Create a role with Tcodes

[Former Member]

Hello Security Experts!!!

I am trying to create to role with only T-Codes. I am going to menu and adding T-codes that i wanted. But once i enter into authorization and wanted to change the field values, i am getting those tcodes only in display mode. No feilds or values seen. I dont know the reason. Please can someone suggest me. I have done a good search but could not find the relevant answer.

Thanks & Regards

Vanitha

[jurjen_heeck]

If I understand correctly, you can only see a read-only S_TCODE object and no others?

What transactions are there in your role?

[Former Member]

What are the tcodes - are they custom?

Do they have proposal values maintained in SU24?

[Former Member]

The t-codes given are SU01, SUGR, PFCG, SUIM and SUPC.

How should we maintain those in su24? Like what needs to be done.

thanks

Vanitha

[Former Member]

I think in your organization the role administration has been segregated and hence you may not have sufficient authorizations for generating profile or mainatining field values for authorizations.

Please check your authorizations for objects:

uthorizations: Role Check S_USER_AGR

User Master Maintenance: Authorization Profile S_USER_PRO

Authorizations: Field Values in Roles S_USER_VAL

[Former Member]

Hello Vanitha,

See the Tcodes you had mentioned are normal tcodes by adding which in authorization maintenance , you plan for the activity.As mentioned earlier about su24, in this transaction you enter trx code option the transaction you r facing problem and then execute.In this sort on proposol and check for yes.The objects which has yes will be called by default whenever u give this tx.If u want more options iin tht to be called thn u have to edit from no to ys.Following this will also propose for the object u had chosen whnever u give the respective tcode.

I hope u doubt would be clear,.

Regards,

Amit

[Former Member]

On double checking on my system, I have found that you may not have authorization for

User Master Maintenance: Authorization Profile S_USER_PRO

ACTVT 01 02

[Former Member]

Hi all,

After i gave the authorization objects manually, the user is getting the authorizations for those Tcodes. But my question is, when i am creating a role with menu, and giving the T-Codes, then go to authorizations, it is showing the T-codes i have given in just display mode. No feilds or values to each of the transaction. As soon as i give T-codes in menu and go to authorization, i should get the fields and values of each transaction so that i can assign values for display, create, delete etc depending on the requirement. I could not do that. Please suggest.

Thank you

Vanitha

[Former Member]

As I have told you you lack the ACTVT 01 (Create) for the object S_USER_PRO.

As a result you would not be able to see any of the objects that are getting populated by addition of the transactions. So, evidently you cannot maintain them either.

>After i gave the authorization objects manually, the user is getting the authorizations for those Tcodes

Can you clarify on how did you give this manually, when you are able to access the the authorization tab in display mode only?

[Former Member]

Hi,

My issue is, i am creating a role with the T-codes. When i go to authorizations tab and see, it has full authorization( Green) but when i login into the assigned user, it is showing you are not authorized...

Regards

vanitha

[Former Member]

Hi vanitha,

Why dont you run a SU53 immediately after the assigned user gets an error. You can than assign the missing objects to the relevant role.

Regards,

Chinmaya

[Former Member]

Hello Chinmaya,

I can do that. But everytime i create a role with T-Codes, i come accross the same situation. So i wanted a solution where it will not give authorization error. Usually once we create a role with T-codes, it will take all the authorization Objects associated with it. But no matter which T-code i give, i face same situation. I feel like there is a prerequisite which i need to do. I am trying ti figure that out. Any suggestions...

thanks

Vanitha

[jurjen_heeck]

Can you go to transaction SE16 and tell us how many entries there are in the tables USOBT_C and USOBX_C?

Sounds as if your 'customer tables' with authorization field proposals aren't filled correctly. Is this a new system? If not, since when are you experiencing these problems?

By the way, if mentioned tables are empty, go to transaction SU25 and execute step 1. That should fill them with the contents of the corresponding SAP tables.

[Former Member]

HI Vanitha,

I think the problem is that the concerned authorization objects are not related with the tcodes that you are setting.

you can make them default by using the transaction SU24. Key in the tcode and it will give the concerned checks with the relevant authorization objects you can change this as per your needs. By converting the Check to "C" or "CM" depending on your version.

As a result when ever you create your own roles in the future they will be defaulted.

Regards,

Chinmaya

[Former Member]

Hello Vanitha,

Can you explain the procedure that you use to get into the authorizations tab, Do you chose "expert mode for profile generation", If so, do you chose "Read Old data and merge with new data" or "Edit old status".

If you chose the latter the authorizations would remain green. you have to chose the former one for getting the open authorizations.

Regards,

Subbu

[Former Member]

I place my bets on custom transaction which is not a parameter transaction for which SU24 is not maintained as well.

Note: If a parameter transaction is not maintained, it will pull the proposal fields of the parameterized "core" transaction.

Cheers,

Julius