how to create a single role with su01 display and su10 full access

[Former Member]

Hi Experts,

Can any one give a solution for this query

How to create a single role with su01 only display and su10 full access and assign to a user.

NOTE: 1) without using SU01D

2) without creating two seperate roles one for su01 display and one for SU10 full access and assigning to the user

[Bernhard_SAP]

> How to create a single role with su01 only display and su10 full access and assign to a user.

--> this is not possible, as both t-codes are using the same authorization objects

  2) without creating two seperate roles one for su01 display and one for SU10 full access and assigning to the user*

-->this does not make sense at all. It does not matter if you assign authorizations through one or more roles.

b.rgds, Bernhard

[Former Member]

HI ,

It is ok but my trainer is saying that it is possible to do in a single role

regards,

santhosh B

[Former Member]

Please tell your trainer to explain how this is possible, here in this thread...

(ps: Transaction variants is cheating )

(pps: please do not duplicate post!)

Cheers,

Julius

[Former Member]

Yes...I would also like to know how it is possible..should be really interesting!!! Also it would be a good learning for SAP AG as well.

Someday people might ask how to transport users across systems (as their trainer said it is possible!!)

[Former Member]

Actually you can transport even purchase orders and bank payment instructions... and changing SU01 to display only for someone with full SU10 access is also possible, but both are nonsense and are just "hacks"..

That is why I would like to know what the sense is in this?

Possibly it is just an academic theory, or an interview question??

Cheers,

Julius

[Former Member]

Hi,

It is not an interview question its just an acadamic work.

> My trainer said that this question is asked to think on objects and how they behave.

Thanks To All Who Replied For This Post

Cheers & Regards

santhosh

[Former Member]

If it is just academic, then make an entry for your trainer's ID in table SHDSTUSR and assign a screen variant for transaction SU01 which permits display only (same as that of SU01D). You can also create this in tcode SHD0.

Then assign your role you created (to display SU01 but full access to SU10) to the trainer and announce that it is infact possible within one role which overrides the authorizations of the others... and the trainer can test it...

Then ask the trainer how it would have been possible to achieve the same with two seperate roles (as per your original question)... just for academic curiosity... without any pressure...

Keep us posted on how the action unfolds...

Cheers,

Julius

[Former Member]

Hi Julius,

Thanks and i will update u soon the reaction of my trainer.

thanks&regards

santhosh