Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

s_tabu_dis

Former Member
0 Kudos

Are there any risks with limiting this to authorization groups. Aside from transactions not being able to work, and getting an authorization errors which I can perform su53 to locate the table or group needed. Will this affect how report painter works? Will this affect how a normal transactions functions ie not being able to post documents. I would just like to know what i need to look out for.

Thanks to all!

1 ACCEPTED SOLUTION

Former Member
0 Kudos

S_TABU_DIS is only to be used for restricting table access so only programs for SE16 and other similar trx will ask for this!.

That is why every customer can put any table in any group they like!

SO there are no risks in changing table groups.

Who ever we do not advise to use TRX Se16 itself but use custom trx instead.

9 REPLIES 9

Former Member
0 Kudos

Maritza,

Any AUTHORITY-CHECK statement which fails will be available in SU53.

This aside you can proactively check authorizations are available for a process/transaction by using trace (Transaction ST01).

Hope this helps.

Ashley

Former Member
0 Kudos

S_TABU_DIS is only to be used for restricting table access so only programs for SE16 and other similar trx will ask for this!.

That is why every customer can put any table in any group they like!

SO there are no risks in changing table groups.

Who ever we do not advise to use TRX Se16 itself but use custom trx instead.

0 Kudos

I understand but it is odd when a user attempted to utilize OAMK, it brought up an authorization was needed for s_tabu_dis KA .

0 Kudos

Most config tx require S_TABU_DIS access & OAMK is definitely a config tx.

0 Kudos

Maritza,

Transaction 'OAMK' is 'Change automatic posting control' and the S_TABU_DIS Table Authorization Group 'KA' is 'CO: Application tab.'.

I would suggest that this is correct as the transaction is CO related.

To see the mapping of Table Authorization Group to description you can look in table TBRGT.

Hope this helps.

Regards

Ashley

0 Kudos

As far as I know there is no possibility to find out, which value of DICBERCLS is checked in which transaction. You might get some information, when you make a list of these checks, which are automatically provided when a role is created: SE16 table USOBT and object S_TABU_DIS and LOW KA.( the Table Authorization group KA has got nearly 300 tables, see TDDAT CLASS KA ).

S_TABU_DIS is mainly used for SE16 and SM31 and as well for controlling Queries (Transaction SQ01).

0 Kudos

Hi,

As you mentioned that S_TABU_DIS is for table access, how I can give access to some of the tables through SM31?

Can you please send the details as how to do these. I am not an auth. person. So please elaborate as how I can restrict table access through SM31?

Thanks in advance

Prash

0 Kudos

Pls contact you security admin as they will probably tell you that access to tables via Sm31 should never be granted!!!

They will also know how to restrict access in S_TABU_DIS if neede for other TRX!

A functional consultant should be able to tell you the "NORMAL" transaction to access the tabel wanted.

Former Member
0 Kudos

Hello Maritza,

Which release are you on?

The user might have a reason of some sort to want to be able to change automatic account determination in production - so for them it should be "master data", and not "company customzing" settings.

My guess is also that you meant 'AC' and not 'KA'. In release 4.6C the system checks S_TABU_DIS 02 AC upfront when you start the transaction (you can see this when displaying the transaction in SE93).

If you look in SE93 and see that it is a parameter transaction of SE34, then take a look in SUCU / SE54 to see whether a symbolic table '&SM3*&' has been assigned the table authorization group 'KA'.

This would not make sense to me, because 'KA' is also a real group with real tables assigned to it.

Cheers,

Julius

Message was edited by:

Julius Bussche