09-21-2010 7:05 AM
Hi there,
Here is the issue I faced.
I need to analyze SQL statement for example. I can do it two ways:
1) run ST05> Enter SQL statement> Explain
or via trace itself:
2) run ST05> Display trace> Explain
The thing is that when doing it the second way it requires additional authorizations that are not required when going the first route.
Additional authorizations which way 2) requires are:
S_TCODE SM69, SM49
S_DBCON with ACTVT=36
I was able to remove check for S_TCODE using transaction SE97, so that S_TCODE is not checked for SM69 and SM49 now for ST05 transaction. As for the S_DBCON - as SAP says:
"36 Extended Maintenance
Permission to execute all kinds of SQL statements on the database. This authorization is
extremely powerful and should not be granted on a routine basis.
Extended Maintenance, which should be restricted from use. This authorization allows a user
to execute any SQL statements on the database it is granted for. Improper use of this
feature can do significant damage."
So this object with ACTVT=36 cannot be given to a basic developer or basis, only to superuser, right?
My question is,
Is there way to go the second way (as it is more convinient to analyze SQL statement when viewing trace) and not to give the authorization above?
P.S.
ECC6.0, MSSQL, SAP_BASIS 700, SP 18
Thanks,
Igor
Edited by: Igor Kustov on Sep 21, 2010 8:10 AM
09-21-2010 8:07 AM
I would first verify that there isnt a functionality to change the SQL statement from the trace, in which case the check is correct.
But most likely the check is too strong and not used correctly here, so you should have opened a support message with SAP.
Cheers,
Julius
09-21-2010 8:07 AM
I would first verify that there isnt a functionality to change the SQL statement from the trace, in which case the check is correct.
But most likely the check is too strong and not used correctly here, so you should have opened a support message with SAP.
Cheers,
Julius
09-21-2010 8:53 AM
Julius, thanks.
Well, yes, when in Trace List there is a button "Editor for Changing SQL Statement" which brings you to the Enter SQL statement screen (first option in my original post) with the statement you clicked on and ability to change it. You click "Explain" and analysis appears with no additional checks there.
It is strange why S_DBCON with ACTVT=36 is required to just push "Explain" button within Trace list. From my experience the ability to execute any SQL code (natively to RDMS) from either ST05 or ST04 was revoked with basis SP12 when DBACOCKPIT was introduced.
OK, it looks like there is a workaround to analyze a statement from trace with two clicks and not just one. May be I should open a message with SAP then.
But still, since you cannot execute SQLs anymore what this S_DBCON with Extended maintenance acitivity is intended for?
Thanks,
Igor
09-21-2010 9:19 AM
Then most likely this upfront check is "legacy coding" and is no longer correct, as it would force a user with display trace authority to perform other more critical tasks.
I would (have) opened a customer message with SAP.
Cheers,
Julius