Adding Object Mannully Vs. Adding Object in SU24 for Tranaction

[Former Member]

All,

What is the diff. between Adding a missing Object Mannully in PFCG Vs. Adding Object in SU24 for Tranaction ?

What is the diff. between chaning Vaule for a missing Object Mannully in PFCG Vs. Changing a value in SU24 for a Auth Ojbect ?

Please let me know.

From

PT.

______________________________

[former_member74904]

hi pranav,

the main difference would be that when adding values for transactions/objects with SU24, it will become standard throughout your client.

this means that when modifying the values for a transaction, it will appear in all roles where this transaction is added through the menu tab-screen.

this is in contrast of changing values for objects in PFCG where these changes will only affect the role you have made these changes to.

perhaps it is a good idea to think about whether it's a solution to add 'missing' objects to a transaction. there are situations where this missing object may not be missing at all under different circumstances but for the same transaction.

[Former Member]

When you add a value in su24 basically you tell the system to put that value by default when you add the object in your role maintenance.

Adding the value within pfcg only adds that value to that specific role.

[Former Member]

Hi PT,

There is no direct link between transactions and the auth objects assigned to them via PFCG. Things like config and the way transaction are used have an impact on how the auths are evaluated for a given transaction.

As you know, we use SU24 to update the SAP delivered values to meet the auth checks in our particular implementations or as per our requirements. What this enables us to do is to ensure that when we enter a transaction, all the relevant auth objects and where appropriate fixed values are pulled through (so if you know that different usages of that tx requires different values then add the object in SU24 but leave the relevant field blank). If you remove that transaction from the role, the auths that are also required are removed from the role too, as long as the role is not in Manual or Changed status.

If you manually add the auth object then you have no link with the transaction/s that are required to run the object. You can remove the transaction and the auth object value will remain in the role. If not properly managed, you can end up with excess auths still present in roles, particularly with the S_* objects and in areas like FI where it is very easy to skip between transactions through menu options where there is no S_TCODE check, with the auth object check being the only controlling one.

Manually entered objects definitely have their uses as long as they are properly documented and managed when maintaining roles.

[koehntopp]

Alex,

a huge THANK YOU for that answer. It's what we're preaching to every customer, unfortunately adoption of that knowledge takes longer than we'd like to.

If you don't properly maintain SU24, your authorizations will be a mess faster than you can say "sox audit"

This post should be a sticky....

Frank.

[Former Member]

Thanks Frank, I agree that this particular topic is one that always takes a while to get through!