Authorization Issue

[former_member184114]

Dear All,

Scenario

I have one user in R/3 for example USER1, who has almost all the authorizations. We have created one custom transaction code and set certain authorizations for the same and assigned this tcode to user USER1.

However, when he executes this tcode, the result is not correct! In order to solve this I have done the following work arounds:

Workaround 1:

1. Created a test user and assigned only this custom tcode to this user.

2. Executed this tcode and got the desired results.

Workaround 2:

1. Deleted USER1 from R/3.

2. Copied test user to new user USER1.

3. Accessed the custom tcode. However, the I did not get the desired result!

I regenreated all the roles in R/3 and created user USER1 from scratch and assigned this custom tcode again. But I did not get the desired result.

I think the USER1 master data is not getting updated in the system.

Can anybody please give his/her inputs on the same?

If you need any more information,please let me know.

Regards,

Fasial

[Former Member]

Hi,

You can get more information by using ST01 - Authorization trace, specifying with the user id getting the problem.

Regards

Krishna vanga

[former_member184114]

Hi All,

Thank you for your kind responses. As suggested, I switched on the trace and checked. What I found is that the authorization check for users TEST and USER1 are different.

Extra Auth Objects were being checked for user USER1 (which is creating problem). So, I disabled these objects from the roles assigned to him and regenerated those roles. However, when I executed our custom tcode, those Auth Objects are still checked!

It seems this information is not getting for this user id USER1. Can anybody suggest and give me your inputs?

Regards,

Faisal

[Former Member]

Hi Faisal,

What version of SAP you are using.Check for the size of user buffer.May be it is small.

Regards

Ashok

[Former Member]

Hi,

User could have another profile like sap_all or so which is giving authorizations. Please check.

Regards,

Gowrinadh

[former_member184114]

Hi,

We are on SAP R/3 4.6C.

Regards,

Faisal

[former_member184114]

We have only 2 such roles:

1. for Executing all the tcode excpet BASIS

2. Authorization for all the tcodes just to display.

I have disabled these objects in the above profiles as well.

Regards,

Fasial

[Former Member]

Please paste the output of trace here for both the users. Also the debug is the best option here for you.

Regards,

Gowrinadh

[former_member184114]

Dear Gowrinadh,

Below is the trace output for both the users:

USER1

M_MRES_BWA:ACTVT=03,BWART=201

M_MRES_WWA:ACTVT=03,WERKS=YL20

M_MRES_BWA:ACTVT=03,BWART=221

M_MRES_BWA:ACTVT=03,BWART=261

S_GUI:ACTVT=61

S_ALV_LAYO:ACTVT=23

TEST

M_MRES_BWA:ACTVT=03,BWART=201

M_MRES_WWA:ACTVT=03,WERKS=YL20

M_MRES_BWA:ACTVT=03,BWART=221

M_MRES_BWA:ACTVT=03,BWART=261

If you could observe, for user USER1, 2 extra Auth Obj. are checked always!

S_GUI:ACTVT=61
S_ALV_LAYO:ACTVT=23

Where as, for TEST user, these objects are not checked. I disabled the above 2 Auth Obj. from all the roles, deleted USER1, regenerated all the roles and then recreated user USER1 from scratch and assigned only required custom tcode. However,still in user trace, I could see that, the above 2 Auth Obj. are still checked for this user.

Your valuable input is appreciated. If you need any more information, please let me know.

Regards,

Faisal

[Former Member]

Hello Faisal,

These two objects are checked for GUI activities and layout display,which in fact will not have any impact on the authorization required. Now the question is is the output display format is different or the result of the output is different. If the output format is different the reason is the object S_ALV_LAYO.

Also, for the authorization check below did you see RC=? field value in the trace. Is it 0 for all the entries i.e user1 and test user.

FYI,

S-GUI values

60 Import

61 Export

DL Download

UL Upload

Thanks,

Gowrinadh

[Former Member]

Hi,

As per your query you should provide authorisation object value to this user. If object is not avalable in the user profile then add this object manually and provide the required value.

Anil

[Former Member]

hi,

If you have assigned sap_all to the user, regenerate the sap_all. If not start tracing the user in authorization check and see.

Even after this issue is not solved, get in touch with abaper and debug the program execution. Here you will definately find on the reason for incorrect result.

Regards,

Gowrinadh

[Former Member]

Hai,

Assign tcode and the try logoff and login with the user1 and then try.

Regards,

Yoganand.V

[former_member184114]

Hi Yoganand,

Thanks for your reply.

However, this is done many a times, but of no use!

Regards,

Faisal