08-05-2009 10:26 AM
Hello All,
We, in our project trying to trace out various transaction codes assigned to each of roles.
I have an issue tracing an transaction code FB60. When i searched in suim for transaction codes within the role, I could see FB60 listing in the results.
But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.
what went wrong here? Now i want to remove the transaction code from the role so that next time when i use suim it wont be listed in the results.
Kindly advice.
Regards,
Brahmeshwar Poloju
08-05-2009 11:29 AM
> I have an issue tracing an transaction code FB60. When i searched in suim for transaction codes within the role, I could see FB60 listing in the results.
>
> But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.
>
> what went wrong here?
Actually nothing.
FB60 may well be in the field value for S_TCODE in the role's profile.
If this S_TCODE object was added menually you can take it out there. If not, you'll have to go into transatcion SU24 and go through the proposal values for all transactions which are in the role menu and see if you can find a proposal for S_TCODE containing FB60.
Edit this and afterwards go into your role again and re-read the authorization profile. It should now be gone.
08-05-2009 7:43 PM
Follow the procedures as suggested above. In addition with it, the things were happened as the transaction was not added from menu in these roles. That's why it was not showing there..
Always add transaction from the menu. This is the standard procedures. By this way, this kind of problems can be avoided in future.
Regards,
Sandip.
08-05-2009 7:55 PM
> Follow the procedures as suggested above.
Thank you
> Always add transaction from the menu. This is the standard procedures. By this way, this kind of problems can be avoided in future.
This isn't always true. Some transactions will bring in additional S_TCODE values when added to the menu. The content of the menu and the content of S_TCODE can differ, even when you only add transactions through the role menu.
08-06-2009 7:10 AM
Hi,
But when i go to role through pfcg and see in the menu tab i cannot find the transaction code there.
Here the problem is that you won't get appropriate results by chking throught Pfcg-->Menu tab.
Always go by Suim >Role>Authorization object -->S_Tcode. It wil dispaly all the Roles and tcodes Exits in that.
Now i want to remove the transaction code from the role so that next time when i use suim it wont be listed in the results
.
1. Goto SUIM and select USER node, then select USERS BY COMPLEX SELECTION CRITERIA node then execute BY TRANSACTION AUTHORIZATION report then give the Tran. code and it will return you the number of users having that trans with relevatn details.
Follows these steps :-
- Go to SUIM .
- Choose Roles --> By Transaction assignment.
- Enter Transaction : "FB60"
- Choose execute.
- Double click on a role in which you want to remove "FB60" authorisation.
- Click on pen mark to change into change mode.
- Go to tab "Authorization"
- Choose change authorization data.
- Choose Utilities --> Technical names on .
- Choose > cross application authorization objects>
- Expand the selection for Object "s_tcode" , under the corresponding profile look the values maintained for "TCD" and remove value "FB60" from the list to eliminate the authorization.
- Don't forget to regenerate profiles.
Thanks
Ramakrishna.
08-06-2009 7:23 AM
> - Expand the selection for Object "s_tcode" , under the corresponding profile look the values maintained for "TCD" and remove value "FB60" from the list to eliminate the authorization.
And what should he do if this object is read-only (standard)?
08-06-2009 8:56 AM
Hi All,
Thanks for your help.
I could have very well deleted the unwanted tcode directly from S_TCODE, if it had existed there. I could see the tcode(FB60) neither in menu tab nor in S_TCODE. Somehow the suim results is listing FB60 for my role.
But what i observed was the profile of the roles is having few of the auth objects listed under this tcode. I checked su24 and the objects with proposal YES are present in the profile.
Is problem because of this? How should i proceed now?
Regards,
Brahmeshwar Poloju.
08-06-2009 9:07 AM
I suggest you go to table AGR_1251 (tr SE16), select your role and the object S_TCODE and post the results here so we can have a look at its contents.
08-06-2009 9:22 AM
HERE IS THE OUTPUT.
