Massive entry into S_TCODE

[former_member539700]

Hi experts,

I have ti insert about 1500 transactions in S_TCODE object. I want to know if there is a transaction to enter into a role so many transactions, from txt file using the upload.

Best regards

S.

[Former Member]

There is none that I know of. Why are you not inserting into the menu (where there is the facility to generate role menu from a flat file)?

Directly updating S_TCODE is not a good approach.

[former_member539700]

Thank you for your quick response.

Unfortunately I do from S_TCODE because the customer requires it to me.

But if I upload them from the menu then they are in S_TCODE? I think not.

The role already includes other transactions in the menu but they are not present in S_TCODE. Or am I wrong?

[Former Member]

Your customer is wrong. If you are consultant then surely it is your role to add value and to show them the error of their ways.

Adding tcodes into the menu will populate S_TCODE and a myriad of other auth objects with the data configured in SU24. If you just enter stuff into S_TCODE it will not pull through the required auth objects and on removal of a tcode, remove entries supporting that transaction.

Edited by: Frank Koehntopp on Jun 7, 2010 10:32 PM - It was actually 3 posts

[martin_voros]

Hi,

you are wrong. Please refer to PFCG documentation or just try in PFCG. What exactly does your customer require from you? Does he want to add manually object S_TCODE to some roles or he wants to add access to some transactions? Honestly, most people have no idea what exactly security means. So I don't blindly do what customer tells me.

Cheers

[martin_voros]

Hi,

you are wrong. Please refer to PFCG documentation or just try in PFCG. What exactly does your customer require from you? Does he want to add manually object S_TCODE to some roles or he wants to add access to some transactions to some roles? Honestly, most people have no idea what exactly security means. So I don't blindly do what customer tells me.

Cheers

[koehntopp]

Where oh where do I start...

OK then:

- As Alex said: NEVER use S_TCode directly: No exceptions.

- Add the transactions through the menu, then they will pull the required objects, too.

- Have a look at Note 389675 for a text format to upload roles, maybe you can shoot your list of TCodes in there somehow.

Isn't it great how I avoided questioning the sanity of having a role w. 1500 transactions in the first place? And this in the security forum!

Frank.

Edited by: Frank Koehntopp on Jun 7, 2010 3:08 PM

[Former Member]

I have to confess that I have done this before, but it is a special case and might be the same here.

For key users who have a functional role for that which they do infact use (let's say max 100 transactions) you might want to give them the option to switch to the SAP standard menu and take a look there in their area to see what SAP has to offer if they cannot find it in their own role (as "visible tcode launch pad").

Better than ranges in a manual S_TCODE and S_ALR* is to import the node from the SAP menu into a 2nd role for the user, then go through it for critical transactions and SOD stuff (heh?) and create a profile for it which has all objects set inactive except S_TCODE .

That might be where the 1500 tcodes come from in the first place (a download of the menu of such a role) but it is just a speculation.

In the "basis" forums there are also several threads about how to provide an up-to-date Test system. This type of role is an alternative as they can start the "functionally similar" tcodes, but the program execution and behaviour is 100% dependent on the real role (unless of course those tcodes don't make checks or use auth objects in semantically conflicting ways, or they are too strict, etc).

As they are SAP standard tcodes and you can filter the nodes before, it should be okay... --> consistent authorizations for consistent coding techniques.

I have done this before and consider it to be a "lesser evil" if the requirement is there, the authority-checks and a rather painfull review...

Cheers,

Julius

Edited by: Julius Bussche on Jun 7, 2010 11:27 PM

[Former Member]

>

> ... about 1500 transactions 
> 

Where did they get the list from and where do they want to start these transactions from, the names of which they nor you cannot possibly memorize...?

Cheers,

Julius

[Former Member]

Hi S.

When we make a change to the S_TCODE or any other object in a GWR authorization, the status of this object becomes CHANGED:

Changes should never be made directly to the S_TCODE object.Once the S_TCODE object gets into CHANGED status, T-Code deletions made in the menu path DO NOT override the T-Code value in S_TCODE. The T-Code doesnu2019t exist in the menu, but can be called because it still exists in S_TCODE.

The solution to this problem:

Always make T-Code additions/deletions from the menu path ONLY.

This is how the profile generator is designed to work. When you add the T-Code into the menu, SAP will bring in the necessary objects/values. The only exception here is when working on non-end user roles, roles used in Development and Integration that use ranges in S_TCODE.

When deleting T-Codes, check to see that S_TCODE is in STANDARD status. If it is in CHANGED status, take these steps to get S_TCODE back into STANDARD status:

Inactivate and delete the S_TCODE object using the trashcan.

Use the u201CExpert mode for profile generationu201D button to regenerate the role from the T-Code menu entries:

Check the u201CRead old status and merge with new datau201D button. This will merge the objects with an u201COldu201D status with new objects pulled in from the current SU24 configuration:

The S_TCODE object should now be in STANDARD status.

Maintain any yellow objects, merge, reorganize, save, and generate.

If you have massive transaction then you can use CATT scripts / LSMW / SHDB upto menu level.

Thanks,

Sri