Skip to Content
avatar image
Former Member

Restrcting SE37 access to single Function Module

Dear Experts,

We are trying to restrict the access to SE37 for single function module. Is there any possibility ??

Eg-We want to give SE37 access for only this FM "ZFIN_ADVANCE_PAYMENT "

for Eg.. SE38 access can be restricted for single program,,we are in point of trying for this incident also..

Pls provide some inputs..

Thanks in Advance!!!

Regards

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

2 Answers

  • Best Answer
    avatar image
    Former Member
    Mar 15, 2013 at 09:51 AM

    hi indirapriyanka,

    you can do it, but the way it can be done is not according to SAP guidelines (S_DEVELOP should not be assigned to end users in a productive system).

    since you cannot authorize on FM's specifically you can instead authorize on function groups.

    by adding a S_DEVELOP object to the users' role with the following data:

    OBJTUPE = FUGR

    ACTVT = 16

    OBJNAME = ZYOUR_FUNC_GROUP

    the ZYOUR_FUNC_GROUP is a name I made up. you should create your own group in SE80 and add only the FIN_ADVANCE_PAYMENT FM to it.

    good luck!

    Message was edited by: Dimitri van Heumen

    Add comment
    10|10000 characters needed characters exceeded

    • Former Member Former Member

      hi again indirapriyanka,

      it's not the P_GROUP field where you should enter the function group name but in the OBJNAME field.

      you can enter an ALL (*) value to the P_GROUP field in this case.

      good luck and let us know how this works for you!

      //dimitri.

  • avatar image
    Former Member
    Mar 18, 2013 at 10:54 PM

    Write a program which executes the FM. Provide application security before the call and react to return messages. Then you will be fine and no need for F8 usually.

    But F8 will also check the progname in navigation. This is a numerically sequenced include, which corresponds to the FM number in the top include of the function group. If you display that sub-include, then you display the FM. Same for subsequent execute (actvt 16).

    Giving them remote comparison and and emergency procedure is more sustainbable. Emergencies are mostly in the Z-area from experience. If you make the developers test more (or at all) then you are better off completely forbidfing it in prod systems and restricting SM59 connections from DEV to PROD completely.

    Cheers,

    Julius

    Add comment
    10|10000 characters needed characters exceeded