authorization object: 'star' and 'all of the value'

[Former Member]

hello all

i had got a problem.

my company code is 1100,and there are 7 plants belong to it.

i create a authorization object 'AAA'. I set the company code 1100,and i chose all of the 7 plants.

but when i run Tcd 's_alr_87011963'--asset balances,i got messages that i have no authorization on company code 1100.

i can run this tcd,the message appear in the output result.

then i changed that plant to '*', the problem was resolved.

and today i change this '*' to 7 values,it's also ok.

are there any different between 'star' and 'all of the value'?

and anyone get any idea about my problem?

thanks.

best regard. zokii

[Former Member]

Dear Zokii,

As per my understanding, there is no difference between '*' and all values which you entered for plants.

Both works same.

And your problem may be because of not generating the profile or user comparison .

This is possible when you tried it again today , user is compared and you get the authorisation.

Regards,

Varun

[Bernhard_SAP]

Hi Varun,

it is not the same in all cases. If the coding asks explicitely for '', it has to be assigned. All single values are not sufficient. Good example is the hidden check for the display of the buttons 'Other menu','Assign users',... in session manager. You need full auth for the authorization values checked ('' explicitely').

b.rgds, Bernhard

[jurjen_heeck]

> Good example is the hidden check for the display of the buttons 'Other menu','Assign users',... in session manager. You need full auth for the authorization values checked ('*' explicitely').

Another one is the authority to regenerate SAP_ALL, I believe that needs a * in S_USER_AGR.

[Former Member]

Hi,

You can do the ST01 authorization trace analysis to know the required authorizations. Then role can be modified accordingly.

Regards,

Sandip.

[fredrik_borlie]

In addition to the very good responses I can only add the futuristic approach.

Cause if you add * instead of mark all values, every new value you activate is always granted.

In my humble opinion you should always try to use the select all activities, cause if you decide to expand some values, the roles have to be analyzed and changed accordingly.

If you only select what you need, you dont have to modify any roles that get too much access. Only create/adjust the roles that should allow the access.

/fredrik

[jurjen_heeck]

> In my humble opinion

Don't be humble, you've just proven to understand what authorizations are about and it's not about being lazy now and paying the price in the future! Very good point indeed.

Luckily OP wasn't considering to be lazy but frowned upon unexpected system behaviour.