STMS Display Role

[Former Member]

Experts,

I have a requirement to build an STMS display only role. Is it possible??

[Former Member]

Experts,

I have a requirement to build an STMS display only role. Is it possible??

[Former Member]

> Is it possible??

Yes.

[Former Member]

>

>Coming to STMS....how do we create one. When i add STMS and S_TRANSPRT ACTVT 03 the user is able to import the transports, change the transports etc.

Then you should mention this in your question and improve the question - then the answers follow in the same quality.

Please rephrase and ask the question about exactly where your doubt is after having attempted to do it.

Cheers,

JUlius

[Former Member]

Hello Julius,

I tried to create the display role, When i inactivated all the objects expect S_TCODE. The system didnt allow access STMS. When i added S_TRANSPRT object with ACTVT 03 and * for other field values the user was able to pretty much do everything. I didnt know how to restrict. Do we have any other procedure?

[Former Member]

Raghav,

If you need to restrict STMS Display access to particular usersgroup then you

can restirct users to STMS display access by Authorization object S_USER_GRP. Here you need to maintain

activity : 03 (display) & User group in user master maintenance : Particular Usergroup .Then you

can manually add this object S_USER_GRP in Authorization tab, in change authrization data .

It will help you to restrict particular group of users for STMS Display access.

Thanks

Vikas rana

[Former Member]

>

> If you need to restrict STMS Display access to particular usersgroup then you 
> can restirct users to STMS display access by Authorization object S_USER_GRP. Here you need to maintain
> activity : 03 (display) &  User group in user master maintenance : Particular Usergroup .Then you 
> can manually add this object S_USER_GRP  in Authorization tab, in change  authrization data .
> 
> It will help you to restrict particular group of users for STMS Display access.
> 

?

How many more of your rediculous answers must I delete before it becomes more efficient to simply delete your user ID from SDN and the OSS systems?

[Former Member]

Hi,

Goto PFCG>authorization tab>stms-->chk for s_transport auth object and click on activity field of that object --> change to display. There will b many options like create,delete,display.select display.

Thanks.

krishna.

[Former Member]

You need to consider that the STMS is a system and not just a little transaction.

Underneith it is an RFC system which connects the systems in the transport domain to each other, and depending on which system you are logged onto and what you are attempting to do in the STMS, these checks will not only run against your own user ID but also against the RFC connections for the TMS's own administration and the setup of the support calls to the target systems.

First of all, which task in the STMS can the user perform successfully which is not only "display"?

If it is in the Import Queue, then most likely this is faulty config of the TMS when you set it up.

Please confirm.

Cheers,

Julius

[Former Member]

Julius,

The user was able to login to the Quesu and import the transports. Do we have a procedure to change the faulty config in TMS??

[Former Member]

Verify in client 000 that the user TMSADM only has the limited profile it is delivered with --> S:A_TMSADM (or similar).

From the TMS domain controller client 000 you can also reset the user from transaction STMS via the Extra's menu.

Note that when logged onto a DEV system for example, and using the import function from the Import Queue to the QAS system for example, the user would be prompted to logon to the QAS system and have the authorization for the import there in QAS, not in the DEV system.

Also check in SM59 TMSSUP* RFC connections to that system. A user ID should not really be saved in that connection.

Cheers,

Julius

[fredrik_borlie]

The first thing that I ask my customer is WHY.

Next is WHO and then WHY again.

If they really can give me good answers for why there is need for such a function I can give a go and create such an access.

In this case it seems that this control have failed.

I do not see why there should be any need for display rights into STMS.

If someone needs possibilities to display certain transports I would have granted them access to SE03 instead. Or why not SE09/SE10?

Access to STMS should be really restricted.

Regards Fredrik

[Former Member]

> Access to STMS should be really restricted.

On the other hand, the STMS can also be started via several reports and remotely via RFC as well... Even is display mode without a very strong authentication in place.

I prefer the correct authorization to use the STMS in this case, regardless of the transaction access. If the STMS is set up correctly, then it should be fine (protected by client 000 of the domain controller, etc).

Cheers,

Julius

[Former Member]

Yes, it is possible in several ways. If you are not authorised to edit the object S_Transprt in the corresponding role, just make a search via SUIM >Roles> Roles by complex selection criteria-->in the Authorization Object 1, Object field (below)enter S_Transprt and press enter. you will be asked for Request type and activity. Restrict the activity to 03 (which is for display) and execute ,seach for the suitable roles. assign that role to the user.

[Former Member]

I think one of the crucial and important authorization object that controls the transport landscape is S_CTS_ADMI - check the availabel options for the user on this and make sure that the user does not have the authorizations for import on this object.

Coming to the discussion as a whole: I agree with what Julius and Fredrik mention

The correct way would be to set up the TMS landscape in a appropriate manner and give the right authorizations on the DEV, TEST, QA and Production systems. We have a set-up where we have two users approving the requests before they are imported into the Production server. NO ONE is authorized to access STMS and import imports, we have a batch job that runs to move the transports from the QA system to Production.

Firstly, we modified the code for STMS_QA and had a check-object. This check-object ensures that no user can do a level 1 and level 2 approval.

The user who creates the transport request can release it in the DEV, this after a pre-defined time is imported into the test environment. Once satisfied, the creator does a Level 1 approval in Production (he cannot do a level 2 for the request), the team manager then does a level 2 for the request and it is then in the buffer of the QA system.

the level 1 and level 2 approval process is managed by the check-object where we have a field for defining the task (level1 or level 2) and the code is modified appropriately.

For my understanding i see this is as quite a nice and efficient set-up.

I know explaining the set-up i have here was not necessary to what was asked in the question, the intention was to give more options to plan your set-up

Good Luck

[Former Member]

Hi Shekar,

Can you help me to point which part of the program of STMS_QA you changed/modified and added the check-object? The check-object that ensures that no user can do both a level1 and level2 approval.

Thanks and regards,

Rante

[Former Member]

Hi Florante,

the changes are made via an enhancement in the include LTMSQFI02.

the authority object has 4 fields

Task Type:

Activity:

Task Level:

Project ID:

the project Id's are created in SPRO_ADMIN and every task in the system should be related to one of the project ID's maintained

the task level, gives the option of either doing a level 1 approval or a level 2 approval.

• I am not skilled in ABAP and if you have more complex questions to ask, I might struggle

[Former Member]

Hi Shekar,

Thanks a lot for your reply.

Is the check you designed on a per transport level? Meaning, what happens if I selected multiple transports and approve.. but some of the transports I am not authorized? Is the approval being cancelled for all? Or rejects only those transports that I am not authorized?

Also, can you tell which form routine exactly it was implemented in the mentioned include?

Regards,

Rante

[Former Member]

Hi,

It should be in the form user_command_QA_Worklist

when you use STMS_QA for approving a transport request, we first would have to select if we want to approve as a request owner or as a team leader. A request owner approval would be task 1 as per the authority object and is assigned to all. The team lead approavl is a task 2 approval as per the object and this is given to specific users

[arpan_paik]

Having 03 actvity in S_TRANSPRT cannot freeze a user to do transport. Restriction to object S_CTS_ADMI is also necessary.

Pardon my sudden inclusion as I admit I did not went through all the history...

Not sure if someone already told what I write just now.

Arpan