Transaction to a role

[Former Member]

Hi Guys,

I want to find the list of tocdes assigned to a role.

I checked it in table agr_1251 it gave 194tcodes.

But when checking through suim->transaction->excutable fora role it shows 202 tcodes.

COuld you please suggest me which procedure is correct or which can be employed to collect the tcodes assigned to a role.

Regards,

Adithya G

[andrea_brusarestelletti]

Hello,

  try with table AGR_TCODES.

Best regards,

Andrea

[Former Member]

I did try with agr_tcodes but it not displaying any tcodes.

[Former Member]

Hi Adithya,

Usually this problem occurs when you have add extra t-codes in the role by using S_TCODE (manually).SUIM is the standard one.If management asks for executable t-codes please use SUIM report

To avoid such issues please use table

AGR_1251.. Give role name and authrization object S_TCODE.. then you will get the list of t-codes exicutable for that role.

[andrea_brusarestelletti]

Hello,

I knew that object S_TCODE can't be modified manually but is automatically filled from the transactions entered in the menu tab. Is there a way to do that?

Best regards,

Andrea

[Colleen]

The initial S_TCODE for Standard is automatically populated based on Role Menu. In addition, you can manually add S_TCODE to a role. You will see changed status when someone has overwritten the Standard import from

Within the authorisations data you will see S_TCODE as:

• Standard - the authorisations values have come from the role menu
• Manually - an S_TCODE authorisation has been manually added to the role
• Changed - someone overwrote the Standard import values (bad admin person, bad)

AGR_1251 will cover all of those scenarios. AGR_TCODES shows the values in the role menu but can have duplicates if same transaction code added to different folders in the menu.

[andrea_brusarestelletti]

Thank you.

Best regards,

Andrea

[Colleen]

suim->transaction->excutable fora role

Have you read what this report is actually checking? It is not just about S_TCODE but whether the role has the authorisations to start the transaction (SE93 definition of transaction may have additional check)

also, it looks like it's evaluated the generated profile of the code (i.e UST10s/UST12) for S_TCODE access. If you have maintained PFCG but not generated your profile what appears in the AGR_1251will not match the UST* entries.

Suggest  you read the help information for that transaction

COuld you please suggest me which procedure is correct or which can be employed to collect the tcodes assigned to a role.

the procedure depends on whether you want to know:

• all transactions in the role menu (AGR_TCODES)
• all S_TCODE authorisation access AGR_1251 or UST12
• all executable transactions in role (SUIM report you ran)

If you read the help information and look at your role build you will probably be able to figure out that procedure yourself.

Regards

Colleen

[Former Member]

Thanks for your answer.

But i have few more clarifications

1)The Tcodes that are manually entered in a role will not appear in suim. Is it correct?

2)In AGR_1251 table i see 2 columns low and high.If low contains value mm01 and high mm03 does it mean role has tcode(mm01,mm02,mm03).

3)If i add a tcode and does not generate profile will that tcode appear in agr_1251.IF not is there any way to see those tcodes.

And as per my understanding agr_1251 includes all executable tcodes including those added manually while through suim we wont get transaction that are added manually. Is it correct??

Could you please provide me some link or document which you have roles.

Regards,

Adithya G

[Colleen]

Hi

1. Suim depends on which report (eg complex criteria for role menu won't give manual s_tcode)

2. Yes - search scn and you will find heaps of discussions on ranges

3. You still see them in pfcg but end of the day if you dont generate the profile the user won't get that access

agr_1251/agr_1252/agr_1250 contains all of the pfcg authorisation detailed screen (when you go into change mode). Generating the profile is ust10s/ust12

documentation exists in suim help; sap help; scn and google

test your scenario and by running report and seeing what results you get

[Former Member]

Hi

FInal question

why am i not able to see any tcodes in agr_tcodes table. It is showing as 0.

[Colleen]

II'm starting to feel like I'm sitting in an interview being quizzed;)

does your role have a menu or is it a derived role?

[Former Member]

well i got the answer for that.

Thanks for your help.

[Former Member]

Adithya is either maintaining a manual S_TCODE or inserting into the menu as "Authorization defaults" invisible to the menu. In the latter case they are in table AGR_BUFFI.

I place my bets firmly on the former case, raise you 2 bananas and would like to see Adithya's cards...  🙂

Cheers,

Julius

[Colleen]

I love it... we're now playing a game of find which table the transaction is hiding in!

I didn't think of AGR_BUFFI as I haven't built roles that way before

Regards

Colleen

[Former Member]

hey just to point out.  In SU24, there can be a Check/Maint value on S_TCODE having specific values of other tcodes that will cause additional Tcodes to enter S_TCODE of a role without being seen in the role menu.   that's why AGR_1251 / object=S_TCODE is best approach for scanning tcodes in a role IMHO.  Then you can always use Excel vlookup or even SQVI to join agr_1251 to AGR_TCODES and locate "tcodes that are in the role but not in the menu".  then with that you can scan usobt_c and usobt to locate the Tcodes causing s_tcode values to be pulled into the role.