Understanding AUTHORITY-CHECK

[Former Member]

I am a security guy but am trying to understand how the AUTHORITY-CHECK works. I have read the help on it but it doesn't answer to my understanding. I want a check in a report so that no matter what the user selects the program goes out and checks the authorization in the users master record and only displays what he has access to. I am sure this is basic but I am not a programmer.

Thanks

[Former Member]

I am a security guy but am trying to understand how the AUTHORITY-CHECK works. I have read the help on it but it doesn't answer to my understanding. I want a check in a report so that no matter what the user selects the program goes out and checks the authorization in the users master record and only displays what he has access to. I am sure this is basic but I am not a programmer.

Thanks

[RichHeilman]

You must create an authority object or use an existing one. In the report program, code the authority check. If sy-subrc <> 0, then the user does not have authority.

  authority-check object 'A_A_VIEW'
           id 'VIEW' field p_asset.

  if sy-subrc <> 0.
    write:/ 'No Authority'.
  endif.

Regards,

Rich Heilman

[Former Member]

Thanks Rich. The documentation lists specific values for the field values.

[Former Member]

Hi Greg,

Is your question answered ? Or do you require additional information ?

If your problem is solved, then could you please mark this thread as answered ?

Regards,

Anand Mandalika.

[rahulab]

Dear Rich,

Can you please explain the working of Authority-check?

reply appreciated.

regards

Rahul.

[Former Member]

Hi,

Authority-Check is used to check User authorizations. You can use an AUTHORITY-CHECK in your program, if you have a requirement where only specific users can have access to the program.

One can have several validations in Authority-Check. For e.g. only selected Users can run a particular transaction, only selected Users can run a report for a specific plant & if any other user tries to execute the report, then the Authority-check would fail & will raise a message that 'The User doesn't have access for a specific plant'.

One has to create a authorization object & assign authorization fields to it. Only those fields are validated.

AUTHORITY-CHECK OBJECT 'ZABC'

ID 'BUKRS' FIELD ITAB-BUKRS

ID 'VKORG' FIELD ITAB-VKORG.

Here the user authorization is done for two fields i.e. BUKRS & VKORG. If for a particular value of BUKRS or VKORG, the User executing the program doesn't have authorization, then that record won't be executed.

Now, if in another program, developer doesn't want to have validation on two fields but only validation on VKORG. Then he can use the same Authorization Object with following changes :-

AUTHORITY-CHECK OBJECT 'ZABC'

ID 'BUKRS' DUMMY

ID 'VKORG' FIELD ITAB-VKORG.

So here the BUKRS field won't be validated & only VKORG would be validated.

Hope this clears the doubts.

Best regards,

Prashant

[Former Member]

Good Explanation Prashant