how to restrict developers access to create TR but allow to create TOC

[Former Member]

I have a new problem in SOLMAN 7.1 SP14 I have never seen before.

We want Developer in CHARM to be able to create and release TASK only - i.e. transport is created and released by the team lead.

Though when development is done by the Developer, he must be able to "Pass NC to Test" - meaning he must be able to create and release TOC.

What we found here is that we no longer can rely on the person's own authorizations in DEV system , because everything in TMS is taken over by TMW RFC and user from that RFC SMTM<SID> that has full authorizations S_CTS_ALL. So basically even without authorizations in DEV to create/release transport the Developer will be able to do that via user SMTM<SID>.

The only way to restrict it now is by the auth. object /TMWFLOW/D by giving only specific numeric actions to Developer, like 2000- "Create TR Task" and not allowing 1000- "Create TR" and 3000-"Release TR".

However there is no specific code for "Create TOC" in this auth. object...

So if I give 1000 to Developer - he will be able to create TOC AND TR.

If I do not give 1000 to Developer - he will not be able to create either, meaning, he will not be able to execute "Pass NC to Test" - which we need him to be able to do.

Is there any other way to control "Create TR vs Create TOC" authorizations in CHARM ?

As far I know in SP13 it was checking the user's own authorizations first before switching to TMW RFC user to perform action, seems like now RFC user is taking over the complete execution in backend.... 

Looking for any suggestions.

Thank you in advance

Elena

[Former Member]

SAP support says this behavior is standard now, and to restrict it further customization is required.

Anyone knows how to customize this ?

I would think a new auth object needs to be created under /TMWFLOW/D authorization.    Looking for suggestions how to do this.....

Any suggestions ? Anyone ?

Thank you

Elena