Maintainig su24 for the tx se16 ..

[Former Member]

Hello All,

As per su24 in our SANDBOX system for transaction SE16 , the auth object maintained is S_TABU_DIS.Also for this object the Check Indiactor is "Check" and Proposal is YS.

But when I create a test role with se16 tx in it , only S_TCODE shows up .

S_TABU_DIS does not come up automatically when i generate profile.

I also tried Expert mode of pfcg.But no result.

Is there any system specific setting to be maintained ?

Regards,

Ajit

[Former Member]

Hi Ajit,

In SU24 the S_TABU_DIS should be check/maintained and proposal should be Ys.

Regards,

Sneha

[Former Member]

Hi Sneha,

Its already "Check" and Proposal is maintained as YS (I already mentioned it!! )

[Former Member]

hi Ajit,

Sorry fot not reading ur question clearly .Have u checked in SE93 tcode , whether authorization check is maintained for S_TABU_DIS authorization object. I just checked in system it is default settings for SE16 tcode with ACTVT 03 in S_TABU_DIS authorization object.

Regards,

Sneha

[l_borsboom]

Hi Anjit,

The 'Check & Maintain'-status is different from the 'Check'-status in SU24. Only with the status Check & Maintain, the proposal values will be copied in PFCG.

Kind regards,

Lodewijk

[Bernhard_SAP]

Hi Lodewijk,

as of release 7.00 SU24 is different. The flags are devided into the check flag and the Proposal flag. So as of 7.00 there is no check/maintain flag anymore...

b.rgds,

Bernhard

[sdipanjan]

Hi,

As per your query, it is evident that you are in ECC environment. Though you have already confirmed, still I would like to repeat the Object status:

Object: S_TABU_DIS

Check Indicator: Check

Proposal: YS

If these are already correct, then please check the traffic signal at left side of row of Object. It should be green. There is no other way to get the Object in profile generator except of Check (together with Proposed value = Yes) in SU24. SE93 is not meant for this. So, there is no point of thinking of SE93 for this particular issue.

(Also you may check whether S_TABU_DIS is already present in the role in Inactive status).

Regards,

Dipanjan

[Former Member]

> (Also you may check whether S_TABU_DIS is already present in the role in Inactive status).

I place my bets on Dipanjan being correct.

Cheers,

Julius

[Former Member]

Starting SAP Transactions

When a user starts a transaction, the system performs the following checks:

· The system checks in table TSTC whether the transaction code is valid and whether the system administrator has locked the transaction.

· The system then checks whether the user has authorization to start the transaction.

The SAP system performs the authorization checks every time a user starts a transaction from the menu or by entering a command. Indirectly called transactions are not included in this authorization check. For more complex transactions, which call other transactions, there are additional authorization checks.

¡ The authorization object S_TCODE (transaction start) contains the field TCD (transaction code). The user must have an authorization with a value for the selected transaction code.

¡ If an additional authorization is entered using transaction SE93 for the transaction to be started, the user also requires the suitable defined authorization object (TSTA, table TSTCA).

If you create a transaction in transaction SE93, you can assign an additional authorization to this transaction. This is useful, if you want to be able to protect a transaction with a separate authorization. If this is not the case, you should consider using other methods to protect the transaction (such as AUTHORITY-CHECK at program level).

· The system checks whether the transaction code is assigned an authorization object. If so, a check is made that the user has authorization for this authorization object.

The check is not performed in the following cases:

You have deactivated the check of the authorization objects for the transaction (with transaction SU24) using check indicators, that is, you have removed an authorization object entered using transaction SE93. You cannot deactivate the check for objects from the SAP NetWeaver and HR areas.

This can be useful, as a large number of authorization objects are often checked when transactions are executed, since the transaction calls other work areas in the background. In order for these checks to be executed successfully, the user in question must have the appropriate authorizations. This results in some users having more authorization than they strictly need. It also leads to an increased maintenance workload. You can therefore deactivate authorization checks of this type in a targeted manner using transaction SU24.

¡ You have globally deactivated authorization objects for all transactions with transaction SU24 or transaction SU25.

¡ So that the entries that you have made with transactions SU24 and SU25 become effective, you must set the profile parameter AUTH/NO_CHECK_IN_SOME_CASES to u201CYu201D (using transaction RZ10).

All of the above checks must be successful so that the user can start the transaction. Otherwise, the transaction is not called and the system displays an appropriate message.

I think it is redandancy you have to remove the object from transaction with SE93 or filled the value there.

In this case you will have two objects. One in the role (su24) and other one in tranzaction (se93).

[Former Member]

>

> some stuff

Hi,

If you are going to copy and paste material please just attach the link that you are copying from as it will make it much easier to read

[Former Member]

gkrivdyuk,

What was the question again? :-0

Edited by: John Navarro on Dec 22, 2009 11:40 PM

[Former Member]

https://cw.sdn.sap.com/cw/docs/DOC-25427?decorator=print