Restrict Sets maintenance

[Former Member]

Hi,

We have more than 15000 Sets in our system used for different purposes. We want to give access to few users to maintain some Sets and they must be restricted only to those ones. To do so, I created an Authorization Group and I assigned it to those Sets. But the problem is all the other Sets have no Auth Group assigned to them (Blank) and then even if I restrict the users to that specific Auth Group they still have the capability to maintain all sets including the ones with blank Auth Group.

Is there any solution to restrict the user to maintain only a limited number (only one or two) of sets other that adding an Auth group on all the 15000 sets?

Thanks

[Former Member]

Chiheb,

Are you using the word "Sets" same as Tables/View/Structures/etc? Or something else? Just trying to clarify before providing an educated response.

Thanks,

Matt

[Former Member]

For sets it's the same as for other master-data. You can restrict the maintenance if you have defined authorisation groups for them (field BEGRU) which you can subsequently authorise in objects G_800S_GSE and G_802G_GSV.

Other than that I cannot see ... of course, this demands maintenance of all the sets you already have, which is no small effort - but maybe there's some kind of mass-maintenance? Consult your functional, s/he might know ...

[mvoros]

Hi,

here is quote from documentation for auth. object G_800S_GSE.

All users that have an authorization for authorization object G_800S_GSE then have all authorizations for all sets
without an authorization group.

Hence you really need to assign a dummy authorization group to all your sets. I am not sure but it looks like you could do it with one direct update of table SETHEADER. Warning: I've never done it and as usual the direct update of SAP tables is pretty risky. Maybe someone else has experience with this.

Cheers

[mvoros]

Actually, have a look at note 459864 and all related notes. The correction instruction contain report ZCO_ASSIGN_AUTH_GROUP which might be helpful for you. It also shows that changing authorization group is not that simple as I thought.

Cheers