VT02N authorization - user was able to allocate deliveries from other state

[Former Member]

Hi guys,

Can somebody help me on my issue.

Here's the scenario:

1. I have two users from different state SA & WA to which it also have corresponding shipping point value as an ORG LEVEL. SA has a shipping point value of S010 while WA has shipping point value W010.

2. An SA test user TESTSA run tcode VT02N and entered shipping number. Tried to allocate deliveries from WA and it was successful. This should not be the case though. This user should not be able to allocate deliveries from other state/shipping point.

3. I checked the SU24 to find what auth object is being checked in VT02n for shipping point and I found it that V_LIKP_VST is by default not checked. I tried to changed that from NOT CHECKED to CHECKED but still the user TESTSA was able to allocate the deliveries from other state.

Your help is very much appreciated.

[Former Member]

Are you certain these test users do not have more authorisations for the objects you mention?

An authorisation trace whilst you are doing the test on VT02N will show exactly what SAP is looking for - all the authorisation checks carried out and the results of these, which will show which object and values are allowing this transaction to work.

Sometimes, regardless of the check indicators, the SAP program code in a transaction will only check what it has been set up to check. I've only needed to adjust check indicators for totally new authorisation objects or ones where the SAP delivered settings aren't correct.

ST01 for authorisation checks on the same application server where you are doing your testing should help to explain why your authorisations aren't behaving as you'd like. Your Basis team should be able to assist with the trace if you are not familiar with it.

[Former Member]

Thanks Craig but I did run ST01 for that user and it did not tell me what object is missing or in error.

[Former Member]

The test role ZTESTSA has 3 objects :

S_TCODE (Cross Apps AO)

TCD = VT02N

V_VTTK_SHT (Shipment Processing: Auth for shipment type)

ACT = 02, 04, 06

SHTYP = *

V_VTTK_TDS (Shipment Processing: Auth for Transportation planning point)

ACT = 02, 04, 06

TPLST = 1000

the only difference with ZTESTWA is the field TPLST in V_VTTK_TDS is equals to 2000.

User with only role ZTESTSA assigned was able to allocate deliveries for transportation plant 2000 which is for ZTESTWA.

Please advise what needs to be done. Thanks

[Former Member]

Pls make the object V_LIKP_VST as check maintained and add the object manually to the role and maintain the values and assign it to Users.

[Former Member]

Hi,

I think there is no authorization check for allocating deliveries for the shipment via VT02n. When you run VT02N and enter the shipment number, it does check whether that shipment no. belongs to the transportation planning point but when you start allocating outbound deliveries for that shipment, it does not check if that delivery is for that particular shipment.

Do you know of any workaround to resolve this issue? Thanks.

[Former Member]

This is not possible with Standard SAP.

Only the Creation or Change of a shipment can be restricted on shipping point.

The allocation of deliveries to a shipment can't.

If you want to make this possible custom changes should be made to include some extra authority checks when allocating deliveries.

[former_member248712]

I had the similar error, but there is an Authorization Switch in SPRO to turn it on, here in this case I did was for M_MSEG_LGO. SPRO Path... Materials Management->Inventory Management and Physical Inventory->Authorization Management-> Authorization Check for Storage Locations.

Try a similar check in SPRO before setting up the security and let us know if it worked.

AB

[Former Member]

Which one works? Custom code or SPRO? pls advise.

[Former Member]

both works. if u do not have abapers around you just go for the config.