Restricting SPRO in existing profile

[Former Member]

Hi All,

I have created the role through SAP Menu but somehow user has got the access of SPRO tcode and i want to disable his/her access to SPRO. I have tried the blocking all the autho objects related to SPRO but user is still able to access. Please tell how to disable it?

regards,

Vikram

[manohar_kappala2]

Hi

If you are speaking of restricting the direct access to SPRO then I suggest check for this in S_TCode if you have a string value there like * or S* or a range which includes SPRO then this will give access to the SPRO Tcode. But however the catch here is each of the actions in the SPRO can be performed by using back doors like SM31 (direct table maintainence) and Tcodes which take you to the specific node in SPRO without having access to SPRO. So the first one can be achived through S_Tcode but the second scenario needs some analysis..

Regards,

Manohar

[Former Member]

Hi,

If you restrict the autho Objects and if the same objects are availabe in other role though if you restrict in a particular role then user will get authorization for SPRO.

Further you can check using SUIM for the transaction SPRO for user ID and roles which he is assigned may contain relevant objects.

For testing you can create a test user ID and assing only role which you have created if is still having authorization then chek for the following

1. In object S_TCODE (for SPRO)

2. All relevent auth Objects.

Hope this helps

Cheers

Soma