Reg:BAPI_USER_GET_DETAIL

[Former Member]

Hi All,

Iam using the BAPI_USER_GET_DETAIL to get the User Details.But this BAPI uses Authorization Check Internally and it is failing for some User Id's.

We can get the User's Data from the Datbase Tables but we dont want to do that.

Please let me know how to resolve this issue.

Thanks.

Regards,

Srinivas.

[Former Member]

Hi All,

Iam using the BAPI_USER_GET_DETAIL to get the User Details.But this BAPI uses Authorization Check Internally and it is failing for some User Id's.

We can get the User's Data from the Datbase Tables but we dont want to do that.

Please let me know how to resolve this issue.

Thanks.

Regards,

Srinivas.

[uwe_schieferstein]

Hello Srinivas

The BAPI passes the following check (in function module SUSR_USER_READ_CHECKS):

* note 6773660 - Display own without authority check
  IF sy-uname ne user_name.
    PERFORM AUTH_CHECK USING OBJ_GROUP
                             USER_LOGONDATA-CLASS
                             SPACE
                             ACT_SHOW
                             RC.
    IF RC <> 0.
      PAR1 = USER_LOGONDATA-CLASS.
      CALL FUNCTION 'BALW_BAPIRETURN_GET2'
           EXPORTING
                TYPE       = 'E'
                CL         = '01'
                NUMBER     = 495
                PAR1       = PAR1
*         PAR2       = ' '
*         PAR3       = ' '
*         PAR4       = ' '
*         LOG_NO     = ' '
*         LOG_MSG_NO = ' '
           IMPORTING
                RETURN = ERRORTABLE
           EXCEPTIONS
                OTHERS     = 1.

      APPEND ERRORTABLE.
    ENDIF.
  ENDIF.

If the (RFC-)user calling the BAPI has authorizations for all <b>User groups</b> in user master maintenance then you should be able to read the data for all users.

Regards

Uwe

[Former Member]

Hi Uwe,

Iam using this BAPI in a Transaction.This transaction takes the Input as Userid and then fetches that Particular User Details.So for some users this BAPI is failing and they are not able to too see the User Details(First Name,Last Name) as the BAPI is failing.

User can login and request for other User Details.So when i request for other User Details, the BAPI is checking for Authorization and it fails.

Regards,

Srinivas.

[uwe_schieferstein]

Hello Srinivas

In this case have to use a little trick. Assuming that you read the user data on the same SAP system you call the <b>BAPI remotely</b> and not locally.

Simply define a RFC destination aiming to the client where you want to read the user data. The RFC-user used in this destination should have authorizations for all authorization groups. In you transaction you simply call

CALL FUNCTION 'BAPI_USER_GET_DETAIL'

DESTINATION <RFC destination to client>

...

Regards

Uwe

[Former Member]

Hi Uwe,

Our admin created a Userid which has all authorizations.

Please let me know how to use that Userid and get other user's information.

Regards,

Srinivas.

[uwe_schieferstein]

Hello Srinivas

Let's assume the following scenario: your transaction is executed on PRD system (client 100) and the user data should be read from this client.

Then define the RFC destination (e.g. PRDCLNT100) with the following attributes:

- Language = <can be empty = syst-langu>

- Client = '100'

- User = <the userid defined by your admin>

- Password = <must be entered>

The trick is that although you make an RFC-Call of the BAPI you stay on the local system. However, due to the RFC-call the RFC-user calls the BAPI and not the current user executing your transaction.

Regards

Uwe

[Former Member]

Hi Uwe,

Thanks a lot.

Regards,

Srinivas.

[Former Member]

Hi Srinivas,

if you are allowed to read all User you need

the object s_user_grp in your Authority. Ask your Admin.

Regards, Dieter

[Former Member]

Hi Dieter,

Our admin are not ready to give Authorization for the object S_USER_GRP for Security reasons.

Regards,

Srinivas.

[Former Member]

Hi Srinivas,

the question is who decides if you have to have

the authority your bos the cio or the admin?

Another question is, who whants to have the result

of the FM.

I think if you don't get the authority you shound't see

the special users.

A triky way is to copy the FM to an Z-FM and delete the

authority-checks. But be careful!

Regards, Dieter