P_ORIGIN authorization object.

[Former Member]

Hi

We are encountering one problem in production.We have one role giving Authorization to PA51 and PA61 tcodes it is working fine and the user assigned to that role is able to execute those tcodes with the help of that role upto last month. Now he is not able to execute PA61 and even PA51 also . There is no changes transported to production for that role.

User is trying to create IT2005 records

SU53 screen is telling for P_ ORIGIN object

AUTHC = u2018Eu2019

INFTY = 2005

PERSA = <Dummy>

PERSG = <Dummy>

PERSK = <Dummy>

SUBTY = u2018u2019

VDSK1 = <Dummy>

Current authorization he is having for P_ORIGIN

AUTHC = M, R,W

INFTY = 2005

PERSA = JTCW

PERSG = *

PERSK = *

SUBTY = *

VDSK1 = ESS.

I am not even able to simulate in QA or in DEV the same error. In QA and DEV the role if working fine when assigned to some test ID. According to AUTHC he is having authorization for writing the record, but why system is looking for E.

I did usercomapre again, reset user buffer through SU53, still he is not able to execute.

Any idea on what to do? Any suggestions

[Former Member]

Hi DGS,

Could you please check whether role has been experied for those users.

Regards

Ashok

[Former Member]

Hi Ashok,

Yah I checked the usercompare button it is green in colour and even i can see user name in Uer's list.

Thanks

Sasi

[Bernhard_SAP]

Hi DGS,

do you have different SU24-settings those 2 t-codes in your production system?

If not, start analyzing the checks with ST01 in Dev and PRD to find out, where the check is performed in PRD (jump to the coding from the result list) and compare with DEV. Maybe there is some customizing setting different....

b.rgds, Bernhard

[Former Member]

Hi Sasi,

As per my understand,user should also have AUTHC = u2018Eu2019 & 'D' cos he needs to be changed overtime data for existing employee.May be the user did't maintened time data untill last month.But anyway without AUTHC = E & D,user may not be able to work in PA61.

Rgds

[diwheeler]

Hi there,

I just wondered if you had run a trace in ST01 for the authorisation checks? I've found often in my troubleshooting the SU53 will only show the last failure, but in HR issues, the auth check causing the failure will be many lines above, so you might see on the trace something like it checking auths for *, then W, then S, E, etc... before the checks stop failing...

Good luck with it,

Cheers,

Dianne

[Former Member]

Hi

Thanks for all for putting effort and time in advising me.

The issue is user is not having authorisation to run ST01 tcode to do trace. But he is able to do updation of the overtime records last month, anyhow i included 'E" accordingly in the role and transporting to production to see how it works?

But What wonders me is how come all the time the role is working from 2004 witout E?

[Bernhard_SAP]

Hi,

the user does not need to be able to start ST01. You can start it (you can set a filter on the user-ID you are interested in to keep the file size small). When viewing the trace, set again the filter for that user-ID.

So switch on trace, ask user to start the process/transaction) until he gets the problem. Stop the trace and view the file.

Then compare the rsult with the same from your previous release (2004). So you need to have access to such an 'old' system...

If there has been a change of checks between releases, that shall be documented somewhere (release notes, regular notes, documentation,.....).

b.rgds, Bernhard

[Former Member]

Hi Bernhard,

Thanks for the input and sorry for not responding fast. Even I dont have access to production system as I am HR consultant. I will work according to your sugegstion with our Basis.

Just want to be clear, The role is working fine even last month also and user is able to enter overtime records of his staff . But this month When he tried to key in overtime records, system didnt allow him to do so.Even the header information of the staff when execute the PA61 tcode is missing. But when he keyed in his employee number he is able to see all the header information. But when trying to view his staff he is not able to see header information this month only. But Personnel number check authorization object is not included in the role. Any suggestions?

Thanks

Sasi.

[Former Member]

Hi All,

Thanks to all for efforts. I am able to resolve this. Actually this happened because of structural authorization. Nothing to do with the role that is assigned to him,

Edited by: DGS on Nov 5, 2008 7:18 AM