disable merge of authority objects

[Former Member]

Hi,

I connect an authority objekt to sevral Transaktions by SU24. When a Role gets this Transaktions by inserting them to the menu the objects were merged. But I don´t want this.

what can I do to disabel this function?

Thank you in advance and Greets

Volker Schäfer

[Former Member]

What did you maintain in SU24? Are you deleting the authorizations each time? (not a good idea...)

There is a difference between the check indicator ("Yes") and the default values proposed ("Proposal" + values).

Probably you only want to document the transaction's capability with a "check = yes" indicator and not have those values proposed each time (previously known as "Check/Maintain") as default values.

Cheers,

Julius

[Former Member]

I take Proposal + value. I fill one value in this objekt for every Transaktion in SU24. And I want that i can fill other values in pfcg for every Transaktion seperate. But I don´t want to copy the objekts in PFCG.

[sdipanjan]

Would like to know the purpose for which you thought about this? Do you want to see each separate Object Instances for each proposal of the corresponding TCode (by clicking on the mountain icon).

1. If yes, then you can go for the design of roles based on Menu role-Authorization role.

2. Another way would be to enter the Authorization data in the existing scenario with "Read Old status" mode and then manually add the Object Proposals manually for the newly added TCode by checking USOBT (SU22) for that TCode.

However, these are all nothing but making simple things complex intentionally. Even if Prof generator is going to Merge objects, there is way out to find out the Separate Value proposal from Customer Table for a specific Object / Transaction(s).

Regards,

Dipanjan

[Former Member]

I fill one value in this objekt for every Transaktion in SU24.

Ok.

And I want that i can fill other values in pfcg for every Transaktion seperate.

This is a contradiction.

But I don´t want to copy the objekts in PFCG.

For which purpose are you maintaining SU24 if it is not for PFCG?

If you are not clear yet what transaction SU24 is good for and how it works, then it is best not to change anything there.

I suggest you read the threads and notes in the FAQ sticky thread at the top of the forum page, there are a few on SU24. This will give you a good overview and details about the PFCG working in combination with SU24, and what your options are.

Please take a moment to read them and clarify what you want to achieve by this.

Cheers,

Julius

[Former Member]

When I add the objekts manual they won´t be delete if I delete the Transaktion in the menu. That is the reason, why i want to avoid add objeckts manually.

I need this because ther is one field in the object what is called fieldname, and this have to be filled differend for every Transaktion.

[sdipanjan]

When I add the objekts manual they won´t be delete if I delete the Transaktion in the menu. That is the reason, why i want to avoid add objeckts manually.

Yes, indeed.

I need this because ther is one field in the object what is called fieldname, and this have to be filled differend for every Transaktion.

It doesn't matter at all if the same Objects are appearing separately with respective field values for each Transaction codes or Profile generator is going to merge them in a single room. In case of merging also, there is an option SAP provided to give the details of the contribution of each TCode to that Objects current values. Please see my earlier post and also follow a search in the forum. Did you check the "Mountain Icon" beside each Tcode? Clicking on this leads to what?

Regards,

Dipanjan

[Former Member]

My Problem in Details:

I have an self-designed authorization objekt.

This must be connect to several Transactions with one special Value for every Transaction. I make this in SU24. By choose the Transaktion and add the Objekt and enter in the Field "Tabellenname"(name of the Table) a value. the value is different for every Traansaktion.

Now I want to add this Transaktions in the menu for a role. After this i (or our Costumer) want to fill a second Value in the authorization object, which is also different for every Transaktion. In our Example it is the filed "Feldname" (Fieldname). But the Transaktion PFCG merge all the objects so that I get one Object and in the Field "Tabellenname" are alle the values together which I had inserted in SU24. Because of this i can't fill the field different values in Feldname for every Transaktion.

[sdipanjan]

My Problem in Details:

I have an self-designed authorization objekt.

This must be connect to several Transactions with one special Value for every Transaction. I make this in SU24. By choose the Transaktion and add the Objekt and enter in the Field "Tabellenname"(name of the Table) a value. the value is different for every Traansaktion.

Fare enough!

Now I want to add this Transaktions in the menu for a role. After this i (or our Costumer) want to fill a second Value in the authorization object, which is also different for every Transaktion.

This means you do not want to allow the those Transactions to use the field values of other Transaction for this Object.. correct?

In our Example it is the filed "Feldname" (Fieldname). But the Transaktion PFCG merge all the objects so that I get one Object and in the Field "Tabellenname" are alle the values together which I had inserted in SU24. Because of this i can't fill the field different values in Feldname for every Transaktion.

Here lies the story of Authorization checks and the logic behind it. in Application server ABAP (and also in earlier versions) the checks for Objects appearing in the PFCG auth. tab are being done with AND logic and NOT by OR logic. So, it is evident even if the Objects are separated for each object as you want, it wouldn't be possible for make this segregation in place during the authorization check when the user is using those Transactions. They will be able to use each of those values.

Now, analyzing the idea of separate values for the Custom Authorization field (in that object): What is the purpose of providing separate value for each of them if you are going to maintain them manually and assigning into same role? It should be any one of the follows:

1. The Field values which is separate for each of those Tcodes should have been mentioned in the ABAP code

2. The Tcodes should have been assigned separately to separate roles to keep the values intact as you wish to provide and need not to be assigned to a single user. Else, it will implicate the same scenario. During loading of Authorization instances in the user buffer and their checks for a particular user will emit same smell as merge auth. principle (you are trying to avoid) at the time of executing Transactions even if they are provided by using separate roles.

Let me know if I am able to make this clear.

Regards,

Dipanjan

[Former Member]

I think you misunderstood me.

Example:

I want the Result:

Objekt 1 for Transaktion z1:

tabname: VTTK

Fieldname: TKNUM

Objekt 2 for Transaktion z2:

tabname: VTTP

Fieldname: POSNR

When I now go to SU24 and add the Objekt to z1 with tabname = VTTK fieldname stay empty because it could be different for different Roles. also I add the Objekt for z2 with tabname = VTTP and fieldname = empty.

After this I add the Transactions to the menu for a role and the Result is:

Objekt1:

tabname: VTTK, VTTP

feldname: empty

[sdipanjan]

I have explained the reason of this in the last post and the probable solution also. Please check them thoroughly.

Regards,

Dipanjan

[Former Member]

You see, the first time you access the authorizations tab and maintain values there for "standard" proposals for objects, you will have differentiated these two within these roles.

If you back out and want to go in again (because you went to lunch and the GUI logout time is set to 30 minutes) then choose "Change" in expert mode next time to continue.

Please read the SAP note in the FAQ I have mentioned before. Read it twice please and test it.

Otherwise (plan B) create "manually" authorizations and explain to your project lead why you are doing this and that it might create an overhead later on down the line.

Cheers,

Julius

[arpan_paik]

Hi Volkar,

This is not possible by profile generation neither through change mode nor through expert mode. Only way to do it manually add in expert mode edit old status. What is not recommended. However you can maintain a null value (like ") in field name for any of the transaction then you will be able to get your desire authorization.