Starting transactions when user has access to authorization objects only

[Former Member]

Hi Experts,

Is it a possibility that if a user has access only to an authorization object he could start any transaction.

I can understand that a user may have access to SU01d by default for him to change his password, but are there any other transaction he would be able to start?

Thanks,

CP

[Former Member]

If a transaction is started from the command line, then the Authorization Object S_TCODE Is checked for that. However, lets say, user has SE28 access, then user can run the program directly which SU01 calls and would not fail if user has all the required authorization.

One more example that struck me is SE80, from there you can run any program even if you don't have SE38 access and have the required authorizations to run a program.

Cheers !!

Zaheer

[Former Member]

Hi Zaheer,

You perhaps misunderstood me. What I wanted to say was that the Authorization object S_TCODE will not have any value.

But he may or may not have other authorization objects in the role assigned to him.

Will the user still be able to start any transaction?

Regards,

Chinmaya

[Former Member]

User will not be able to run any transaction codes if he doesn't have S_TCODE in his buffer.

EXCEPTION : However, in case you have maintained certain tcodes within the parameter "auth/tcodes_not_checked", then user will be able to run only these transaction codes only.

Cheers !!

Zaheer

[Former Member]

Hi Zaheer,

My next question would be how in that case would a user be able to change his password, because i think the change password screen is a variant transaction for SU01.

I have a role with only a * value for S_USER_GRP and no other value. ( That is no calue in S_TCODE) and even no other authorization object. but the user will still be able to start su01d. Are there any other set of transactions which this user could start?

Regards,

Chinmaya

[Former Member]

Chinmaya,

The screen / program for password reset is different from the initial screen doesn't check for SU01 or SU01D. The program for SU01 (SAPLSUU5) is different from the one you get when you connect to system (SAPMSYST), it is not a transactional variant screen of SU01.

And for the second part of your question, if user has S_USR_GRP with * and no other authorization object ( no value in S_TCODE for SU01D) then user WILL NOT BE ABLE to run SU01D, unless that is maintained in RZ10 parameter to exclude SU01D from authorization check.

Cheers !!

Zaheer

[Former Member]

Zaheer,

I think profile parameter auth/tcodes_not_checked is used for "Disables Tcode checking for SU53 & SU56 auth analysis" not for disabling check for S_TCODE.

Thanks,

Pravansu

[Former Member]

For some types of users (SYSTEM and SERVICE) it is important that they should not have any transaction code start authorizations (S_TCODE).

They use other entry points (RFC's or Services) which provide programming interfaces or (external) web services which "provide" the interface.

Sometimes it is usefull (or better than nothing) to create such an "all objects" role without any entry ponits, but there are some objects you should exclude as they are stronger than S_TCODE, S_RFC and S_SERVICE.

Cheers,

Julius