authorisation checks while calling SAPGUI.

[Former Member]

Hi All,

I am analysing the authorisations required to call SAP GUI Script.

Autho obj S_SCR with ACTVT 16, should be present in user's profle to successfully call the SAPGUI Script.

However auth check will only be active sapgui/user_scripting_per_user to TRUE.we have set the parameter to TRUE and were expecting for SAPGUI Script call to fail because of above missing authorisation.

However, as the SAPGUI Script was successfully called without access to S_SCR auth obj.

(Trace shows a check and returns a code RC=12, for obj S_SCR).

Can someone provide me inputs on authorisation checks while calling SAPGUI.

[Former Member]

Additional authorization check of S_SCR through parameter : sapgui/user_scripting_per_user is available with below software versions :

SAP GUI for Windows

1- 6.40: Patch 22 and following

2- 7.10 and following

SAP System

1 - 6.40: Kernel 6.40 patch level 159, support package SAPKB64020

2 - 7.00: Kernel 7.00 patch level 87, support package SAPKB70011

3 - 7.10 and following

Just check the version of SAP GUI and let us know.

[Former Member]

What some folks do is that they check the SAPGui version in the SAPGui logon exit, and reject a logon from anything they don't want.

A better option in my opinion is not to permit Gui Scripting at all. You will save yourself a lot of hassle and security risks...

Cheers,

Julius