How does SAP deal with authorization profiles combination?

[Former Member]

Will anyone please confirm me that how authorization checking works with profiles combination in SAP? If I set two profiles for a user. In one profile, I grant auhorization object F_BKPF_BES with value 3/001. And in another profile, I grant F_BKPF_BES 1/002. Will the system reckon that the user have been granted F_BKPF_BES (1,3)/(001,002) or it will consider the two profiles separately?

Regards

Robbie

[former_member190272]

Hi,

Please try with T Code SU53.

Regards,

Pankaj

[Former Member]

Hi

you can check from SU53 , check under S_TCODE

regards,

Balaram

[jurjen_heeck]

> Will the system reckon that the user have been granted F_BKPF_BES (1,3)/(001,002) or it will consider the two profiles separately?

Separately. The other two replies are not an answer to your question. You can safely ingnore them. You'll find tons of useful info if you have a look at the sticky thread in the Netweaver forum.

[Former Member]

Just a short thing from my own experience:

Beware that the authorisations are not checked based on the roles.

e.g. I can give a user authorisation to a transaction, with possibilities to post to GL only.

Another role might be added, allowing AP postings, but not access to the S_TCODE.

Anyhow, in the transaction, the user will then be able to post both to GL and AP as the objects are not checked in combination with e.g. the S_TCODE.

I hope what I'm trying to explain makes sence

[Former Member]

The answer your question is Yes. All the authorisations are loaded in the user buffer when the ID logs in and are combined to maximise the user buffer. Therefore your authorisations will be seen as if they are all combined.

I hope that helps.

Amrit

[Former Member]

> All the authorisations are loaded in the user buffer when the ID logs in...

Yes, the reference to the authorizations are loaded, per authorization(!) for each object.

>... and are combined to maximise the user buffer.

Not completely. Authorizations are generated per role and per object. You cannot mix the field values of the objects in different authorizations.

> Therefore your authorisations will be seen as if they are all combined.

The consequence is combinations of all roles, per object. Not per field. Otherwise you could not create authorizations which permit you to display some values and change only a subset of them.

Cheers,

Julius