User does not have authorization.

[Former Member]

The end-user gets an error message "PM:xxx No authorization for Plant XXXX in the TCODE screen".

I have debugged the TCODE, and no authorization checks are made within the program.

How do I check if the user is setup correctly? FYI - I do not have authorization to SU01.

[Former Member]

If you do not have authorization then your basis team should do this for you.

Cheers

[Former Member]

Hi:

It is quite possibel that there are certain <b>authorization checks</b> for the plant. If there is a authorization check for that particular plant, then the user will on be able to execute for that plant.

SU21 is the transaction code for maintaining authorization check objects.

Regards,

Sookshma

[Former Member]

hi Ganadeep,

Sometimes your basis person or the client may restrict you from accessing few transactions ... for that check with the basis person for providing the authorizations

Regards,

santosh

[Former Member]

U can do SU53, whereby it would list the problem as to the object...than you can give appropriate rights to the particular user.

[Former Member]

Small correction - your user should run SU53 right after he got the message about missing authorizaiton, he'll see which object/values were checked and were not successfull.

SU53 should be executed by the person who actually eperiences authorization problem.

[RichHeilman]

Right, fool proof way is to run the transaction to the point where he gets the error message, then type /nSU53 in the tcode box at the top of the gui, then print the output and give to security guys.

Regards,

Rich Heilman

[Former Member]

We have been going back-and-forth with end-user and Basis to fix this issue.

The SU53 screen shot was submitted to Basis and they claim the user's autorization profile is correct. Is it possible for one authorization profile to interfere with another authorization profile?? Because the profile under contention should allow add/change/delete material classification attributes. But there exists another authorization profile against the same user that give him only display rights.

Another clarification from the user - Initial stand was that he saw the 'No authorizatoin for plant xxxx' message when he typed in the TCODE (which made me look for authorization checks in PBO module of the screen). But now, he states that the error message is displayed when he hits the ENTER key (so, the check is being made in PAI module, is it??).

[RichHeilman]

I would think it is in the PAI.

What tcode/program are we talking about?

Also what is the message id and number, you may be able to do a where used on this and find exactly where this message is coming from.

Regards,

Rich Heilman

[Former Member]

The program is a custom progoram.

The message displayed is

"PM:301 No authorization for Plant 0123"

I did perform a global search for this message is the message class, text symbols and did not get any results.

[RichHeilman]

What function module is it calling in this custom program, most likely it is coming from there.

Regards,

RIch Heilman

[Former Member]

If your user is getting error message and his SU53 keep showing missing authorization - then your BASIS folks need to check authorization again.

You can enable authorization trace in ST01 and check which objects/values have been checked.

[Former Member]

Guess I finally figured this one...

The user has two conflicting authorization profiles.

One profile give him 'display only' rights and the other profile authorizes him to execute a TCODE. The program behind the TCODE looks for a 'create' authority.

Basis has been notified and ticket has been re-routed to a different queue.