OBJECT AUTH VARIANT FIELD LOW HIGH
S_TCODE T-DC84003900 TCD SCPE*
S_TCODE T-DC84003900 TCD SDD1* SE03
S_TCODE T-DC84003900 TCD SE07 SE16N
S_TCODE T-DC84003900 TCD SE17 SECQ*
S_TCODE T-DC84003900 TCD SEEF* SI24_12
S_TCODE T-DC84003900 TCD SI2414 SIBU
S_TCODE T-DC84003900 TCD SIC_* SLAT
S_TCODE T-DC84003900 TCD SLG0 SLIB_*
S_TCODE T-DC84003900 TCD SLIN SLXT
S_TCODE T-DC84003900 TCD SM30
S_TCODE T-DC84003900 TCD SM31 SM37
S_TCODE T-DC84003900 TCD SM50
S_TCODE T-DC84003900 TCD SM51
S_TCODE T-DC84003900 TCD SMAR* SMEZ
S_TCODE T-DC84003900 TCD SMTH* SNLS
S_TCODE T-DC84003900 TCD SNRO SO99
S_TCODE T-DC84003900 TCD SOACARRY* SOTR*
S_TCODE T-DC84003900 TCD SP02
S_TCODE T-DC84003900 TCD SCUS* SDCA*
S_TCODE T-DC84003900 TCD /* DA_*
S_TCODE T-DC84003900 TCD DC* PFCF*
S_TCODE T-DC84003900 TCD PFD* RYZ*
S_TCODE T-DC84003900 TCD RZZ* SAIM*
S_TCODE T-DC84003900 TCD SAIO* SAK*
S_TCODE T-DC84003900 TCD SAM* SAPTE*
S_TCODE T-DC84003900 TCD SARJZ* SARTN*
S_TCODE T-DC84003900 TCD SASAPCATT SBEA
S_TCODE T-DC84003900 TCD SBI* SC2_*
S_TCODE T-DC84003900 TCD SCA* SCBZ*
S_TCODE T-DC84003900 TCD SCDO SCI*
S_TCODE T-DC84003900 TCD SCTS* SCU3
S_TCODE T-DC84003900 TCD SWF_TR* SYNT
S_TCODE T-DC84003900 TCD SZG* TRBS
S_TCODE T-DC84003900 TCD TRCM* UR_M*
S_TCODE T-DC84003900 TCD USRM* _Z*
S_TCODE T-DC84003900 TCD SWF_CN* SWF_RE
S_TCODE T-DC84003900 TCD SPEC* SPERS*
S_TCODE T-DC84003900 TCD SPP* SPROJE
S_TCODE T-DC84003900 TCD SQ00 SRT*
S_TCODE T-DC84003900 TCD SSC SSDZ*
S_TCODE T-DC84003900 TCD SST0 ST05*
S_TCODE T-DC84003900 TCD ST14 ST62
S_TCODE T-DC84003900 TCD STCU STKZ*
S_TCODE T-DC84003900 TCD SV* SWF_BA
S_TCODE T-DC84003900 TCD SURAD SURVEY
S_TCODE T-DC84003900 TCD SU50 SU52
S_TCODE T-DC84003900 TCD SU3
S_TCODE T-DC84003900 TCD SU2
S_TCODE T-DC84003900 TCD SU0
S_TCODE T-DC84003900 TCD STS* STYLE*
Regards
08-06-2009 9:27 AM
OBJECT AUTH VARIANT FIELD LOW HIGH MODIFIED
S_TCODE T-DC84003900 TCD SCPE* U
S_TCODE T-DC84003900 TCD SDD1* SE03 U
S_TCODE T-DC84003900 TCD SE07 SE16N U
S_TCODE T-DC84003900 TCD SE17 SECQ* U
S_TCODE T-DC84003900 TCD SEEF* SI24_12 U
S_TCODE T-DC84003900 TCD SI2414 SIBU U
S_TCODE T-DC84003900 TCD SIC_* SLAT U
S_TCODE T-DC84003900 TCD SLG0 SLIB_* U
S_TCODE T-DC84003900 TCD SLIN SLXT U
S_TCODE T-DC84003900 TCD SM30 U
S_TCODE T-DC84003900 TCD SM31 SM37 U
S_TCODE T-DC84003900 TCD SM50 U
S_TCODE T-DC84003900 TCD SM51 U
S_TCODE T-DC84003900 TCD SMAR* SMEZ U
