Authorisation object

[Former Member]

Hi All,

I have some basic questions on authorisation

I created one new authorisation field

AEPRO -- it is change profile in change master (Engineering Change Management).

I have standard authorisation object C_AENR_ERW does not contain above field.

What could be best practise to have this additional authorisation field in authorisation check.

Also , i need to create authorisation check where user will have authorisation to create change master (to create through program), but he wont have authorisation to CC01 transaction, what would be best practise in this.

Thanks and regards,

[mvoros]

Hi,

there is no magical way how to add additional field to authorization object. The problem is that almost all authorization checks have to be programmed in ABAP programs. Hence just adding new field to standard object would not update all places in source code where C_AENR_ERW is called.

What you can do is to define a new custom object with all required fields and enhance standard transactions to also perform check for this object. This can be really tricky and in some cases not possible without modifying standard SAP programs. As a first thing you can search where C_AENR_ERW is used from SU21. But you will need help from somebody with a good knowledge of ABAP and enhancement framework.

For the second question you need to figure out what objects are required and get them somehow into role. The easiest way is to manually insert them into role but this is not the best practice. Other option is to create a dummy tcode and link those authorization objects to it in SU24 or link it to other object such as web dynpro app or RFC function module.

Cheers