Best way to control display authorizations to GOS (attachment list) in XK03

[former_member204634]

Hello All

Purpose: Prevent users to access confidential attachments in XK03 which contains bank account details - SSN etc., I tried to check through all existing forums, solutions etc. but please pardon if there is an obvious solution that I might have missed.

I tried multiple approaches:

(a) Option A is to secure at source - when vendor admin is uploading the attachment containing SSN details, please make sure to mask/block/encrypt whatever it takes to not to make SSN public for general consumption.

(2) Option B - OB23 -> this seems to help to suppress data at field level while we are focusing specifically on attachments

(3) Object F_LFA1_GRP -> vendor account group - can we create an account group for confidential vendors ->  potentially not an option as I understand all account groups can have confidential attachments, again its not about restricting access to account groups information just the attachments across all account groups.

(4) F_LFA1_BUK - on basis of company code - seems not relevant as behavior of authorization access to GOS should remain consistent across all company codes

(5) S_GUI -> seems plausible - if an user doesn't have authorization to download/upload/print - they can't actually view the attachments since they can't either upload/download/print of display from attachment list option.

But this object is too generic to be used for a particular t-code and one solution with least amount of customization is to link XK02/XK03 GOS functionality with an custom S_GUI (though I know sound of "custom s_gui" isnt pleasing at all) which doesn't allow document upload/download/print for users who should only have XK03 access while provides access to vendor admins who need access to upload attachments via XK02

(6) S_OC_ROLE - this object allows adding/deleting attachments for an user in GOS but you can only upload if you have S_GUI and can really view if you have S_GUI (seems I am own remote desktop - would that be an reason that S_GUI is coming into play heavily - I dont think so - thinking out loud)

(7) S_GOS_ATT - this is the first authorization object to be checked for authorizations to change/delete attachments from attachment list - and if an user doesnt have this object then next check is placed on S_OC_ROLE as per my investigation, (SAP NOTES: 1293080 and 1539457). This object only has 02/06 at activity level.

so based on investigation, most suitable solution at this stage based on initial research involves creating an custom s_gui, only giving access to vendor admins to this object, modify the GOS function module for XK02/XK03 to place authority check on this object, update su24 (all the usual std. steps etc. etc.), and not allow XK03 only user (i.e users who are only meant to display and are not vendor admins) to not to have S_GOS_ATT for object LFA1 (Vendor data) and also not to allow them access to S_OC_ROLE so that they dont delete/ any uplaoded attachments even by mistake.

Still better and most natural solution would have been to add an activity 03 in object S_GOS_ATT and allow display of data only through this object .. thinking if I should raise a SAP OSS incident to allow for this functionality ?

Please share your experiences/approach and thanks for your time!

[mvoros]

Hi,

If I remember correctly there is a standard BADI from SAp that allows you to implement more granular access to attachments. I would go this way and create new auht. object.

Cheers

[former_member204634]

Thanks Martin !!

Yep I was able to achieve the required granularity of authorization via BADI GOS_SRV_REQUEST.

Thanks again !!

[former_member669968]

Would you mind sharing how you achived it? We have similar requriement where I want to get document level locking in the display mode of the Vendor

Thanks,

Shruti

[former_member204634]

Hi Shruti

Sorry for the late reply, is your query resolved ? We just tied authority checks within BADI GOS_SRV_REQUEST to allow for authorization check on who can display/upload/download documents for object LFA1 .. at the same time auth object S_GOS_ATT was changed to include activity 03 for display (i.e Vendor t-codes  XK02/03). You should be able to get it implemented with help from an ABAP Consultant. Something on similar lines is available in the following thread:

Hope this helps.

Thanks

Prashant