Restrcting SE37 access to single Function Module

[Former Member]

Dear Experts,

We are trying to restrict the access to SE37 for single function module. Is there any possibility ??

Eg-We want to give SE37 access for only this FM "ZFIN_ADVANCE_PAYMENT "

for Eg.. SE38 access can be restricted for single program,,we are in point of trying for this incident also..

Pls provide some inputs..

Thanks in Advance!!!

Regards

[Former Member]

hi indirapriyanka,

you can do it, but the way it can be done is not according to SAP guidelines (S_DEVELOP should not be assigned to end users in a productive system).

since you cannot authorize on FM's specifically you can instead authorize on function groups.

by adding a S_DEVELOP object to the users' role with the following data:

OBJTUPE = FUGR

ACTVT = 16

OBJNAME = ZYOUR_FUNC_GROUP

the ZYOUR_FUNC_GROUP is a name I made up. you should create your own group in SE80 and add only the FIN_ADVANCE_PAYMENT FM to it.

good luck!

Message was edited by: Dimitri van Heumen

[Former Member]

Hi Heumen,

When i was trying the above, In S_DEVELOP authorization Object , P_GROUP authorization field is taking only 8 character length where as the Function Group length can be maximum 26 Alphanumaric charcter length.

http://help.sap.com/saphelp_nwpi711/helpdata/en/d1/801ef5454211d189710000e8322d00/content.htm

This is where i couldnt able to connect the gap between the above.

Can you pls throw some light on this!!!

Thanks in Advance!!

Regards

Priyanka

[Former Member]

hi again indirapriyanka,

it's not the P_GROUP field where you should enter the function group name but in the OBJNAME field.

you can enter an ALL (*) value to the P_GROUP field in this case.

good luck and let us know how this works for you!

//dimitri.

[Former Member]

Write a program which executes the FM. Provide application security before the call and react to return messages. Then you will be fine and no need for F8 usually.

But F8 will also check the progname in navigation. This is a numerically sequenced include, which corresponds to the FM number in the top include of the function group. If you display that sub-include, then you display the FM. Same for subsequent execute (actvt 16).

Giving them remote comparison and and emergency procedure is more sustainbable. Emergencies are mostly in the Z-area from experience. If you make the developers test more (or at all) then you are better off completely forbidfing it in prod systems and restricting SM59 connections from DEV to PROD completely.

Cheers,

Julius