SAP Authorizations Unclear responsibilities, especially between business and IT

Direkt zum Seiteninhalt
Unclear responsibilities, especially between business and IT
FAQ
The RESPAREA field has a maintenance dialogue that allows you to enter areas of responsibility. The care dialogue is called as a building block and provides different tabs for input depending on the authorization object. Now, if you declare the RESPAREA field to be the organisation level, you must first set the display of the tabs for input in customising. To do this, you must add an entry to the KBEROBJ table that is independent of the client by using the SE16 transaction. In this entry, leave the first OBJECT field blank. The CURRENTOBJ field must be maintained because it defines the tab that will be displayed when the maintenance is called, i.e. the Default tab. If this field is blank, no startup image can be found and errors occur. The following fields determine the contents of the various tabs and should therefore also be maintained so that you can use RESPAREA as an organisational level. These are the OBJECT1 to OBJECT7 fields for the first to the seventh tab. In these seven fields, you define what values you can enter on the tabs.

If you only want to translate the description of the role, it is recommended to record the PFCG transaction and to change the source language of the role using the Z_ROLE_SET_MASTERLANG report before the LSMW script runs through. The report on how to change the source language can be found in SAP Note 854311. Similarly, you can use the SECATT (Extended Computer Aided Test Tool, eCATT) transaction to perform the translation instead of the LSMW transaction. Furthermore, automation is possible with the help of a customer-specific ABAP programme. To do this, you should take a closer look at the AGR_TEXTS table. The table contains the different text blocks in different languages. Here we show you a section of the table with our example role Z_SE63. Short texts are assigned a value of 00000 in the column LINE, and long texts are assigned a value of 00001 to 0000x. The language keys are displayed in the SPRAS column. An ABAP programme now allows you to write the counterparts for the text fields in the target language into the fields in the tables.
Query the Data from an HCM Personnel Root Record
The difficulty in assigning permissions to the S_DATASET object is determining the correct values for the FILENAME and PROGRAMME fields. If you have not specified a path in the FILENAME field, only the files in the DIR_HOME directory will be allowed.

If the authorization objects also require permission fields, you can create them in the SU20 transaction. When creating a authorization object in the SU21 transaction, you first set a name and description for the authorization object, and then assign it to an object class. Then assign the necessary permission fields. If any of these fields are ACTVT, you can select all of the activities to be checked by clicking the Activities button. The navigation behaviour has been improved here a lot.

Assigning a role for a limited period of time is done in seconds with "Shortcut for SAP systems" and allows you to quickly continue your go-live.

If you want to know more about SAP authorizations, visit the website www.sap-corner.de.

It is essential to implement adequate authorization checks in every ABAP development.

For example, an employee may be authorized to access data for which he or she is not authorized.
SAP Corner
Zurück zum Seiteninhalt