Role/Auths report

[Former Member]

What is the best way to create a report of all the authorization field values for each of our Roles to allow the business to scan and verify the existing values?

[jurjen_heeck]

I suspect table AGR_1251 technically contains the information you require, but formatting that to something the business can understand will be a daunting task.....

[Former Member]

Include the below mention tables in your report this tables will fulfill your requirements

usr21, usobt, agr_users, usobx, agr_1251

[jurjen_heeck]

> Include the below mention tables in your report this tables will fulfill your requirements

>

How and why? OP asked "all the authorization field values for each of our Roles "

> usr21

Has no relation to roles.

> usobt

Has no relation to the existing roles

> agr_users

Is about assignment, not role contents

> usobx

Has no relation to the existing roles

> agr_1251

Was already mentioned by me.

So please elaborate on the "fulfill your requirements".

[Former Member]

Jurjen

as usual your last answer is completely correct.

Question here is primiraly what does one try to achive. There is NO ENDUSER who will understand the outcome of any tabel in the secuerity area whitout a lot of explanation.

So the better way to go is ASK the business what they want to know about the restrictions in the system. EXAMPLE no one from company A should be able to see SD data in company B etc.

and then translate this into technical soplution and do your onw invesatigation in thables AGR_1251, AGR_1252 and AGR_users as you can prove the exmpale in a combination of these tables.

In general use AGR_* and USR* /UST* tabels to investigate the system for this kined of requestes.

Also be aware that it normally is the AUDIT department who are worried about access controls as mostly business does not want any resctictions to be applied! Claiming that they can not do their work if resctrictions are applied

[Former Member]

Agree with Auke, we have created a template (using AGR_125 and other tables providing list of tcodes and object description) rather translated them so they can understand the definitions and terms and it also helps a good documentation.

thanks

santosh kumar

[Former Member]

David,

Once you finalise the requirement from the business likewise what specific details they want and what format, you can develop the report in the BSP or WebDynpro and display as HTML or with some better format.

We have developed the BSP based reporting structure which is basically extracting all required data from the tables and display as webpage, This can also be interactive and you can drive the report by inputs.

However to achieve this you need to be very specific what you want to display as by simply extracting all auth fields and auth objects will be a performance issue, same time technical terms may not make sense from Business prospective.