su53/st01?

[Former Member]

hey,

su53 or st01 is used to find the missing authorization for the user..on wat criteria a user will face the missing authorization?the only chance is tat security guy fail to assign the particular authorization to a particular user then it results to the missing authorization.. other than this wat cld b the reason??

[Former Member]

hey,

su53 or st01 is used to find the missing authorization for the user..on wat criteria a user will face the missing authorization?the only chance is tat security guy fail to assign the particular authorization to a particular user then it results to the missing authorization.. other than this wat cld b the reason??

[Former Member]

Kamal,

I am not clear what your exact question is.

If you are using custom profiles to run a collection of programes, especially custom programs, then you users would probably experience frequent authorization failures, especially in the design and build phase. It is difficult for most users and security personnel to get it right the first time, every time. In this scenario, SU53 and ST01 are vital transactions for troubleshooting.

If you are using SAP delivered profiles with SAP transactions and programs then this would not occur frequently.

jwise

[Former Member]

Hi Kamal,

You got the scenario right in one sence... If the User is not supposed to have for instance Tcodes related to MM module and is trying to access them then obviously he would be having a missing authorization warning. And SU53 would show exactlky yhe same... but u have to note the below points...

A failure of an authorization object in SU53 screen is not exactly a failure.

1. It may be that the user is not allowed to access that object/Tcode due to SOX limitations.

2. Yes, he is eligible to use the Tcode and the incomplete assignmen of a few values inside the Roles/Profiles is restricting the user to proceed successfully.

in Case of option 2 then u can change the roles and move the correction to help the user attain the required funtionality.

In case of 1 pl;ease note to the user that he is not allowed to access that Tcode etc.

Hope it is clear.

reg ST01, its used to check if the users trace shows any objects where the authorization fails...

Br,

Sri

Award points for helpful answers

[Former Member]

Hello,

There are 2 scenerios in which the authorization can fail .

1 . As pointed by you the user has the access to the transaction but the necessary object is missing due to which the user can not proceed with the process . In this case the Security person needs to check the SU53 and assign the missing object

2. The 2nd scenario is when a user is not allowed use a particular transaction. For example not everyone would be given a access to Creation of Sales Orders (VA01) .

Regards,

Sowmya.

[Former Member]

hi kamal,

1)when users execute a transaction or report that is not included in their user menu , they may see the system message similar to: you have no authorization for transaction ... this message means that either their current authorization profile does not contain the required authorization to execute the transaction or the values maintained for the profile aothorization are insufficient , the missing authorizations can be determined either by tracing authorizations with transaction su53 or with system trace st01.

2) if you are using structural authorizations , su53 is not very useful if the transaction where you are receving messages : you have no authorization for ... is an HR transaction or a transaction that calls HR objects . su53 only reveals the last authorization check failure based on the abap code statement authorization check , however structural authorizatiions do not always use authorization-check statement in determining access , therefore if extensive structural authorizations are used , the system trace st01 will be more useful than su53.

if you find this information useful award me suitable points .

regard's

nvramana

[Former Member]

I think something has been missed above. ST01/SU53 are useful for troubleshooting standard SAP security. That is, any security implemented by the placement of a standard authorizaton check within the piece of executed code. Keeping this in mind, there are two other ways that security can be voided that lead many times to a confused Security Analyst.

(1) Tcode SU24 (table USOBT_C) contains the marriage of tcode to proposed authorization objects that is used when creating roles in PFCG. You can "add" objects to this list, but they will not be checked unless a developer already placed a corresponding "authority_check.." statement in the code. Importantly though, you can deactivate a check in the code, but toggling the colum value "Check Ind." (check indicator) in SU24. The values must be transported and are client independent.

(2) Custom code, including, but not limited to user exits and FI validations can limit a user. User exits often incorporate standard authority checks, but they do not have to...its custom code. If a non-standard check is used, it is most likely that a trace will show nothing. Get an experienced ABAP'r to help debug the code if you suspect this may be the case. In the case of FI validations, quite commonly there is a user maintained table with SAP ID's. Any user not in the list doesn't get to go to the party. This is completely invisible to the hapless security consultant. Make FI inform you of all their active validations before you begin troubleshooting their system.

Hope this helps.

Ian.