authorisation group for reports ??

[ashish_vikas]

Hello friends,

Can some one tell me how can i create a new authorization group for programs/reports. I need to use this value in authorization Object S_PROGRAM > filed P_GROUP.

On SAP help, i understand table TPGP should be updated.. But should i update table directly OR there is some additional transaction available ?

(I am not talking about authorization group for tables)

thanks

ashish

Edited by: ashish vikas on Jan 7, 2011 7:17 PM

Edited by: ashish vikas on Jan 7, 2011 7:19 PM

[madhumsr]

This message was moderated.

[Former Member]

You don't have to create an auth group anywhere to be able to enter the characters against a program or in S_PROGRAM.

You can create program auth groups in SE54 like you would for tables.

[ashish_vikas]

then what this thread talks about ?

thanks

ashish

[Former Member]

A brief browse indicates that it is telling you how to see what auth groups are assigned to programs and how you can update those mappings. For the sake of repeating myself, you do not need to create an auth group to be able to populate a value against a program or update a role. Open up SAP and experiement!

[ashish_vikas]

Alex.. what i understand now is, I can assign authorization groups to a program in 2 ways :

1. SE38 approach - By editing the attribute. if I do so, i need to create authorization groups in TPGP.

2. Through RSCSAUTH - I use this and it assign authorization groups to the program.

However, I do not find this new authorization group TPGP table now.. Is this OK ?

Will in BOTH CASE, role with this authorization group will be used ?

thanks

ashish

[Former Member]

Hi,

Both methods will work, just like table auth groups you don't need the group to be created - it's a free form field that will allow arbitrary entries (at least it is on the ECC6 system last did it on).

[Former Member]

You can edit the available list of groups via SM30 using view V_TPGP. This is always better as you have a value help (F4) for it when assigning the groups.

When the group does not exist, or in SE38 you change the attributes although RSCSAUTH wants to remember a different one, then the system throws a warning at you that the group does not exist or is going to create an inconsistency.

Generally, you can accept warnings by hitting the "Enter" key and save the group anyway.

Best practice is to create and document them - that way you have more consistency.

However, to be honest, the S_PROGRAM mechanism is a major pain and will hopefully become obsolete oneday with newer programming techniques. You should only use it as a blunt method to prevent upfront the execution of really critical programs (though such programs should contain correct checks in the correct coding locations anyway, so...).

Cheers,

Julius

[ashish_vikas]

fine.. Let me summarize what i understand.

1. Create Authorization groups via SM30 using view V_TPGP

2. Assign this Authorization group to any program by any one of the two methods(SE30-attributes or report RSCSAUTH)

Correct ??

thanks

ashish

[Former Member]

To avoid inconsistencies between the trdir and srepoath records you should only use one of the methods, and rscsauth is by far the better method to use, particularly if you are protecting some SAP standard reports.

Cheers,

Julius

[madhumsr]

This message was moderated.

[madhumsr]

This message was moderated.