Removal of t-code ranges within roles

[Former Member]

Hi all,

I have been looking to cleanup and refine our authorization concept. Old authorizations person created many roles that contain massive ranges of t-codes. Naturally, they were all manually placed into S_TCODE.

Is there any way to go about generating a report of which roles in my systems contain these ranges, outside of manually looking at S_TCODE and then being able to clean them up or at least assign menu items to the offending t-codes?

I am unsure of this.

I have been able to at least use SUIM to search based on contents of the S_TCODE auth object for specific sensitive transactions. Actually, that requirement is what led me to find the abundance of roles that contain the large ranges.

Any tips on this would be greatly appreciated, because manual cleanup or re-creation of these roles will certainly be time consuming.

Thanks.

[jurjen_heeck]

Is there any way to go about generating a report of which roles in my systems contain these ranges, outside of manually looking at S_TCODE and then being able to clean them up or at least assign menu items to the offending t-codes? 

If you have a look at table AGR_1251 you'll notice that there is a LOW and a HIGH field. If the HIGH field contains a value there is a range. If you filter this table for object S_TCODE and go for the non-empties in HIGH you will probabely get what you're looking for.

Jurjen

P.S. To find 'star' entries in the low field, search for #*

[Former Member]

In addition to above suggestion, I believe you should be also looking at entries in LOW field with wildcards like S* or P* which practically are "range" of tcodes as well. And yes, manual S_Tcode objects are the one you should be looking at.

Thanks

Sandipan

[Former Member]

Thank you both. This will greatly speed up my search to identify the ranges. Also, good advice on the ALPHA* entries as I know those are basically ranges in themselves as well.

Now I just need to figure out a way to clean them all up.

[arpan_paik]

In table AGR_1251 look for object status (MODIFIED). For standard S_TCODE it will be S, For manual it will be U. By the way there is one standard report exists to give you report for all role with manual S_TCODE. I forget the name. If a person named Dipanjan sails here may give you the name :-). Anyway AGR_1251 will also give the data but need to filter a bit

Regards,

Arpan Paik

[Former Member]

Thanks Arpan! Determining the U versus S values in SE16N really helped me to be able to sort the info. I'm still interested in the report, but this has me going in the right direction for now. Thanks for the help! I am marking the thread as answered.

Thanks everyone for your input.

[arpan_paik]

I searched a bit and think report PFCG_AGRS_WITH_MANUAL_S_TCODE is the correct one...

Regards,

Arpan Paik

[Former Member]

Worked! Thanks again!

[Former Member]

This message was moderated.