Inconsistency with SUIM

[Former Member]

Hi,

I've created a role with some Tcodes.

When I check that in SUIM -> User Information System -> Transactions -> Exectuable for Role -> <rolename> , it is showinf less Tcodes than what I've given in that role.

Can anyone please explain me why that incosistency is happening.

Thanks in Advance,

A.S.Chaitanya Swarup.

[JPReyes]

Moved to Security Forum

Regards

Juan

[Former Member]

Hi,

Is the role working as expected with all the transactions you have added? Please share the SAP system version and add more details about the problem.

Check note: 1393940 (SUIM| Incorrect results when searching for profile and roles)

Regards,

Gowrinadh

[Former Member]

Sataya,

In SUIM is your query using "Transaction" field or are you searching by Authorization Object S_TCODE and putting in specific values?

A thing to note is that the "Transaction" field on SUIM searches against transactions assigned directly to role menu whereas if you search by "Authorization Object" S_TCODE you will get all instances of that objet with values specified.

Thanks,

Matt

[Former Member]

You might also want to consider that it is a composite role, and the menu might have lost it's relation to the single roles with the authorizations needed to actually execute the transaction. Sooner or later the authorizations themselves follow suite.

It might also even be a remote enabled menu, and the authorizations needed to execute the transaction are not only in other single roles, but they are in another system...

The tool is largely obsolete. By the time you need to use it to find roles or users or even profiles or authorizations.... it will be too late...

Cheers,

Julius

[Former Member]

Satya,

For the t-codes that does not come as executable, did you check it they really do exist or the program for that do exist in the system where you are executing SUIM. I am taking the liberty of thinking that you are talking about some Z custom reports.

I had an issue where we added a custom t-code in the role and transported it before the program for that t-code was transported. So the dummy t-code reached quality but not the actual t-code and the corresponding program for it. In that case if you run your SUIM report the way you did then it will not display this custom t-code but a dummy t-code will still exist in the role if you look through PFCG or SUIM -> Roles -> Roles by complex selection criteria -> Transaction assignment

[Bernhard_SAP]

.... and finally: did you countercheck, that the t-codes are really executable with that role assigned?

Please be aware, that not only s_tcode authorizations are necessary to execute a t-code. Cosnider additional checks in SE93 at t-code start, if the t-code is locked and if it exists.....

A simple check with a testuser with only that role assigned will give you the clue, and I suppose, that there is no inconsistent result. But it is necessary to 'trust' the title of the report '....executable with...' So only if the t-code really can be started with that role, the tcode will be in the result list...

b.rgds, Bernhard

[arpan_paik]

Hi Satya,

Consider you have gone through all the above checks suggested. If still you find issue then post to SAP in Service market place. SUIM do have many bug what you can feel by searching in Servicemarket place. I have also experienced such issue and applying SNOTE as guided by SAP solved the issue.

Best of luck !!!!!!!!

Arpan