Solved: User roles

Former Member · ‎2006 Oct 24

Now I have got a problem which I really have no idea how to solve it. Really appreciate if anyone can give me any clue or suggestion.

Background:

User AAA is doing transaction TTT (a customize transaction) but she gets error message "You have no authorization for this transaction in plant PPP".

However, her colleague can do the same transaction.

Actually user AAA has more roles than her colleague has. (AAA has all roles her colleague has + more other roles)

Current solution:

After I removed a role RRR1 (which contains the tcode TTT) from the id, the result was OK. (although other derived roles (RRR2-RRR5) still exist in the ID)

(to remove other roles cannot solve the error)

But I cannot find out why only role RRR1 should prevent the users to perform TTT.

Should you have any idea how to investigate it, please let me know. Thanks a lot.

I have checked SU53 and ST01. However, it seems to be not related to the issue (ST01, all are 0) (SU53 - the administration object is required)

Former Member · ‎2006 Oct 24

Hello Sirirak,

removing the role solved the authorization issue.. this is pretty surprising. However since you mention that this is custom transaction for a custom code I would advise you to check the code. Look for Authority_Check function module. The user is missing authorization for the auth object mentioned there.

Had it been standard SAP t-code then the authority checks would have been maintained in SU20 and they would reflected in SU24 but in this case I am not sure if this has been done.

Regards.

Ruchit.

Message was edited by: Ruchit Khushu

Former Member · ‎2006 Oct 24

Hello Sirirak,

removing the role solved the authorization issue.. this is pretty surprising. However since you mention that this is custom transaction for a custom code I would advise you to check the code. Look for Authority_Check function module. The user is missing authorization for the auth object mentioned there.

Had it been standard SAP t-code then the authority checks would have been maintained in SU20 and they would reflected in SU24 but in this case I am not sure if this has been done.

Regards.

Ruchit.

Message was edited by: Ruchit Khushu

Hank · ‎2006 Oct 24

Hi Sirirak, Try Ruchit solution 1st, but if not successful, please verify if user AAA has not exceed their buffer size.

HB

Former Member · ‎2006 Oct 24

Hi,

Try copying the user AAA and try the same access. Make sure you run a

user compare. If it works, then remove all of the roles from user id AAA

and save. Then re-assign all of the same roles, save and run user compare.

Found that especially in 4.6C the user buffer gets "corrupted" and this

is only way to solve issue.

Former Member · ‎2006 Oct 25

Hello Sri,

You mentioned that user AAA has more roles than her colleague and that cab a problem also. Size of raw dafa field limits the maximum number of roles you can assign a user.

Good luck

Former Member · ‎2006 Oct 25

Sound to me like a pretty standard case of buffer overflow. You can check the total number of authorizations by asking the user to run SU56. You can also check what is the buffer size (auth/auth_number_in_userbuffer) by either running RSPARAM thru SE38 or running RZ11, the default setting is 2000.

One interesting fact all Security folks might be interested, do so research on F_IT_ALV, this is one auth object, if a user has this auth object, additional auth check will be carry out. If the user do not have this auth object, the user has full auth to change the layout (auth-check will not be perform).

Thanks,

Lye

Wolfgang_Janzen · ‎2006 Oct 25

> One interesting fact all Security folks might be

> interested, do so research on F_IT_ALV, this is one

> auth object, if a user has this auth object,

> additional auth check will be carry out. If the user

> do not have this auth object, the user has full auth

> to change the layout (auth-check will not be

> perform).

Well, that's an example for bad usage of an existing concept. I've even seen once an application that has submitted an AUTHORITY-CHECK on some object and deactivated some functionality if SY-SUBRC = 0 (i.e. when the user does have the requested authorization) ...

I'd recommend to analyse and compare the authorization trace (ST01) of both actions. It is not normal that an user which is assigned to a more powerful authorizations than another user is blocked from certain actions while the less authorized user is granted access.

Regards, Wolfgang

Former Member · ‎2006 Oct 26

Hi all,

Thanks a lot for your answer!! I'm really appreciated to know that there're many people giving me great support!!!

I have tried many ways:

Firstly, I have created a test user with only the (problem) role RRR1 and another derived role that can access to the plant. However it's also not working which means that it's not related to user buffer.

Secondly, I also do trace (st01) all authorization objects are passed (value 0).

In addition, the code check, since it's a derived role and the user with other derived role can access. I don't think it's a Authority Check problem.

At last, I created a new derived role (with the same organization value as the role RRR1. With this role assigned to user, it canbe executed sucessfully!! I have compared the new role with the old one in SUIM and AGR_1251, AGR_1252 as well. However, everything is the same. I don't know why?? Do you think it's SAP bug?

I'm also thinking if someone has broken the link of organization level in this derived role? How can I know if the link has already broken? Please advise.

RainerKunert · ‎2006 Oct 30

Hi,

did you check the profile that is assigned to the derived role?

May be the profile itself is damaged. If you have transported another role with the same profile name, the new role will override your RRR1 profile definition.

By Category

Related Content

Activity Groups

Industry Groups

Influence and Feedback Groups

Interest Groups

Location Groups

Customer Only Groups

Forums

Related Resources

Products

Learning and Support

About

My SAP Profile

My SAP Profile

User roles