SE16 Display Access only

[Former Member]

I just want to give out SE16 display access for the all the tables

so that user can not mannually enter values in it?

We are on NW2004s SR2. I have went in SU24 and assigned

S TABU DIS 03 I also checked the value for A oject in Roles

for all the Auth. Groups to 03.

Anything else I need to do ?

What vaule should I assign to S TABU CLI ?

From,

PT.

[Former Member]

Ensuring that S_TABU_DIS ACTVT=03 is all you need to do.

You can leave S_TABU_CLI blank as users shouldn't need it if only displaying table data.

Users should not have access to DEBUG mode via S_DEVELOP as this will let them bypass this (and pretty much any other security that you have put in)

[Former Member]

Yeah ! All thats to be done has been explicitly mentioned by Alex.

For the academic interest, For S_TABU_CLI if you place a X you grant the use permission to edit the independent tables !

Thanks

[Former Member]

you will also need S_TABU_DIS ACTVT=02 & S_TABU_CLI=X to edit cross client tables

[Former Member]

Ok Thanks guys.

From

PT.

[ashley_kenealy]

You try all the things suggested above or you can simply give access to transaction SE17 - General Table Display.

[Former Member]

Regardless of the transaction used to access the table data it would be short sighted not to apply restriction at object level.

[Former Member]

>

> You try all the things suggested above or you can simply give access to transaction SE17 - General Table Display.

Totally agree. SE17 is a simple straight forward solution to Display Tables. With certain limitations such as 'Maximum No. of Hits' etc, from a security stand point it works fine.

Gp.

[Former Member]

Another (perhaps better) option is SE16N? It has many more usefull features (the clipboard, graphics, etc - see the toolbar!) and if the user has the correct authorizations then it should be okay (if you have implemented some oldish SAP notes...).

I also browse SAP tables and it is very usefull - but I am always weary of the fact that I might be making assumptions about how the system works based on tables only... where the system itself (the programs) might use these tables and fields in a different way than what I am assuming, or what the field names appear to indicate on their own, or the programs might change...

Even if you can display tables; be carefull of them! The chances of making mistakes are fairly good.

Cheers,

Julius

[koehntopp]

Hi Pranav,

usually NOONE should have access to all tables. As SE16 allows client independent table display, data protection is at stake here. People will also be allowed to see security relevant tables (authorizations etc.) which may lead to serious problems.

SE16 is usually a poor excuse for incomplete functional access. If people really do need to look at the tables directly (are there no transactions or reports that provide the infomation?), you're much better off creating table views especially for these cases.

The auditors will not like SE16 in production...

Frank.

[Former Member]

I belive there is a sap note for it which tells to do a program change and create a custom t code which removes change access to se16.

We have implemented this for our system and it works fine. Need to find that sap note though.

Thanks,

Yogesh

[jurjen_heeck]

Yogesh,

When answering theads, please have a look at the posting dates. This thread is almost a year old. I doubt that Pranav is still waiting for an answer.....

Jurjen

[Former Member]

Most likely you are refering to [SAP Note 1133739|https://service.sap.com/sap/support/notes/1133739] which I can also strongly recommend implementing.

Creating a transaction variant for SE16 will not work. It will only appear to work...

Cheers,

Julius

Edited by: Julius Bussche on Oct 3, 2008 3:58 PM