization to carry out various archiving object programs is checked by the authorization object S_ARCHIVE. The Archive Development Kit (ADK) performs the check when an archive file is opened for one of the following actions:

· Write

· Delete

· Read

· Reload

Use

The following authorizations can be given per archiving object and solution, (such as mySAP Financials or mySAP Human Resources):

· Everything is allowed

Write, read, and reload archives; execute delete programs; change mode in archive management

· Change mode in archive management

Maintain notes

· Read and analyze archives and display mode in archive management

There may also be additional access authorization checks for specific application components.

When a user starts a transaction, the system performs the following checks:

· The system checks in table TSTC whether the transaction code is valid and whether the system administrator has locked the transaction.

· The system then checks whether the user has authorization to start the transaction.

The SAP system performs the authorization checks every time a user starts a transaction from the menu or by entering a command. Indirectly called transactions are not included in this authorization check. For more complex transactions, which call other transactions, there are additional authorization checks.

• The authorization object S_TCODE (transaction start) contains the field TCD (transaction code). The user must have an authorization with a value for the selected transaction code.

• If an additional authorization is entered using transaction SE93 for the transaction to be started, the user also requires the suitable defined authorization object (TSTA, table TSTCA).

If you create a transaction in transaction SE93, you can assign an additional authorization to this transaction. This is useful, if you want to be able to protect a transaction with a separate authorization. If this is not the case, you should consider using other methods to protect the transaction (such as AUTHORITY-CHECK at program level).

· The system checks whether the transaction code is assigned an authorization object. If so, a check is made that the user has authorization for this authorization object.

The check is not performed in the following cases:

You have deactivated the check of the authorization objects for the transaction (with transaction SU24) using check indicators, that is, you have removed an authorization object entered using transaction SE93. You cannot deactivate the check for objects from the SAP NetWeaver and HR areas.

This can be useful, as a large number of authorization objects are often checked when transactions are executed, since the transaction calls other work areas in the background. In order for these checks to be executed successfully, the user in question must have the appropriate authorizations. This results in some users having more authorization than they strictly need. It also leads to an increased maintenance workload. You can therefore deactivate authorization checks of this type in a targeted manner using transaction SU24.

• You have globally deactivated authorization objects for all transactions with transaction SU24 or transaction SU25.

• So that the entries that you have made with transactions SU24 and SU25 become effective, you must set the profile parameter AUTH/NO_CHECK_IN_SOME_CASES to “Y” (using transaction RZ10).

All of the above checks must be successful so that the user can start the transaction. Otherwise, the transaction is not called and the system displays an appropriate message.

Have a look at below link. It will help you for sure.

http://help.sap.com/saphelp_nw04s/helpdata/en/52/67129f439b11d1896f0000e8322d00/content.htm

or kindly check

The easiest way is brows the table USOBT for the authorization objects for a tcode.

Regards,

Priyanka.

[varma_narayana]

Hi Swathi..

Authorization Checks are used to ensure that only particular user can access particular data of a table.

Select Statement does not perform the Authorization Checks.

So we must code them in the program before using SELECT, INSERT etc..

using the statement AUTHORITY-CHECK .

<b>Reward if Helpful</b>

[Former Member]

Hi Swathi,

The authorization checks are used to limit the access of the users using the application. For example, suppose that a user is posting an Invoice, the invoice will be posted to a specific cost center.

Now in a bis organisation, there can be 100s of cost centers, and there will be more than 1 person responsible for posting to the cost centers. Now if i am responsible for cost center 'A' then i should not be able to post an invoice in cost center 'B'.

This is acheived using authorisation checks. We add in the code like:

AUTHORITY-CHECK OBJECT 'xxxxxx'

ID .......... FIELD 'yyyyy

ID ........... FIELD 'zzzzz'

ID ....... DUMMY.

The authorisation object is an area, where we can make a check.. This can be suppose 'S_TCODE' for transactions..

ID will be an assigned value to this object say we have SE11.

So, if i say

AUTHORITY-CHECK OBJECT 'S_TCODE'

ID Transaction FIELD 'SE11'.

Then the system will check whether i am authorised to execute SE11.

We can check the objects assigned to us in SUIM transaction..

Thanks and Best Regards,

Vikas Bittera.

**Points for useful answers**

[Former Member]

Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.

If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.

This means you have to allocate an authorization object in the definition of the transaction.

No select statement doesnt do that

[Former Member]

Hi Swathi...

forgot to answer other point..

By itself SELECt statement does not check the authorization..

Thanks and Best Regards,

Vikas Bittera.

**Points for useful answers**