Skip to Content
author's profile photo Former Member
Former Member

Excessive HR authorisation check (53,500) on one transaction

Hi experts,

We have a situation where one of our HR administrators runs PA20, for example, and this takes an excessive time to load. There is a timer message in the bottom of the screen (which i have never seen before) stating Authorisation Check 5% and carries on up to 100%

We turned on the PERNR authorisation check about 5 weeks ago, which should check object P_PERNR in your authorisations. However, for this one user, the only check being carruied out is P_ORGIN.

This user had 53,500 checks in the trace file from just executing PA20, not even entering a personnel number at this point!

The other user just had 30 checks - which would be regular enough.

Start of trace file for excessive user (no P_PERNR check)

21:39:32 	P_ORGIN	RC= 0 INFTY=0000;SUBTY= ;AUTHC=R;PERSA= ;PERSG= ;PERSK= ;VDSK1= ;
21:39:37 	P_ORGIN	RC= 4 INFTY=0000;SUBTY=' ';AUTHC=R;PERSA=*;PERSG=*;PERSK=*;VDSK1=*;
21:39:37	P_ORGIN	RC= 0 INFTY=0000;SUBTY=' ';AUTHC=R;PERSA= ;PERSG= ;PERSK= ;VDSK1= ;
21:39:37	P_ORGIN	RC= 0	INFTY=0000;SUBTY=' ';AUTHC=R;PERSA=AT02;PERSG=1;PERSK=AB;VDSK1=AT02;

Start of trace file for normal user (P_PERNR check)

21:48:54	P_PERNR	RC=		0	AUTHC=W;PSIGN=*;INFTY=0001;SUBTY=' ';
21:48:54	P_ORGIN	RC=		0	INFTY=0001;SUBTY=' ';AUTHC=W;PERSA=*;PERSG=*;PERSK=*;VDSK1=*;
21:48:54	P_PERNR	RC=		0	AUTHC=W;PSIGN=*;INFTY=0003;SUBTY=' ';
21:48:54	P_ORGIN	RC=		0	INFTY=0003;SUBTY=' ';AUTHC=W;PERSA=*;PERSG=*;PERSK=*;VDSK1=*;
21:48:54	P_PERNR	RC=		0	AUTHC=W;PSIGN=*;INFTY=0002;SUBTY=' ';

Can anyone help? Surely 53,500 authorisation checks is a little too extreme! It is not happening to other HR users so it is very strange why just this one!

Thanks,

Bernard.

Add a comment
10|10000 characters needed characters exceeded

Assigned Tags

Related questions

3 Answers

  • Best Answer
    Posted on Jun 17, 2008 at 07:33 AM

    >

    > Can anyone help? Surely 53,500 authorisation checks is a little too extreme! It is not happening to other HR users so it is very strange why just this one!

    Just to be qurious and try to understand your problem.

    Are the users looking at the same information?

    It feels like the user with 53500 checks are viewing an entire tree full of entities.

    So can it be so that the one with many authorization checks have full access to the org structure?

    Regards Fredrik

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Jun 17, 2008 at 01:39 PM

    Hi Fredrik,

    The strange this is that the user isnt even getting to the stage of entering a personnel number or anything. It is literally when they run t-code PA20

    But to answer your question, yest this user would have display access to the entire org structure.

    Any more suggestions?

    Bernard.

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Jun 18, 2008 at 02:59 PM

    I have noticed now in our Quality client that there is a P_PERNR check taking place 1st as is expected.

    15:34:02:946 AUTH    - - -   S_TCODE    RC=0  TCD=PA20;                       
    15:34:02:985 AUTH    - - -   P_PERNR    RC=0  AUTHC=R;PSIGN=*;INFTY= ;SUBTY= ;
    

    where as in our production client there is a P_ORGIN check taking place 1st

    21:39:31:991 AUTH    - - -   S_TCODE    RC=0  TCD=PA20;                                               
    21:39:32:15  AUTH    - - -   P_ORGIN    RC=0  INFTY= ;SUBTY= ;AUTHC=R;PERSA= ;PERSG= ;PERSK= ;VDSK1= ;
    
    

    Or configuration of the PERNR check in table T77S0 is the same in both clients.

    Are there any settings in PA20 or user defaults that would cause this. From my analysis, the trace file is showing up with one particular personnel area for the majority of the 53,500 checks!

    Any help appreciated!

    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.