Authorization to a single Transaction

[former_member654002]

Hi,

I am novice in the authorization issue but i have a need that i will describe in the following lines:

i need to atrib t-code FDTA to a single user.

How can do that? and How can i know what users are using the t-code in a single moment

Thank you for your answers

Best Regards

João Fernandes

[Former Member]

Hi,

follow this steps :

- goto PFCG

- submit new role name, e.g Z_TEST

- save

- on tab MENU

- add transaction FDTA

- assign transaction

- goto tab authorization

- save

- goto pencil button : change authorization data

- on popup window : define organization level, submit your company code

- submit necessary value for give authorization object, in this example there are two authorization object : S_TMS_ACT and F_REGU_BUK.

- change the value suits to your needs

- all authorization object should be green (maintained)

- click button circle with red-white (generate) or press shift+F5

- for proposed profile name, accept it by clicking check button

- press back button (don't press save, you need to generate again if you press save here)

- on tab user, assign to your user.

- press user comparison

- complete comparison

- save ? yes

- then save again to make sure.

if you wish to check when and where user is using that tcode, use tcode STAD

submit username (and/ or) transaction, and time period you wish to evaluate, then press ENTER.

hope it help you.

rgds,

Alfonsus Guritno

[Former Member]

Joao,

How can i know what users are using the t-code in a single moment

Use the "User information system" with transaction SUIM

Since you are trying to determine a list of users, click on users > users by complex selection > by transaction authorizations.

Enter the transaction code, execute.

Lotsa other ways within SUIM to look at other authorization data as well.

Best Regards,

DB49

[former_member187989]

Use t.code S_ALR_87101201 - Currently active users.

Edited by: Jeyakanthan A on Nov 28, 2010 2:51 PM

[Former Member]

Hi,

..or you can use AL08 to see "who is doing what" in global view.

use filter option to filter transaction code, or username or terminal.

hope it help you.

rgds,

Alfonsus Guritno

[former_member654002]

Hi Alfonsus,

Thank you for your answers. they are veru useful .

So i have an adittional question.

How can erase the transaction from the other users that i do not want to use it.

Best Regards

João Fernandes

[Former Member]

Hi Joao,

You need to remove the users who are assigned to that role that has transaction FDTA

You can find the list of users who are assigned to FDTA by running SUIM->Roles->By transaction assignment

Put FDTA in this report & run execute, you will get the roles that have FDTA. You then need to remove users for those roles

[Former Member]

Hi,

transaction code is attached to role.

and role is attached to user.

you cannot attach transaction code directly to the user.

role can consist of several transaction code in it.

and one role can be assigned to as many as user you want.

if you want to remove one or several transaction code from user, first you have to unassign or remove transaction code from role which contains that transaction code. dont forget to maintain regenerate authorization profile after transaction code removal.

example :

user A

is assigned role ZA, ZB and ZC.

role ZA contains tcode FDTA and SU53

role ZB contains SM37 and SP02

role ZC contains FDTA.

if you want to remove FDTA from user A, then you have to remove FDTA from role ZA and ZC.

hope it help you.

rgds,

Alfonsus Guritno

[former_member654002]

Hi,

Thank you

I think that i am biginning to understand.

So I course i can not remove FDTA from the role because is a standard object, is't it? (S_TMS_ACT

and F_REGU_BUK)

So my solution is remove the entire role from the user?

How can i do that in a quick way?

Best Regards

João Fernandes

[Former Member]

Hi,

yes S_TMS_ACT and F_REGU_BUK is two authorization object which is assigned to FDTA.

in this case you can't remove that, because your role consist of FDTA only, so when you remove FDTA, this two objects will be removed too, and on this point the role will have no authorization object anymore so that it can't be generated.

different case if your role have FDTA and say SPAD. if you remove FDTA from role, authorization object related only to FDTA will be removed, and authorization object that is related to SPAD will remain there.

so if your role consist of FDTA only, from PFCG you can goto user tab,

and remove the username you wish to unassign. that is the quickest way.

hope it help you.

rgds,

Alfonsus Guritno

[former_member654002]

Hi Alfonsus,

I am almost done. You help me very much and you deserve the points.

