Community
Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Read only

SU53 authorization checks

former_member206377
Active Contributor

‎2010 Feb 11 2:11 PM

0 Likes
8,924

Hi all,

I have a query regarding SU53. Suppose I have executed a prog/tcode in the system to whcih i do not have authorization, then on checking SU53 , the authorization fail will be displayed. So the next time if I execute a different program to which I do not have authorization again, will the first authority fail message not be displayed, or will still be displayed along with the new one?

In short i want to know that if there is no authorization for 2 or more different objects ,will all of them be displayed or only the latest one?

Thanks ,

Vasuki

Hi all,

I have a query regarding SU53. Suppose I have executed a prog/tcode in the system to whcih i do not have authorization, then on checking SU53 , the authorization fail will be displayed. So the next time if I execute a different program to which I do not have authorization again, will the first authority fail message not be displayed, or will still be displayed along with the new one?

In short i want to know that if there is no authorization for 2 or more different objects ,will all of them be displayed or only the latest one?

Thanks ,

Vasuki

Reply
10 REPLIES 10
Read only

vinod_vemuru2
Active Contributor

‎2010 Feb 11 2:16 PM

0 Likes
3,708

Hi,

SU53 shows only the latest authorization check.

Check with your BASIS team. They have the userwise tracker i hope to see what transactions they have executed in a given timeframe.

Thanks,

Vinod.

Read only

former_member206377
Active Contributor
In response to vinod_vemuru2

‎2010 Feb 11 2:23 PM

0 Likes
3,708

Hi Vinod,

Thanks a lot for your response.

Any table or any other way by which we can determine about the other authorization failure?

Read only

vinod_vemuru2
Active Contributor
In response to vinod_vemuru2

‎2010 Feb 11 2:40 PM

0 Likes
3,708

Hi,

Not sure if there is a direct table. Because, this trace data is stored in buffer but not in database tables. We can use unix system calls to read this data. You can check the logic used in program SAPMS01GN.

Thanks,

Vinod.

Read only

former_member206377
Active Contributor
In response to vinod_vemuru2

‎2010 Feb 12 5:11 AM

0 Likes
3,708

Hi Vinod and Nikhil,

When I execute the application, I get an authorization fail message in SU53 and i dont get the required output. But when the functional owner is testing my application, he too does'nt get the required output but he doesn't get any authorization fail message after the execution too.

Now I am wondering whether it is an issue with authorization. But if it was not, then why is this authorization message showing up? ANy thoughts about the issue?

Read only

former_member194669
Active Contributor
In response to vinod_vemuru2

‎2010 Feb 12 5:14 AM

0 Likes
3,708

you need compare yours & fun consultants auth for that object thru program RSUSR002

a®

Read only

mvoros
Active Contributor
In response to vinod_vemuru2

‎2010 Feb 12 5:29 AM

0 Likes
3,708

Hi,

there is no such a table which stores all failed authorization checks. The standard tool which is used by security consultant for authorization debugging is ST01 - System trace. You can activate a trace for authorization checks only. You can also limit a trace to particular program or user. In this case you will see all authorizations checks (positive as well as negative).

Cheers

Read only

Former Member

‎2010 Feb 11 2:32 PM

0 Likes
3,708

HI Vasuki ,

You can try with Tcode SUIM.

Here you have a facility to check the transactions executable by user

Lot of options are available here to check the authorizations in various dimentions.

Hope this will help you.

Regards,

Nikhil

Read only

Former Member

‎2010 Feb 20 7:41 PM

0 Likes
3,708

> In short i want to know that if there is no authorization for 2 or more different objects ,will all of them be displayed or only the latest one?

Only and always the last one. This also includes ANY checks in navigation after an authorization message is raised (e.g. you click a popup away...) and also ONLY the last check performed in a complex authority-check construct (screen modifications based on authorizations). Transaction SM37 is a good example of this.

But keep your hopes up... SU53N is on it's way and would be able to do that which you have described and more...:-)

Cheers,

Julius

Read only

mvoros
Active Contributor
In response to Former Member

‎2010 Feb 21 12:11 AM

0 Likes
3,708

> 

 
> But keep your hopes up... SU53N is on it's way and would be able to do that which you have described and more...:-)

Julius,

Do you know if SU53N well be part of enhancement pack 2 for Netweaver?

Thanks

Read only

Former Member
In response to Former Member

‎2010 Feb 21 12:37 AM

0 Likes
3,708

Hi Martin,

It is still in development, so I don't know when it will be available. Some folks from application areas also wanted to add their wishes (e.g. automatically finding the appropriate role for the missing authorization...). I only know that it was approved and that kernel changes are required.

For more infos see:

[Display multiple authority-checks, source code location and return & reason-codes when analyzing users|http://wiki.sdn.sap.com/wiki/pages/viewpage.action?pageId=85000831] (please add comments if you wish)

and

(this is the only known case of ponits-gaming on SDN which has led to an approved development request

Cheers,

Julius