S_TCODE vs menu transactions search issue

[Former Member]

Hello experts,

I am currently trying to remove a transaction from a composite role.

Since it is a composite role, it should usually have a single role in it that has the transaction, from which I should be able to remove the transaction.

Unfortunately it is not in the menu tab of any single role in that composite role.

I have also done a suim S_TCODE search, but no single roles showed up that where in that composite role.

How else would I find where the transaction is coming from so I can remove it?

Transaction I am trying to remove is SM30.

Thank you,

Ashod

[Former Member]

Hello experts,

I am currently trying to remove a transaction from a composite role.

Since it is a composite role, it should usually have a single role in it that has the transaction, from which I should be able to remove the transaction.

Unfortunately it is not in the menu tab of any single role in that composite role.

I have also done a suim S_TCODE search, but no single roles showed up that where in that composite role.

How else would I find where the transaction is coming from so I can remove it?

Transaction I am trying to remove is SM30.

Thank you,

Ashod

[Former Member]

Using SUIM find out the roles having tcode SM30 at first.

1. SUIM--> Roles--> By transaction assignment. Then put SM30 and execute. You will get the roles having SM30.

2. Now go to tcode PFCG, enter that role name and click on change button. Go to authorizations tab. Click on change button. Press ctrl+F and look for authorization object S_TCODE. then you will get the sm30 assigned under s_tcode. Remove sm30 and save+generate the profile again.

Please try like this and let me know for further help.

Thanks

Asad

[Former Member]

hello ashod,

Once you establish the roles which has SM30, try to use the table AGR_AGRS and find out if the role belongs to the composite role you are trying to delete SM30 from.

if that is so, then you got your solution.....

Let us know once you proceed with this step.

Regards

deepak m

[perpetuum_mobile]

When did do a search? After recent role changes in Prod? The user could be assigned the old profiles and still have the old authorization although the role and newly generated profile do not contain this transaction. Try to run PFUD on the roles or wait until the next execution. (When we are talking about composite role changes on the contained single roles this is also required)

AGR_1251 lists the configuration of the role. I would take every role of the user, derive the dedicated single roles and list every S_TCODE object in it. This filter should be sufficient if you have doubt with SUIM. (however SUIM should work)

[sri_g4]

• Get All the single roles that are part of this composite role from which you are trying to remove the transaction SM30 - Table AGR_AGRS

• Goto table AGR_1251 & copy all the single roles there in the roles fields & S_TCODE in the object field, & SM30 in the value1 field - Execute, this will give the single role that has SM30

• You can remove the transaction using PFCG

[Former Member]

What is the value1 field?

[sri_g4]

The first of the 2 value fields or 'Value - LOW'

[niteshgupta87]

Hi Ashod,

As you mentioned none of the single roles has SM30 in its menu, there are 2 possibilities:

1. SM30 is manually added to one of the single role. or,

2. In one of the single roles, there is a tcode which is bringing S_TCODE = SM30 as its authorization data (maintained in SU24).

For 1st case, you can do a search in table AGR_1251 with object = S_TCODE and Value (Low) = SM30, or in SUIM -> Role -> By Authorization Value -> Object = S_TCODE and Value = SM30.

For 2nd case, go to table USOBT_C and search by Object = S_TCODE and Low (Value) = SM30. This will tell you what all tcodes have SM30 (in S_TCODE) maintained as Check and Proposal = Yes in SU24. Now you can easily find which of your single roles contain this tcode.

If 2nd case if relevant for you, then you would need to analyze and update SU24 for that culprit tcode or find any other solution (like creating a separate role for that tcode, etc.).

Let me know if this helps.

Regards,

Nitesh Gupta