Question Permission of action's objects (inside function).

[Former Member]

Hello, I'm new here.

Nice to meet you all.

I'm having some troubles with SAP GRC RAR and I believe you can help.

During the creation of objects authorizations (Functions, Choose a a function, Permission tab), I can understand the fields: "Field", "Value From" and "Value to", "Conditions" and "Status".

Well I'd like to understand better how the "Conditions" works?

If GRC test condictions between each line of the object or between each object, or even between the values of the fields "Value From" and "Value to".

How it works?

Waiting for some feedback.

Thank you.

[Former Member]

Dear all.

Thank you.

[koehntopp]

This note should help you:

https://service.sap.com/sap/support/notes/1514544

Frank.

[Former Member]

If you're referring to the operators (AND, OR, NOT) within the permissions tab, please review SAP note 1330165 which contains all of this data. A quick overview though is that the condition/operator only applies within a field of an object. If you use a range then it will always be interpreted as OR within that range, even if the operator is AND. I'm given an example below.

F_BKPF_BUK ACTVT 01 02 AND ENABLE

The above would cause a conflict if the user had accounting document authorization for company code with a create (01) or change (02). The operator does not matter because it is in a range. If we want them to have both, 01 and 02, then we should format it as below.

F_BKPF_BUK ACTVT 01 AND ENABLE

F_BKPF_BUK ACTVT 02 AND ENABLE

Again, this was just meant to be a small example. The above listed SAP note should provide you an indepth explanation.

Thanks,

Tyler