Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

t-code does not show in Menu tab but in Stardared S_TCODE obj in PFCG

Former Member
0 Kudos

I find a mismatch in pfcg.

1. t-code does not list in Menu tab

2. t-code shows up in standared S_TCODE obj in Authriztion tab

I'd like to know why this is happending and how to prevent it.

1 ACCEPTED SOLUTION

Former Member
0 Kudos

Hi Lillian,

This has happened because, the transactions might not have been added in the "Menu" tab in Change Roles mode and they have been added directly in S_TCODE

13 REPLIES 13

jurjen_heeck
Active Contributor
0 Kudos

This is a frequently asked question. I think a search on SU24 & S_TCODE or USOBT_C & S_TCODE will reveal the previously given answers.

I am curious as to why you think this is something that needs preventing.

Hmm, the search isn't that easy. Hang on, I'll dig a bit deeper for you.

Edited by: Jurjen Heeck on Sep 21, 2010 4:43 PM

0 Kudos

Hi,

Thanks a lot of your prompt response. I just want to know what cause this happending.

0 Kudos

So I've found an example in my MiniSAP (Netweaver2004s) which I think everyone can repeat.

If you enter transaction SPAM in a role menu, save, and go to the authorizations tab you will find not only SPAM in the S_TCODE object but also SEPS and SAINT.

How?

Look at SPAM in SU24, notice there is a proposal for S_TCODE which contains both the extra transactions. These proposals are brought into the roles' authorizations by PFCG based on those settings. This is normal behaviour.

Where to find?

In tables USOBT (SAP values) & USOBT_C you can see where they come from by entering S_TCODE in the 'object' field and (in my example) SEPS and/or SAINT in the 'low' field. Now you see from where they came.

Why?

These proposal values were filled by SAP developers who considered that anyone needing SPAM might need both SEPS and SAINT as well, along with all the other objects proposed.

In my opinion it is not something you 'need to prevent' and if auditors bug you over differences between menu entries and S_TCODE values they need to be educated. I've had to do that several times and probabely will not see an end to this.

Hope this helps

Jurjen

Edited by: Jurjen Heeck on Sep 21, 2010 4:53 PM

0 Kudos

Thanks a lot Jurjen.

This clear explanation solved my issue as well, very smoothly.

Thanks again,

Sankar.

Former Member
0 Kudos

Hi Lillian,

This has happened because, the transactions might not have been added in the "Menu" tab in Change Roles mode and they have been added directly in S_TCODE

0 Kudos

Hi,

Thanks a lot for your response. I do not think, however, that's the reason. The problem is that t-code shows up in a Stardarded S_TCODE object, which won't allow you to add t-code manually. The standared S_TCODE object should only show the t-codes show up in Menu tab. You can only add t-code manually to a Manually added S_TCODE object.

0 Kudos

> The standared S_TCODE object should only show the t-codes show up in Menu tab.

That is a common misconception. See my edited post above for the explanation.

0 Kudos

Thank you so much for your reply. This really helps a lot. I'd really like to have your email on my list so that i can ask you more qustions.

0 Kudos

> I'd really like to have your email on my list

Just stick to the forum. That way everyone can benefit from the discussions. Besides that, I do not answer emailed questions for free

Former Member
0 Kudos

Dear,

Another possiblity is that the role has been modified in the menu tab (transaction removed and entered authorization tab through Expert Mode for Profile Generation (Edit Old status) and the profile is generated.

Regards,

Shrinivasan. KV

0 Kudos

OP is talking about a 'standard' S_TCODE object. Those cannot be manipulated in the way you describe. It's the SU24 settings, trust me.

0 Kudos

Possibly what you meant was changing the menu and then not generating the profile again?

Cheers,

Julius

0 Kudos

> Possibly what you meant was changing the menu and then not generating the profile again?

Genereating the profile without changing it, and without accepting any proposed changes, could do the trick.

I am still in favor of the scenario I described earlier. Even though I know of ways to fumble with the contents of standard S_TCODE objects to satisfy auditors who insist a manual S_TCODE entry is dangerous