S_RFC Auth Object

[Former Member]

My task is to assign the SCU0 transaction to an existing role. I added the transaction and added the S_RFC Auth object. Well, I can get into the SCU0 transaction but when I do a remote comparison I get a termination from the comparison client. I ran an ST01 trace on the comparison client and it's looking for an RFC_NAME (SCT2) that is not included in the S_RFC Auth Object I added. In PFCG I am unable to change the auth object so I'm not sure what to do to fix it. Even in change mode it's not letting me adjust the object. Any ideas? Thanks!

[Former Member]

HI

Try by adding S_RFCACL Authorization object also

[Former Member]

The more elegant way to solve this is by looking in ST22 or SM20N on the target system and finding the name of the function module which failed.

Then either add that function module to the menu of the remote user's role, or identify an existing menu item which should alway pull the SCT2 value for the function group into the authorizations, then add it in SU24 and do a "read old merge new" in expert mode.

In addition to S_SERVICE and S_TCODE, S_RFC cannot be maintained in PFCG if it came from the menu. I.e. from SU24.

Cheers,

Julius

[Former Member]

Please add a manual instance of S_RFC and then add the auth group SCT2. Hope this will solve the issue.

[Former Member]

Yes, that is still possible but does not make it any less ugly.

The main bugger is that you loose the relationship with the menu item and the advantages of SU24. Some folks try to compensate for this by renaming the authorization instance with a reference to the change request, but you can only do that once and if you ever do a merge again your renamed standard and maintained authorizations will wipe out the changed name of the authorization.

Like with S_TCODE, I would go for the menu option here. I do this regularly and maintain some authorization data in SU24 for the function modules as well. It makes the roles much easier to understand and maintain - you just need to put ina bit of effort and resist the tempation of bad habits...

Cheers,

Julius

[Former Member]

Hi Julius,

I totally agree with you. I always try to avoid addition of any manual instance of objects forcefully to any roles but how can we avoid a situatuion where client want a restrcition in just one role and not in multiple roles. For example: if we need to restrict an auth group to a just one role then how can we do it through iSU24 menthod. As per my understanding if we add rfc auth groups in SU24 table then all the roles having S_RFC object if "re-merged" wil have access to the new auth group.

I might be wrong on this. Hence kindly correct me. Thanks for all your advice, this will help me a lot.

[Former Member]

Hi Akshay,

You assign the value to a field of an object and associate it with a "proposal" flag in SU24 to a specific transaction, or another suitable menu item.

Only adding that one menu item to the menu of a role will pull the values into the authorizations - so you need to choose your SU24 config carefully as well as how you build the menu.

But this is irrelevant in this case, because you can also add the function module itself as an authorization default to the menu - this will pull in a standard (display only) value for S_RFC with the FUGR name already in it.

This way you can start function modules in that function group, but not necessary complete the function call successfully because there might be more checks within the FM.

If you enter all that which you had to work out in SU24, then you only need to do it once.

Cheers,

Julius

[Former Member]

Hi Julius,

This question of mine seems to be a veru stupid one, but please bear with it . How do you add a function module to menu tab till now I have only added Tcoded in the menu tab. Please let me know if this is already answered in SDN forums?

[Former Member]

In PFCG on the Menu Tab --> Authorization Defaults --> Function Module.

Note that some function modules do not have their long text names translated to other languages, so if it is blank then use the FM name. I anyway name them all after the FM.

Cheers,

Julius