But i have a last problem: I remove object S_TMS_ACT and F_REGU_BUK form all the roles assigned to a user but after that

transaction FBDT is stil executable by the user.

What i am doing wrong?

Best Regards

Joã

[Former Member]

Hi,

As per your query you create new role in pfcg and assign to said user.

Anil

[Former Member]

Hi,

glad to hear you are nearly resolved your issue.

from my previous illustration :

user A
is assigned role ZA, ZB and ZC.
role ZA contains tcode FDTA and SU53
role ZB contains SM37 and SP02
role ZC contains FDTA
addition :
user B
is assigned role ZA only.

there is three approach to prevent user access to a tcode:

1. remove FDTA from role (no need to unasign role from user)

in role ZA, tab menu, make sure that no FDTA there if you want to completely remove FDTA from that role. in this case, any user assigned by role ZA will not be able to execute FDTA. don't forget to save any changes made. after that, goto user tab and perform user comparison. Do the same way for role ZC.

in this case user A and user B will not be able to execute FDTA.

2. or unassign role contains FDTA from user (no need to remove tcode from role)

if you just want user A cannot execute FDTA, from role ZA, tab user, remove user A from there, save it then hit user comparison button. do the same way for the other role assigned to A that contain FDTA (in this example above = role ZC).

review from SU01, tab role, that role ZA and ZC is no longer been there anymore.

in this case, only user A unable to execute FDTA. user B still able, because role ZA is still assigned to user B.

3. from SU01, tab profile, there is powerful profile is assigned there.

some powerful profile will give user access to many tcodes. make sure that you just maintain user access only from role, not from profile for a simplification on authorization audit. remove unecessary profile that is assigned manually, and allow only profile from role is stay there (you can recognize by profile name/ description).

tcode SUIM will help you much to trace user-role-tcode assignemnt.

- SUIM > transaction > executable for user (to see if user A able to execute FDTA ?)

- SUIM > transaction > executable for role (see user A's role, and review what tcode can be executed by that role, if FDTA listed there, review that role soon! )

I guess that you haven't perform user comparison so changes on role has not been reflected to the user master.

or my second assumption, there is powerful profile assigned to that user.

hope it help you.

rgds,

Alfonsus Guritno

[former_member654002]

Hi Alfonsus,

Thank you very much for your complete answer.

I am in situation 3. With your help i find a powerful profile.

I was not awared about the meaning of the profile in this question.

So i get t-code SU02 and i remove S_TMS_ACT from this profile. I generate it but seems that nothing happens. Even if i use SU01 to drill the profile i can find S_TMS_ACT available to it.

Should i mantain profile at SU02 or there is another way to do it.

Best regards and Thank you one more time

Best Regards

João Fernandes

[Former Member]

Hi,

as I said on my previous explanation... maintain authorization only from one component : role or profile.

maintain transaction and role and profile concurrently sometime will make you confuse.

my suggestion : from SU01, tab profile, remove unecessary profile (maybe powerful profile) that is assigned manually, and allow only profile from role is stay there (you can recognize by profile name/ description).

if you generate one role via PFCG, it will generate one profile (role-generated profile). so for user A if you assign role ZA and ZC to him :

- on SU01 tab role there is two role ZA and ZC right ?

- on SU01 tab profile there should be only two profile with description : profile for role ZA and profile for role ZB. (one role corresponding to one role-generated profile)

- remove any other profile other than this two profile mentioned above (profile for role ZA and profile for role ZB).

remember that once you unassign user from role via PFCG, if you back to SU01 tab role, removed role should not been there anymore; and jump to tab profile corresponding profile (role-generated profile) from removed role should not been there too.

hope it help you.

rgds,

Alfonsus Guritno

[former_member654002]

Hi,

Thank you Alfonsus,

I agree with your point i should mantain only role.

But if i simply remove the profile i will remove many authorizations so my helpdesk will colapse.

I need to remove this transaction now and then erase profiles gradually.

So How can i mantain the profile in a stand alone way?

Best Regards

Joã

[Former Member]

Hi,

to edit a profile, use SU02.

select the profile, and remove unecessary authorization from there.

hope it help you.

rgds,

Alfonsus Guritno