Authorization objects for transactions in SAP CRM

[Former Member]

Dear Experts,

For transaction, the authorization check is run according to the following procedure:

1.Your own documents (authorization object CRM_ORD_OP)

2.Visibility in the organizational model (authorization object CRM_ORD_LP)

3.Territory check in claims management (authorization object CRM_ORD_TE)

4.Combination of several authorization objects (CRM_ACT, CRM_OPP, CRM_SAO, CRM_SEO, CRM_CO_SE, CRM_CON_SE, CRM_LEAD, CRM_CMP, CRM_CO_SA, CRM_CO_SC)

5.Authorization object CRM_ORD_PR

6.Authorization object CRM_ORD_OE

For CRM_ORD_OP - I have disabled the delete option.

For rest of the auth object, I have given full authorization. But the system is not considering the auth object: CRM_ORD_OP. The user is still able to delete the transaction.

However, if I disable the delete option for auth objects - CRM_ORD_PR & CRM_ORD_OE, its working fine i.e. user cannot delete the transaction.

Actually, our requirement is to govern the visibility of transaction document using auth object CRM_ORD_OP. But the system is not considering the auth object during authorization check.

Any inputs will be highly appreciated.

Thanks!

Best Regards,

Roshan

[robert_kunstelj · Accepted solution]

All auth. objects are considered in auth. check process (privileges are summarized). So if you for example say in CRM_ORD_OP define that user can't delete own objects but on other hand define in object CRM_ORD_PR that he can delete object ZXXX, he will still be able to delete all his own objects of type ZXXX, but other own object he will not be able to delete.

Regards.

[Former Member · Accepted solution]

Hello Robert,

Actually, the user is able to delete his own object. The user is assigned as employee resposible to the document. But he still can delete it.

My understanding was using the auth object: CRM_ORD_OP, we can control the authorization only to his onw documents.

For example if the user has "change" and "delete" authorization to his own documents, then these authorization are applicable only to his own document and he shouldnt be allowed to change or delete other documents, Right?

Is it by default that this auth object is not cosidered during authorization check?

Do we have to implement any BADI to read this auth object?

Best Regards,

Roshan

[robert_kunstelj · Accepted solution]

No, it is checked in standard authorization procedure. Check again your settings and also refresh buffers before testing with /$sync.