destrict access to SQ01

[Former Member]

Hello Gurus ,

I would like some help with restraining access to users that have Tx SQ01.

I know there are two ways to do this :

1. With authorization objects

2. With user groups in SQ03.

Allthough i created user groups , in SQ01 i have still the option to go over

SQ01> Edit>Other user groups and choose a different user group. This is probably because i have more rights . How can i be sure , or better deactivate this option to a user that is using SQ01 so he can execute, create Queries only within a limited SAP area with the infosets that are assigned to his user group ?

Regards,

David (SAP Basis)

[Former Member]

Hi David,

Check for the values of the auth.obj S_QUERY in the user's profile.

Remove the activity 23 from the auth.obj S_QUERY and then chk if this is restricting the user to create Queries only within a limited SAP area with the infosets that are assigned to his user group.

Thanks,

Saby..

[Former Member]

Thank you Saby ,

i did a test with removing the activity 23 and it worked for a user only with couple of roles . If a user has more roles -->more authorization , that he can access infosets that are not in his user group .

Is there another way to delimit the infosets with an additional auth.object in the role ?

Alternative solution would be a Firefighter with only the role thats needed for SQ01.

regards,

david

[jurjen_heeck]

> If a user has more roles -->more authorization , that he can access infosets that are not in his user group .

> Is there another way to delimit the infosets with an additional auth.object in the role ?

This is expected behaviour. SAP security is about allowing things, not denying. You'll have to go through your other roles and take out the unwanted authorizations to solve your issue. I'm quite sure there are no shortcuts.

[Former Member]

Like Jurjen said, Securtiy SAP is not about denying but granting access carefully.

Many user perform daily reporting combining different criteria and queries are to ease their their life

You can give access only to SQ01 and deactivate S_QUERY.

Then assign the users to to particular query user groups using SQ03 so that they may have access to execute queries which they actually need.

When the users execute SQ01, they can see the queries for which they are authorized.

This is a two forked advantage.You prohibit change access in SQ01 at the same granting access to queries which the user needs for reporting on display.

And if you are speaking of production environments, then there is no danger of user creating a query via SQ01 as the prd client is normally closed for changes!

Regards

Deepa

[former_member248712]

 This is probably because i have more rights . 

You may create a test user and assign limited roles just for testing.

AB