PFCG menu entry with blank transaction

[Former Member]

Hello,

While going through some of the roles, I found in PFCG role menu there are some entries in transaction list "- transaction". When i click on it, it says the transaction does not exist. If the transaction has been deleted, than this entry should also does not exist. Maybe this is a common thing, but i am unable to understand it. Please can anyone suggest.

Regards,

Sanjay

[jurjen_heeck]

I suspect the role in question was either imported from another system or transported before the corresponding transaction was transported.

Since the whole role menu is kept separately from the transaction tables I wouldn't expect role menu entries for non-existent transactions to vanish automatically.

To find more 'surprises' you could try to match tables AGR_TCODES and TSTC for transactions that do exist in the role menus (AGR_TCODES) but not in TSTC.

[Bernhard_SAP]

Hello Sanjay,

the pfcg menu structure is independent. So if a t-code is deleted (se93), the entry might still exist in some role menus (w/o the tecnical t-code entry).

To find such entries I can suggest [SAP KBA 1524185 |https://service.sap.com/sap/support/notes/1524185] .

This will help you to get the standard S_TCODE authorization again to a 'green' status.

b.rgds, Bernhard

[Former Member]

Bernhard, You are spot on. This resolved my issue and will have to do the same for other roles as well..

Thanks other for the related answers.

I also have related question to this, not sure if this should be a new thread.

there are many roles which have the transaction present in s_tcodes but not available in role menu. though i am quite sure that the tranasction are not added manually. I would like to know whether there can be scenario where the transactions exist in s_tcode and not under role menu.

Is it necessary to remove them from s_tcode in this case for audit purpose.

Sanjay

[Former Member]

HI,

there are many roles which have the transaction present in s_tcodes but not available in role menu. though i am quite sure that the tranasction are not added manually. I would like to know whether there can be scenario where the transactions exist in s_tcode and not under role menu. 
Is it necessary to remove them from s_tcode in this case for audit purpose. 

Your query has been already answered in following thread

[;

Based on my experience I can say tcodes removed from Role menu and then profile being generated in Expert mode- with 'Edit old Status' option leads to such differences between Role Menu and Standard S_TCODE as you have encountered now.

Regenerating the profile with 'Read old status and merge with new data' option in expert mode of PFCG would sync the role menu and S_TCODE entries.

Thanks

Sandipan

[Former Member]

Regarding the same issue, where we have to adjust the role with "'Read old status and merge with new data" to delete blank entries. I would like to know whether this has to be done in all DEV, QA and PRD system or better to make the changes in dev and transport them to PRD.

Secondly is there a way to find out all the roles which have this issue of role not in synch with s_tcode. As manually tracking all the roles to find this issue will be a tough task.

Edited by: sd6340 on Dec 26, 2010 11:43 AM

[jurjen_heeck]

1- Always adjust everything in DEV and transport.

2- Have a look at tables AGR_TCODES and AGR_1251 filtered on S_TCODE. Anything in there which doesn't appear in table TSTC needs your attention.

Jurjen

P.S. Best open new threads for new questions. I'll ask Julius if this one can be split from the original thread.

[Former Member]

Regarding the same issue, where we have to adjust the role with "'Read old status and merge with new data" to delete blank entries. I would like to know whether this has to be done in all DEV, QA and PRD system or better to make the changes in dev and transport them to PRD.

It is a best practice to modify roles/ create roles in DEV system and move it up the stack to QA and PRD via transport requests so as to avoid inconsistencies across the lanscape.

Secondly is there a way to find out all the roles which have this issue of role not in synch with s_tcode. As manually tracking all the roles to find this issue will be a tough task.

Table AGR_TCODES would give you all tcodes in role menu from PFCG and table AGR_1251 (with object field as S_TCODE and field as TCD) would give you the list of tcodes under S_TCODE auth object within the role. A comparison between these two tables would help you to find the differences between tcodes in role menu and object S_TCODE.

Goodluck!

Sandipan

[Former Member]

Jurjen..you are quick! Sorry for the duplicate post:)

[Former Member]

Hi,

I have got an answer for it probably:-)

When you upload a role/transaction from a text file into SAP with Tcode named replaced with spaces (modified in notepad), the transaction has an entry as "-transaction"

I tested this scenerio with a existing role, where i downloaded it in a text file and replaced entry for SE16 with 4 spaces (SE16 was exisiting in the role menu when I downloaded it) and uploaded it back into SAP to overwrite the existing role, here SE16 was retained in the role menu and a new entry as "-transaction" was also added.

AGR_TCODE table also shows a blank entry for it!

Hope this clarifies.

Sandipan

Edited by: Sandipan Choudhury on Dec 23, 2010 10:56 AM

[jurjen_heeck]

Hope this clarifies.

I think the only thing you have proven is that there are many ways to break the role menus. That doesn't mean that the broken menu-entry Sanjay found was deliberately sabotaged.......

[Former Member]

That doesn't mean that the broken menu-entry Sanjay found was deliberately sabotaged.......

Well I correct myself then, that this is only one of the possibilities viz a human error..will watch this thread to learn anyother reason.

Cheers

Sandipan

[Former Member]

I am very much with Jurjen. I saw these kind of issues when importing roles from other system.