Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Alternative to PFCG?

Go to solution
Former Member

‎02-23-2009 5:53 PM

0 Kudos

Hi all,

I have a user who is an HR authorizer and wants to see the contents of roles for assignment to users. They used to be able to view the contents of profiles with ZTRAN_TO_PROFILES but now in 5.0 our new roles do not allow them to see that. I tried giving the person ZTRAN_TO_ROLES, however it's saying that they need PFCG to view the contents.

Does anyone know an alternative tcode to PFCG that will allow some kind of "display only" authorization for this user to view role contents?

I haven't found any so far and any help would be much appreciated.

Thanks!

1 ACCEPTED SOLUTION

Go to solution
Former Member

‎02-23-2009 6:16 PM

0 Kudos

If your custom Z-tcode is using parts of the PFCG coding, which is now performing a stricter check on S_TCODE, then this will typically be done using function module AUTHORITY_CHECK_TCODE in the application coding (search the forum for more infos about the FM and what it does).

A possible solution is to go to transaction SE97, and there define for PFCG that your Z-tcode is "coupled" to it and the check may be successfull (flag "no check").

This way the user can indirectly use the PFCG coding only if their calling context is sy-tcode = 'ZTRAN_TO_PROFILES' but they cannot start nor call transaction PFCG directly.

Cheers,

Julius

ps: Why don't you use one of the SUIM reports from a z_transaction with a variant, or a selection screen of your own which submits the SUIM report with the parameters you want?

Edited by: Julius Bussche on Feb 23, 2009 7:20 PM

2 REPLIES 2

Go to solution
Former Member

‎02-23-2009 6:09 PM

0 Kudos

> 

> Hi all,
> 
> I have a user who is an HR authorizer and wants to see the contents of roles for assignment to users.  They used to be able to view the contents of profiles with ZTRAN_TO_PROFILES but now in 5.0 our new roles do not allow them to see that.  I tried giving the person ZTRAN_TO_ROLES, however it's saying that they need PFCG to view the contents.
> 
> Does anyone know an alternative tcode to PFCG that will allow some kind of "display only" authorization for this user to view role contents?  
> 
> I haven't found any so far and any help would be much appreciated.
> 
> Thanks!

Check the following table in SE16.

AGR_USERS

AGR_1251

Go to solution
Former Member

‎02-23-2009 6:16 PM

0 Kudos

If your custom Z-tcode is using parts of the PFCG coding, which is now performing a stricter check on S_TCODE, then this will typically be done using function module AUTHORITY_CHECK_TCODE in the application coding (search the forum for more infos about the FM and what it does).

A possible solution is to go to transaction SE97, and there define for PFCG that your Z-tcode is "coupled" to it and the check may be successfull (flag "no check").

This way the user can indirectly use the PFCG coding only if their calling context is sy-tcode = 'ZTRAN_TO_PROFILES' but they cannot start nor call transaction PFCG directly.

Cheers,

Julius

ps: Why don't you use one of the SUIM reports from a z_transaction with a variant, or a selection screen of your own which submits the SUIM report with the parameters you want?

Edited by: Julius Bussche on Feb 23, 2009 7:20 PM