Use of ranges in roles

[Former Member]

I’m having an issue with the use of ranges in a role and would appreciate your help to understand the use of ranges.

Example 1:

I want to give authorization to all values starting with A, B and C and would like to express this in a range.

- what is the correct way to express this range (I’m looking for the from- and to-value) ?

Example 2:

I want to give authorization to all values starting with A, B, and C except values starting with AQ and I would like to express this in ranges.

- what is the correct way to express these ranges (I’m looking for the from- and to-values) ?

[Former Member]

Hi Peter,

Something like this?

Example 1:

From A* to C*

Or:

A*

B*

C*

Example 2 (depends of the characters/field values you want to exclude. e.g. AA or AAA etc):

From A0* To: A9*

From: AA*  To: AP*

From AR* To: AZ*

From: B* To: C*

Regards

[Former Member]

Hi Peter,

I would suggest to check the docs.

According to them, the solution should be

Example 1: from: A     to: C*

Example 2: from: A     to: AP*

                  from: AR  to: C*

Regards,

Patrick

[Former Member]

Hi Patrick

I have been searching high and low for the documentation - thank you very much for the link

Best regards,

Peter

[Former Member]

Hi Roy

Looking at the documentation Patrick sent me a link to, your from-value shoud not contain an asteriks, so your suggestion is not correct.

Best regards,

Peter

[Former Member]

Note that this A* to Z* is a regular source of confusion.

Due to "piggy backing" of ranges (if you start using them...) it often does not show up.

Particularly if you see special characters at the beginning of the FROM value then it is suspect that the ASCII range might end with something after Z if it is another strange character.

But the main source of confusion lies in inadequate use of the function module SUSR_SYNC_USER_TABLES with table type = 'X' in programs. PFCG "orphans" data into UST12 and does not clear the fields nicely every time, which leaves BIS data which can create strange ranges for the COUNTER field.

Users typically end up with more access than they need or appear to have (they won't complain...) but sometimes also have less.

Old roles created / maintained / transported which contained these problems might still exhibit such behaviour.

Unfortunately the old notes (which relate to the time when such roles might have been created and transported) are mostly not available anymore, but there are some new ones about ranges and the table sync from PFCG data to the real data in the AUTHORITY-CHECK.

As Patrick mentioned, convert to A-Z* type patterns and you will be better off.

Julius

[Former Member]

Here you go -> SAP Note 489887.

If roles created with ranges and transported in that era are still used and the table sync has not been triggered since then, then might have this phenomenon if you used and changed ranges a lot.

Unfortunately SAP does not run this function module automatically anymore - however there are still old roles out there...

Best is to avoid ranges completely and if you do use it then with correct syntax.

Cheers,

Julius

ps: The thread was already closed, but this brought back many memories of confusion back in 46C days and then it dawned on me that the roles might still be in circulation... then another thing dawned on me about upload / download tolerances for roles. Then the puzzle pieces were put together... 🙂

[sri_g4]

A* to C*

[Former Member]

Hi

Looking at the documentation Patrick sent me a link to, your from-value shoud not contain an asteriks, so your suggestion is not correct.

Best regards,

Peter

[sri_g4]

Thank you for the feedback

[Former Member]

Hi Peter,

if you want to find the exact range for all the t-codes you should know the all t-codes available in the System. Please follow the below steps.

1.Get all the t-code in the system with the help of table TSTC (this will give the list of all t-code in aSequential manner so this will give exact series).

2. from the list find out Inclusion and exclusions. Thats is you maintained t-code range.. in S_TCODE.

[Former Member]

Hi SailuKumar

I was not looking for transactioncodes.

Best regards,

Peter