XK02 Authorisations

[Former Member]

Please see authorisation object F_LFA_AEN below which I am looking at with XK02

Under VGRUP the authorisation is assigned as '  '

This may be a silly question but does this mean that no fieldgroups have been assigned under this object so the user will not be able to make changes to any fields?

[Former Member]

Hi,

As David stated Dummy value is maintained for this field, i would suggest taking trace of a user executing XK02 and checking the return codes, if this authorization is present in production system it needs to be addressed, you can use one of below approaches to fix this.

1. Add an appropriate value to VGRUP (values can be different based on requirement, this requires input from functional team).
2. Maintain * to give full authorization (SOD check must be performed before making this change)
3. Deactivate the object (If this object does not come up in trace results then it is not required for t-code execution and can be deactivated)

[Former Member]

Hello

If you are lucky enough to have a SAP security strategy document that your client has published it may help. It looks like the field value may not have been known so the person who created the role might have used ' ' as a dummy value to be updated with correct values during UAT?

I don't like the use of ' ' in this way as it is actually a valid entry in some MM authorisation objects to allow searches etc without entering a plant.

Kind regards

David

[JL23]

moved from SAP ERP - Logistics Materials Management (SAP MM) to Security