Deny access to transaction in the command line but not in a report.

[Former Member]

Hi!

Exist a way to deny access to one user in the transaction search bar (command field) but not in a program??

Example: This user execute a report that call a specific transaction but for auditory reasons I can't give him the access to access it by the command line but if I deny the access to that transaction the user can't run the report because the report call it... Exist a way to give him the access to run the report to call that transaction and deny the access if he write it in the command line??

Thanks for ur help people!

Carlos

[Former Member]

In the report call FM AUTHORITY_CHECK_TCODE and in SE97 maintain the "ok" flag for the calling tcode context, but sometimes you don't have one to work with.

A better option would be to create a dialog transaction for a module pool, and for the "remote program" access call FM's which represent the LUW's you want to use in it.

With ABAP-OO you can take it a step further using classes of methods (public parts, private parts, friends, etc).

Cheers,

Julius

[Former Member]

Thanks a lot for ur help!!!

For what is the transaction SE97?

[Former Member]

If you want a transaction context to work with, then it's use is to create "couples" of them which trust each other in SE37, depending on your config.

Search the forum and take a look in the FAQ thread for more details, or explain your scenario if it does not match the available options.

For some "entry points" it does not make sense to check the tcode, as it might force you to grant the direct access to it's screens.

Which transaction is this?

Cheers,

Julius

[Former Member]

Julius,

Here are the transactions...

The user call the transaction ME21N, this transaction call the transactions AS01 and AS01. Auditory wants to deny the access if the user try to access it from the command line in SAP.

I want to deny the access in the command line for this two transaction AS01 and AS02 for this users but not if they call transaction ME21N and this transaction calls it from the program...

I'm making some test with the SE97 transaction to see if can help me with this issue...

[Former Member]

SE97 does not work in all cases, and this is one of them. Same is true for Enjoy xxxxN transactions in general.

Please explain the entry point of the user in this process, if it is not to be the tcodes?

Cheers,

Julius

[martin_voros]

Hi,

you can achieve your requirement with enhancement framework. The transaction AS01 and many other asset related transactions are implemented in function group AIST. There is routine TRANSAKTION_INIT which is called whenever you start transaction implemented in AIST. Here you can implement implicit enhancement point to perform additional checks. You can for example define your own authorization object. I quickly checked it and when I click on on asset in ME22N then it goes to this routine but sy-tcode is still equal to ME22N. The reason for this is that ME2xN does not use CALL TRANSACTION statement but it calls FM ASSET_MASTERRECORD_MAINTENANCE. I haven't run trace but are you sure that when you call AS01 from ME2xN SAP performs check for S_TCODE. If not then you can just simply remove authorization for object S_TCODE to prevent user running transactions directly.

Cheers

[Former Member]

Hi Carlos

Please refer to teh following post for some information on trxn SE97 and table TCDCOUPLES.

Thanks.

Anjan