Run a program with another user privileges

[hagit]

Hello experts,

User A does not have privileges to write to a directory in order to avoid manually creating/deleting files. But doing it via a program it is ok.

I have a program (zprg1), which executes external command by Function Module sxpg_command_execute. The command copies files to the directory. I want that user A, who does not have privileges to write to this directory, will run zprg1 as another user (B), who has the needed privileges. In this way user A will be able to copy the files. I created program (zprg2), which calls zprg1 as another user.

REPORT zprg2.

submit zprg1 user 'B' AND RETURN.

In that way user A succeed to run zprg1 even though he does not have privilege to run zprg1. But when zprg1 executes sxpg_command_execute, it fails on a permission error. (even though user B has permission). Also in the debug (of zprg1) I notice that sy-ucomm is A (not as I expected B).

How can A run zprg1 as user B?

Please do not suggest to run zprg1 in a job. I want user A to run a transaction and to receive its messages (not via SM37)

Thanks

Hagit

[hagit]

Hello experts,

User A does not have privileges to write to a directory in order to avoid manually creating/deleting files. But doing it via a program it is ok.

I have a program (zprg1), which executes external command by Function Module sxpg_command_execute. The command copies files to the directory. I want that user A, who does not have privileges to write to this directory, will run zprg1 as another user (B), who has the needed privileges. In this way user A will be able to copy the files. I created program (zprg2), which calls zprg1 as another user.

REPORT zprg2.

submit zprg1 user 'B' AND RETURN.

In that way user A succeed to run zprg1 even though he does not have privilege to run zprg1. But when zprg1 executes sxpg_command_execute, it fails on a permission error. (even though user B has permission). Also in the debug (of zprg1) I notice that sy-ucomm is A (not as I expected B).

How can A run zprg1 as user B?

Please do not suggest to run zprg1 in a job. I want user A to run a transaction and to receive its messages (not via SM37)

Thanks

Hagit

[FredericGirod]

This is a security issu you will used.

Create a job for doing the job, and you could indicate the username that will do the job.

This way of working is not really serious. Better is to play with FILE transaction and the new secure part of this transaction.

[matt]

Create an RFC enabled function module to do the file access. Create a destination in SM59 which logs in via a service user with the desired privileges.

Call the RFC FM syncrhonously from your program with the SM59 destination.

[hagit]

matthew.billingham , Thank you for your great answer. I will try to implement it and update.

[hagit]

matthew.billingham , I implemented your answer ant it works perfectlly. Thank you

[hagit]

Frederic Girod ,

What do you mean by 'Better is to play with FILE transaction and the new secure part of this transaction.' ?

Thanks

[hagit]

The program has to be run, after other processes are done, by another people. So, we cannot know when to schedule the job in advance. Therefor the program has to be run manually by the user. Even if program zprg2 creates a job for program zprg1 it is a problem because in that way the user will not be able to see messages from zprg1 (only in sm37)

Thanks

[Sandra_Rossi]

Are you talking about SAP user (SU01), or user at Operating System level?

If you execute a command at OS level, it runs under the same OS user (Unix/Linux for instance), which is common to all SAP users (usually <sid>adm).

For executing an OS command (SXPG), if SAP user A is not authorized and SAP user B is authorized, it means that there's an issue with authorization object S_LOG_COM.