How to make transactions and roles appear in AGR_TCODES

[sreekanth_sunkara]

hi all,

I created some roles and when i am trying to pull a report in AGR_TCODES, i am not getting those roles in the report, but i am able to see the other roles from where i derived these new roles.

can any one help me on this and tell me how to make this appear in AGR_TCODES

I tried different ways like using AGR_TEXTS or AGR_1016 and UST12 but no use. i am able to see either transactions or roles but not both in same report

thanks,

Edited by: sunkara on Aug 29, 2008 10:51 PM

[Former Member]

Which report? (post your code)

Writing your own report using (often incorrect) SAP tables and join then while interpreting single fields of them is notoriously "buggy" - even more so than transaction SUIM

(depending on your release and SP level and the intactness of your roles)

Cheers,

Julius

[sreekanth_sunkara]

Hi ok i need to know the list of all roles in the system and the tcodes associated with them

Thanks,

Edited by: sunkara on Aug 29, 2008 11:21 PM

[jurjen_heeck]

Either go to table AGR_1251 and filter for object S_TCODE or go to the report for roles by authorization values in SUIM and enter object S_TCODE.

AGR_TCODES will only show menu entries, not the real authorizations.

[Former Member]

Which report are (or were) you using? Roles by Complex Selection Criteria? That or an F4 in PFCG should answer your first question.

THe second one depends on whether the tcodes are all in the menu (usually unlikely...and anyway irrelevant for access control of a role which matches a business function (as opposed to a simple task).

May I ask why you want the second information? If you have lost the relationship between the authorizations and the tcodes, then finding the tcodes is seldom the correct approach...

Just guessing, please give us more infos.

Cheers,

Julius

[Former Member]

Just to add, i remember something like

AGR_TCODES will show tcodes for parent role and not for derived roles.

Regards,

Zaheer

[jurjen_heeck]

> Just to add, i remember something like

> AGR_TCODES will show tcodes for parent role and not for derived roles.

That is consistent with the original posters' findings. Looks logical to me.

[Former Member]

AGR_HIER probably will give you list of menu contents of all roles irrespective of master / derived.

Regards,

Zaheer

[jurjen_heeck]

> AGR_HIER probably will give you list of menu contents of all roles irrespective of master / derived.

Especially in combination with AGR_HIERT which holds all texts fro the menu-items.

[Former Member]

Ya Jurjen, that's also a good option

[sreekanth_sunkara]

Thanks, AGR_1251 & then searching by S_TCODE worked, but still doubt in mind

what did i do wrong so that my roles are not in table AGR_TCODES or what should i follow when i create a role so that they can be in AGR_TCODES table

thanks,

Sunkara

[jurjen_heeck]

> what should i follow when i create a role so that they can be in AGR_TCODES table

The first step is to enter all transactions via the menu tab in PFCG. Unfortunately some transactions will bring in other S_TCODE values along with other authorization proposals so if you really want AGR_TCODES to be in sync with the S_TCODE values in AGR_1251 you have to keep checking them against each other and add al transactions that are 'pulled in' by other transactions to the menu as well.

Personally I choose to regard AGR_TCODES as unreliable and always use the filtered list from AGR_1251. This is in fact something I teach everyone I train in SAP authorizations.

[sreekanth_sunkara]

Ok thanks for giving me that suggesstion, but my question is

suppose if i create a new role and add transctions in menu tab will it appear if i pull AGR_TCODES or do i need to do any thing special in order to make them appear in report AGR_TCODES

because we created some new roles deriving from the existing parent role and then when we run AGR_TCODES it is showing all the other child roles except the one that we created or derived from parent roles.

thanks,

Sreekanth S

[jurjen_heeck]

> suppose if i create a new role and add transctions in menu tab will it appear if i pull AGR_TCODES or do i need to do any thing special in order to make them appear in report AGR_TCODES

First, let's get the terminology right: AGR_TCODES is a table, not a report. You can query such a table (by means of a report or with SAPquery or the data browser (SE16)) to view it's contents.

> because we created some new roles deriving from the existing parent role and then when we run AGR_TCODES it is showing all the other child roles except the one that we created or derived from parent roles.

See above about "running" AGR_TCODES.

About the roles you can see when reporting on the table AGR_TCODES, are you sure they're derived?

If you look in table AGR_DEFINE, do the same roles you see in AGR_TCODES all have an entry in the field PARENT_AGR?

I ask this because I've tried to reproduce this but were unable to do so. If I derive a role its menu transactions do not appear in AGR_TCODES, just like Zaheer told in

About keeping in sync as I mentioned earlier, amongst the transactions I used to create the demo was SUIM, now that one is a perfect example of the menu becoming out of sync with the real authorizations. The menu in my (parent) testrole holds 5 entries and querying AGR_1251 filtered on object S_TCODE returns 60 rows......

Bottom line: I think there's no use in trying to force tables in synchronisation which were not designed to be synchronized. Best concentrate on finding the most reliable source of information and I'd stick with AGR_1251.

Jurjen

(I tried with MiniSAP Netweaver 2004s, SP12)

[sreekanth_sunkara]

once again thanks a lot for all who helped me in this

thanks,

Sunkara,