Hi Jurjen,
I understand that your specific question is answered, but wanted to add a few comments as you appear to be building a prototype for display all role. I have also built a few and there are some "gotchas" to be aware of and some usefull tricks. Although we flame these questions when they are asked in a stupid way, there is a real need "in the wild" for it, as the alternatives are worse (in my opinion).
First of all, SAP themselves abolished their own "display all" standard access in release 46C. I assume that one of the reasons for this was release dependency. Such a role would require a regeneration mechanism like SAP_NEW has, and that is not possible without a complete code scan and re-engineering of functionality each time (or some way to extract authorization fields from perfect documentation...).
The bugger is that ACTVT values (and the other "action" type of fields of other objects) on their own are dependent on other fields of the same object which interpret then differently.
For example, single testing a function module (actvt = 16 for object type FUGR of S_DEVELOP) in SE37 etc is different to single testing a program (actvt = 03 for object type PROG of S_DEVELOP) in SE38 which in turn is different to single testing a method in SE24 (if the class is public, then you can access it from anywhere). All of them are "execute" (click on F8)... but execute what?
Other objects only (consistently) offer execute as an ACTVT, and other field values will determine whether it is display or not. S_RFC is an obvious example, but S_C_FUNCT is another where you determine the "action" type of the execute activity by defining the program context for the call and in some cases even the function name which can be called from that program. But for a display role, you would most likely need the object for the role to work...
And then there is S_PROGRAM as well, and variants (which might later run under the contexts of users with more authority) and some obscure values which are not in TACTZ or other check tables / domain ranges which are in the coding somewhere.
As you already mentioned, it is a haunting task. But if you are trying it experimental purposes or for users who only have this role (e.g. auditors...), then I will be happy to share some of my prototypes with you for specific objects.
But I cannot share an entire role in good conscience (see above
Cheers,
Julius