S_TCODE T-DC84003900 TCD SMTH* SNLS U
S_TCODE T-DC84003900 TCD SNRO SO99 U
S_TCODE T-DC84003900 TCD SOACARRY* SOTR* U
S_TCODE T-DC84003900 TCD SP02 U
S_TCODE T-DC84003900 TCD SCUS* SDCA* U
S_TCODE T-DC84003900 TCD /* DA_* U
S_TCODE T-DC84003900 TCD DC* PFCF* U
S_TCODE T-DC84003900 TCD PFD* RYZ* U
S_TCODE T-DC84003900 TCD RZZ* SAIM* U
S_TCODE T-DC84003900 TCD SAIO* SAK* U
S_TCODE T-DC84003900 TCD SAM* SAPTE* U
S_TCODE T-DC84003900 TCD SARJZ* SARTN* U
S_TCODE T-DC84003900 TCD SASAPCATT SBEA U
S_TCODE T-DC84003900 TCD SBI* SC2_* U
S_TCODE T-DC84003900 TCD SCA* SCBZ* U
S_TCODE T-DC84003900 TCD SCDO SCI* U
S_TCODE T-DC84003900 TCD SCTS* SCU3 U
S_TCODE T-DC84003900 TCD SWF_TR* SYNT U
S_TCODE T-DC84003900 TCD SZG* TRBS U
S_TCODE T-DC84003900 TCD TRCM* UR_M* U
S_TCODE T-DC84003900 TCD USRM* _Z* U
S_TCODE T-DC84003900 TCD SWF_CN* SWF_RE* U
S_TCODE T-DC84003900 TCD SPEC* SPERS* U
S_TCODE T-DC84003900 TCD SPP* SPROJECT U
S_TCODE T-DC84003900 TCD SQ00 SRT* U
S_TCODE T-DC84003900 TCD SSC SSDZ* U
S_TCODE T-DC84003900 TCD SST0 ST05* U
S_TCODE T-DC84003900 TCD ST14 ST62 U
S_TCODE T-DC84003900 TCD STCU STKZ* U
S_TCODE T-DC84003900 TCD SV* SWF_BAM* U
S_TCODE T-DC84003900 TCD SURAD SURVEY* U
S_TCODE T-DC84003900 TCD SU50 SU52 U
S_TCODE T-DC84003900 TCD SU3 U
S_TCODE T-DC84003900 TCD SU2 U
S_TCODE T-DC84003900 TCD SU0 U
S_TCODE T-DC84003900 TCD STS* STYLE* U
08-06-2009 9:43 AM
This is the range you need to modify:
> S_TCODE T-DC84003900 TCD DC* PFCF* U
FB60 lies within the range DC* - PFCF* so you'll have to split it into two lines to exclude FB60:
S_TCODE T-DC84003900 TCD DC* FB59 U
S_TCODE T-DC84003900 TCD FB61 PFCF* U
Having said that, roles with S_TCODE ranges like this one are usually the result of bad design and implementation. The huge, and probabely growing, number of ranges proves that this role needs a lot of effort to keep it working......
This one will keep haunting you.
08-06-2009 10:19 AM
>
>
> Having said that, roles with S_TCODE ranges like this one are usually the result of bad design and implementation. The huge, and probabely growing, number of ranges proves that this role needs a lot of effort to keep it working......
>
> This one will keep haunting you.
Agreed, removal of FB60 will do little compared to what that role can likely do (or contribute towards).
08-06-2009 11:04 AM
08-06-2009 11:06 AM
> Thanks Heeck for your analysis
That's my last name, but you're welcome
Jurjen