TCDCOUPLES Issue

[Former Member]

Hi ,

I am facing a typical problem when dealing with F-03 transaction code, When a user executing transaction code F-03 its internally calling another transaction code FB1S , where as FB1S is not checking at object level ( I switched on trace and I identify this ) ( which means user does not have authorization for FB1S directly but still user is able to run F-03 successfully ) .

The entries are very well there in TCDCOUPLES table ( SE97 ) . as of my knowledge and understanding if we make an entry in the TCDCOUPLES tables, it will go and check at the object level when running transaction code, but that is not happening at my system, I have checked out many options (like service market place for SAP notes, and took ABAPer help, Modified the settings at SE97and run the traces several times etc ).

What I want now is if a person run transaction code F-03, it should go and check the authorization objects of FB1S also , and if I donu2019t provide FB1S objects for the user at his role, he should not get authorization for that T-Code. So how to achieve this .

Related terms for your reference: OB52, F_BKPF_BUP, TCDCOUPLES, SE97, F-03, FB1S, My sap version is ECC5

Thanks & Regards

Umashankar T

SAP Security

[Former Member]

Possibly you are a bit behind on SP levels?

There are cases [See SAP Note 515130|https://service.sap.com/sap/support/notes/515130] where SE97 did not work, and for many of the xxxN (Easy Access) transactions it does not work.

Bascially, the design of the transaction being called is such that the user would be able to access it anyway... so it is checked (sy-tcode = the "core" transaction").

What are your tcdcouples values for F-03 and FB1S?

Also check whether your OB52 current settings and the user's authorizations permit the transaction to be called. Sometimes the message stating that "You are not authorized to use transaction xxxx" should not be mistaken for "You are not authorized to start transaction xxxx"...

My suggestion: Do an ST01 trace. Double-click the authorization object where it fails. Click on the "Jump to source code" button and take a look at what is going in there...

Cheers,

Julius

[Former Member]

Hi,

Could you check the status of check indicators for FB1S after executing SE97 for F-03? You need set it to P (check) to include authorization checks for FB1S when using F-03 and save. You will need to transport the changes if you need the settings to be reflected throughout the landscape.

If you are checking the contents of table TCDCOUPLES, you will see there are X marks under Column Check ID for the tcodes for which separate authorization checks are made.

Please let me know if you face any problem.

[Former Member]

First of all let me thank both of you for your help , Ananya Dasgupta2 and Julius Bussche .

Yes Dasgupta , what you are saying is correct , I have already done the same ( I set check indicator ( Check ) in the TCDCOUPLES table for F-03 ) , and switched on trace but surprisingly I am able to run transaction code F-03 with out any restriction ( In trace I can see FB1S being called ) ,

Could one among you, can tell me , what else could be the problem.

Thanks & Regards

Umashankar

[former_member701183]

Hi,

Other than se97 and entry in tcdcouples table I dont see any reason the other transaction FB1S is called. If this transaction is not needed then the entry should be restricted in the tcdcouples table. Also check in su24 whether FB1S is CM and included against F-03. Please check and let us know if any issue.

Regards

Aveek

[Former Member]

Hi,

What was the trace result ? Was it showing successful check against the required authorization objects, i.e RC= 0 ?

If it was successful, then user should get this authorization through some roles/profiles.. Also it may also happen that trace result is showing values with RC= 4 or RC=12 for the some objects.. but still the job was executed without any error.. In these cases, the object may not be required for the particular activity.

Also you can check authorization check in SU24 for more details.

Regards,

Sandip.

Edited by: Sandip Maiti on Jul 7, 2009 4:40 PM