Transaction PA30 user locks person do not having authorization

[zsolt_dubovanszky2]

Hi SAP authorization experts,

In ERP 6.0 system we have many personal areas.

Roles are allowing to work only with one personal area. Authorization object P_ORGIN, field PERSA.

One user have authorization in one personal area (P_ORIGIN-PERSA) .

This user can lock the personal record of a person assigned to another personal area in which the current user do not have authorization in his roles.

USER2000 started Tr.PA30, selected a person 100 in PERSA 1000. This user do not has authorization to read and change personal data of persons in personal area 1000.

After USER1000 started also Tr.PA30, and selected the same person 100.

This user has the authorization to change personal data of persons in personal area 1000.

This user get such an error message:

Person is already being processed by user PERSA = 2000 Test user PERSA = 2000

Message no. PBAS_SERVICE001

Diagnosis

If two users change a person's data at the same time, the system cannot decide which changes have priority. For this reason, only one user is ever permitted to make changes at any one time.

User PERSA = 2000 Test user PERSA = 2000 is currently editing the person.

System Response

The system does not allow you to edit the person.

Procedure

Wait until user PERSA = 2000 Test user PERSA = 2000 has finished editing the person.

Procedure for System Administration

User TEST2000 keeps a lock for lock object EPPRELE 00000200.

Question, why USER2000, not having permission to change data or person 100 can lock the record?

Can somebody help to resolve this issue?

Thanks, Zsolt

Edited by: Zsolt Dubovanszky on Jun 3, 2011 4:40 PM

[Former Member]

Hi Zsolt,

Can you provide the package level of your ECC6.0 system and also were you able to figure out how user2000 is accessing the user records ? Is it via PA30 or any batch tcodes ?

This issue was present in 4.7 and the following note has required inputs...Note 577198 but as since you are on ECC 6.0 this issue should have been resolved by now.Hope you have referred [1012708|https://websmp230.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=1012708]

~Sri

[zsolt_dubovanszky2]

Thanks, for your answer!

Here are the info:

Patch level:

ST-PI 2008_1_700 0004 SAPKITLRD4 SAP Solution Tools Plug-In

SAP_BW 700 0020 SAPKW70020 SAP NetWeaver BI 7.0

SAP_AP 700 0017 SAPKNA7017 SAP Application Platform

SAP_APPL 600 0016 SAPKH60016 Logistics and Accounting

SAP_HR 600 0063 SAPKE60063 Human Resources

Both users user2000 and user1000 are using Tr.PA30 in dialog mode. I can reproduce the issue.

Not, I am not referring not to 1012708 , because there the person id are different.

In my case the person ID is the same, person id = 100.

But the user2000 do not have any authorization in resonal area 1000, in the personal are of person 100, so I suppose the correct way how SAP should handle, do not lock any users in other personal area, where the user do not have any authorizations.

If my answer is not clear please let me know.

Thanks, Zsolt

Edited by: Zsolt Dubovanszky on Jun 6, 2011 10:01 AM