missing authorization

[Former Member]

Hello!

I have created a single role and gave some t-codes to it.But the user couldn't access some of them.There are some missing authorization.

But the problem is when I'm finding the object in the role it doesn't show ,saying 'no object found'.

Please help.

[Former Member]

Hi,

While creating the role, You need to adjust the authorizations in "change authorization data".

In authorization, try to clear the open authorization and generate profile. After that you can assign to user. Else role can't be used effectively.

Regards,

Mallikarjuna CD

[Former Member]

I adjusted the authorizations.but when I saw the su53 screenshots of the t-codes which are not running the mentioned Auth. obj is not showing in the role where I have put those t-codes.

[Former Member]

Dear

You can use S_Tcode auh object to add new T-codes and use su24 to all authrazation for that T-code

in these u can add new tcodes and u can assign all necessary auth with su24

Regards

[Bernhard_SAP]

Hello Sarita,

do you mean there are no authorizations at all (maybe except S_TCODE) containted in the role?

This would be a typical case for not filled su24 tables. You have to run su25 first (either step 1 or 2).

Documneted of course:

Setting Up the Role Administration Tool:

http://help.sap.com/saphelp_nw75/helpdata/en/52/671273439b11d1896f0000e8322d00/content.htm?frameset=...

b.rgds, Bernhard

[Former Member]

Hi,

You can manually add the missing authorization object (shown in SU53) and required values to solve the authorization error. But better you add all the related T codes in the role.

Thanks,

Joy Malakar

[Former Member]

Could you please post the SU53 screen shot .

[Former Member]

Hi,

When you add Transactions to the menu using PFCG it loads "all needed" authorization objects.

This Information is taken from the custom tables that are maintained using SU24 (USOBT_C and USOBX_C) These custom tables are initialized by SU25 and are populated from USOBT and USOBX which contain default SAP values. This step is run only once when you install SAP.

Later, using SU24 you can select which objects will be transferred to your authorization data setting the "Proposal" flag to yes and also which objects will be checked at Transaction run time using the "Check indicator". This is done per Transaction and you can or not maintain it, it is optional.

Anyway, sometimes there are more authorization objects that will be checked in the Transaction ABAP code using the AUTHORITY-CHECK command than the specified in SU24. This means that *NOT* "all needed" objects will be transferred to your role authorization data (because SAP forgot to add them?! I don't know).

At the end you'll need to add them manually to your authorization data. You need to use SU53 to detect which are the missing ones except for *some* S_ALR_xxx Transaction reports.

See notes 1050458 and 141876 as an example

I hope this Information can help you.

Regards,

A.Collet.

[kaus19d]

Lets say for example, in T-code VA02 for change in SO, the customized object ZVA2 as shown in below pic will not be available

Here is what we do, for the display users we add the users in that Role User List. Whoever in addition required for change purpose, will select for ACTIVITY=02 & will in change mode select the role like shown in pic & then select manually give the Auth-object as in pic. Also add the users list who need change auth in "User Name" area. After that need to generate the profile as well as you can ask the user to re-login to check for the changes.

Hope the pic here gives your problem solution. If you are getting the solution here then would request you to please close the matter or else if the problem is still there then would request you to run your User's t-code in user's SAP Login & run the t-code for SU53 screen shoot. If the t-code is running & then you are not able to get the missing object, then would request you to run the t-code & inside the t-code where the user is not able to select or get the change option, there need to click (or in-general case, select the drop-down menu where the issue is showing) & then only create a new session & run SU53 & then you follow my instructions for giving authorization.

All the best or else send a reply with the screenshot where the user is facing the problem.

Thanks,

Kaushik

[former_member183044]

Sarita,

The best option for missing authorization is go for the Trace. You will get the clearest idea of which authorization is missing.

Regards

Praveen