authorization check with empty field value

[#1]

For a customer-specific (custom) authorization object, we would like to allow an empty value in one of its fields.

As described in the SAP documentation we have entered ' ' (a space enclosed in single quotes) in the corresponding (source) field of the authorization object, but the AUTHORITY-CHECK statement returns RC 4. Is this intended behavior, or can we correct something?

SAP documentation 

[Lakshmipathi]

According to the SAP documentation referenced, entering ' ' (space enclosed in single quotes) as an authorization value is supported for customer-defined authorization fields and represents an explicit blank value.

However, the authorization check succeeds only if the value passed in the corresponding AUTHORITY-CHECK field also matches the stored authorization value exactly. Therefore, an AUTHORITY-CHECK returning SY-SUBRC = 4 does not necessarily indicate incorrect authorization maintenance. It may indicate that the value being checked is not an actual blank value at runtime or does not match the authorization value exactly.

To verify the behavior, review the exact values used during the authorization check using SU53 or STAUTHTRACE and compare them with the values maintained in the user's authorization profile.

Based on the SAP documentation, maintaining ' ' as an authorization value is valid custom authorization object behavior. If the check still returns SY-SUBRC = 4, the next step is to analyze the runtime value passed in the AUTHORITY-CHECK statement and compare it with the authorization value stored in the user buffer.

SAP's documentation confirms that ' ' is a valid authorization field value, but it is not a wildcard. Therefore, if the customer expects a blank authorization value to authorize any value, that expectation would not be consistent with the documented behavior.