Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Value of CLIIDMAINT in auth object: S_TABU_CLI

Go to solution
Former Member

‎10-13-2006 5:33 AM

0 Kudos

Hi,

In SAP documentation, value of 'X' means the user is authorized to maintain client-independent tables. What if you grant asterisk(*) or input both 'X' and '' for the field?

I would assume full access will NOT grant the authorization to users to maintain client-independent tables.

Is anyone able to confirm this?

1 ACCEPTED SOLUTION

Go to solution
Former Member

‎10-13-2006 12:35 PM

0 Kudos

Hi Annie,

I can confirm that a full access would GIVE authorization to maintain client independent tables.

A * value would give access to Maintain the Cross client tables (Independent Tables)and i have done a test check with * to S_TABU_CLI and a test user and i am afraid your assumption is wrong..

Br,

Sri

2 REPLIES 2

Go to solution
Former Member

‎10-13-2006 12:35 PM

0 Kudos

Hi Annie,

I can confirm that a full access would GIVE authorization to maintain client independent tables.

A * value would give access to Maintain the Cross client tables (Independent Tables)and i have done a test check with * to S_TABU_CLI and a test user and i am afraid your assumption is wrong..

Br,

Sri

Go to solution
Former Member

‎10-13-2006 6:34 PM

0 Kudos

I would recommend giving 'X' and not *.

Technically, granting * means that you not only grant 'X', but infact you also grant '' or other hidden values which SAP_ALL users are deprived of discovering...

A * value for an authorization field will let all authority checks pass against the range of possible values in the authority-check statement.

The permitted value ranges can also have permitted data types and permitted values as can be seen in this example (SE11 -> Domain -> CLIIDMAINT -> Display -> Value range.) There are 2 standard CHAR values, 'X' and (explicit) =''. Theoretically you can extend these ranges, for example if you coded an authority check against S_TABU_CLI field CLIIMAINT = 'Y' and only wanted to grant 'Y' and not 'X' or ''.

Also note that S_TABU_CLI = 'X' check is just an upfront all or nothing check for access to maintain client independent "system" tables at all, <edit> you should still need authorizations for the auth-group </edit>. Depending on the transaction codes etc which you grant the user they should be guided into a table maintenance view, and S_TABU_DIS with appropriate activities and table-auth-groups would (normally) still be required and dependent on the authorizations which the user has in that specific client they are logged onto.

Message was edited by: Julius Bussche