Difference in Objects maintained in SU24 and inside the role.

[Former Member]

Hi Experts,

I noticed that for t.code F-67,default objects maintained in SU24 are different from the objects associated with same t.code in a role.

In SU24 only three objects are associated(F_BKPF_BUK,F_BKPF_KOA and S_TCODE), wherein a role there are eight objets maintained.(F_BKPF_BED,F_BKPF_BEK,F_BKPF_BES,F_BKPF_BLA,F_BKPF_BUK,F_BKPF_GSB,F_BKPF_KOA and F_FAGL_SEG)

Please clarify ! what is the reason of this difference.

Regards,

Mukesh

[Former Member]

Dear Mukesh,

The t-code F-67 when executed is inturn calling the t-code FBV1. And I observed that all the objects mentioned by you in your query are maintained for FBV1 in SU24.

Because of this reason when you assign the t-code F-67 in a role, it is associsted with the objects of both F-67 & FBV1 and you are getting more objects.

Regards,

[Former Member]

Thanks a lot Lakshmi,

Could you please assist me,for below points

1.What is the purpose behind the calling of multiple Tcodes thru a single T.code .I mean to say, suppose, i require a C.Code object to be associated with a T.code for doing that, why i am connecting it to C.Code object of some other T.codes.

2.If i assign a C.Code (let say 1000)thru object F_BKPF_BUKRS to a user,does it mean that,i don't need to assign that C.code to user again for access related to C.code 1000 in the accounting document area.Or is there anything like that, the C.Code access will be coded globally for that user for all C.code related access for FI, MM and SD.

3.Is there any T.code,from where i can associate a authorization object with a T.code.

Regards,

Mukesh

[Former Member]

Hi,

 1.What is the purpose behind the calling of multiple Tcodes thru a single T.code .I mean to say, suppose, i require a C.Code object to be associated with a T.code for doing that, why i am connecting it to C.Code object of some other T.codes.

Many tcodes are customized to limit the access / risk. The best example is with SM30. If an user want to maintain a table, you can create a custom transaction which skips the intial screen (user don't need to enter the table name) and allows the user to edit the right or only one table rather than many.

You can connect your custom authorization object to F-67, it will not affect FBV1. the settings from FBV1 can be overwritten with the entries in F-67. use transaction SE93 to see more details and customization in transaction F-67.

 2.If i assign a C.Code (let say 1000)thru object F_BKPF_BUKRS to a user,does it mean that,i don't need to assign that C.code to user again for access related to C.code 1000 in the accounting document area.Or is there anything like that, the C.Code access will be coded globally for that user for all C.code related access for FI, MM and SD.

Once you assign the authorization to a company code 1000 it means user has access to this company code across modules. This is subject to the transactions and thier authorization objects attached to them in other modules. Note that all the transactions doesn't perform authorization check for Company code.

 3.Is there any T.code,from where i can associate a authorization object with a T.code.

You can use SU24 itself.

Hope it clarifies your queries.

Regards,

Gowrinadh

[Former Member]

Gowri,

If i directly associate a standard authorization object to F-67 e.g. F_BKPF_GSB apart from defaults maintained in F-67(F_BKPF_BUK,F_BKPF_KOA and S_TCODE), is it possible?

Regards,

Mukesh

[Former Member]

Hi Mukesh,

Yes, it is possible to include F_BKPF_GSB for F-67. But this should be done at the user exits present in the program of F-67.

Regards,

[Former Member]

Hi Lakshmi.

Could i perform that without making any changes in the corrosponding program?Actually,my intention was to make it working thru editing some tables e.g USOB*,which have relation between T.code vs Authorization objects.Please tell me know if i can edit these table(s) for this purpose.

Regards,

Mukesh

[Former Member]

Dear Mukesh,

Changes in the program should be made. Only then the object will be checked for authorization during the run time of the t-code F-67.

Regards,

[Former Member]

Hi Lakshmi,

Many many thanks for your clarification on this topic!

Regards,

Mukesh

[Former Member]

Mukesh,

You are most welcome.

Regards,

[Former Member]

Hi,

Try assigning authorization object in SE93 for the specific transaction. I am not 100% sure as it helps.

Regards,

Gowrinadh

[Former Member]

Hello,

Both the transaction calls same program SAPLF040,

So when you check in role there are many object some are maintained for F-67 and some for FBV1.

Thanks,

Prasant K Paichha

[Former Member]

So if I create a custom tcode which too calls the same program SAPLF040, without maintaining SU24, you mean to say it will pull all the objects if I add this in a role?

[Former Member]

When you create a custom tcode you need to give a program name which will be used in the new tcode .

Regards,

Gowrinadh

[Former Member]

Gowrinadh, I was actually referencing about SU24 to the answer :-). It was more of finding something in an illogical assumption and(or) repeating something which had already been put forward!

[Former Member]

It was more of finding something in an illogical assumption and(or) repeating something which had already been put forward

Hi,

I didn't get you?

Regards,

Gowrinadh

[Former Member]

Gowri/ Lakshmi,

I believe now i am able to investigate more in these areas.

Thanks a lot

Mukesh