Authorization...

[Former Member]

Hi,

We have already setup SAP_ALL_DISPLAY Profile for test purpose andits working fine in all cases..

But our problem is we have some Z programs which will insert data in to database when we execute it and we can see that in table mentioned..using se11..

Is there any way ie:Auth object or any other to way to avoid insering into database at Authorization level instead of program level...

Regds,

Satyanarayana N.

[Former Member]

Hello Satya,

You need to change the program in this case. I mean authorizations also run on a logical code. Independently they are useless entities!

Regards.

Ruchit.

[JPReyes]

I might have missunderstood the question but as far as i can see... he need to restrict "execute" for this Z programs, right?

Regards

Juan

[Former Member]

Hi Juan,

Not necessary that you may have misunderstood the question.It could be me as well. Again it is a question of perception. My understanding is based on this statement:

" Is there any way ie:Auth object or any other to way to avoid insering into database at Authorization level instead of program level..."

What I understand from this is that Satya wants to ensure that will the reports can get executed but they don't insert data into tables. This should either be absolute or at the max allowed for certain users. In either cases code needs to be changed.

However if your understanding is correct then yes he needs to remove access to Z programs execution for which ST05 is one of ways to proceed.

regards.

Ruchit.

[Former Member]

Hi,

I see a similar perspective from Ruchit...may be there are 2 ways..

1. To edit the code and insert a standard or Z auth object which gets called during execution of the report. If we can restrict this object then Display all works...

2, Restrict the Tcode to the users having Display All profile by removing Z* in S_TCODE object and provide a range that excludes this tcode.

Hopefully i see them as logical ways for his query...

Rgds,

Sri

[Former Member]

Hi Friends,

Thanks for alll your valuable suggestions..

My issue was not solved..

Here I rephrase it again..

We are about 10 maintainence members and we would like ro have display operations only for production environment..

Problem:We have some Z* programs which has Insert code written.. and whenever we execute that program an entry is written to the appropriate table.. and when we check that table in se16 we are able to see that entry even tough display mode operations have been set..

We would like to know whether we can restrict insert access to this z* programs to the list of users ..

Or Any other suggestion from your end..

Regds,

Satyanarayana N.

[JPReyes]

The only way to restrict access to Z programs will be remove auth for SE38 and or any transaction that call the Z program...

Also, you can create modified versions of those programs that only query the data without inserting information.

Regards

Juan

[Former Member]

Hi,

As said by Ruchit that I would like to restrict execute to Z* Programs and that can be done by ST05..

Could you please let me know the exact procedure and any other alternatives..

Regds,

Satyanarayana N..

[Former Member]

Hello Satya,

You have got my point wrongly and infact you seek to do something different. Using ST05 you can run an authorization trace of what all authorization objects are checked while executing the reports and not actually restict the authorization to execute them. Once you have the trace ready you need to analyze it and then remove access to the authorization values (not entire objects) that are being displayed in the trace.

However if the reports do data insertion and you don't want that to happen then why do all this unecessary hardwork. I would in this case stick to Juan's approach and remove access to Z reports. However if apart from insertion the reports independently do some data reading then I would go for ST05 route. But I dont know why you are using reports for data insertion. Long time back when I learnt ABAP I was told data updates should be normallydone using dialog programming and reporting should for only reading data. Not that updates using reports is totally barred but is not the best approach.

Regards.

Ruchit.

[Former Member]

Hi,

AS said by ruchit that we rae not using reports for data insertion we rae using programs that will insert data in to table specified by program..

All I want to know is how we can restrict access to z* programs and is it possible to avoid only execution of z* programs and display should be possible.

Pls suggest.. and let me know the restriction procedure for z* programs..

Regds,

Satyanarayana N.

[Former Member]

Hi Satya,

In case you are using SE38 for execution then remove access using S_Program authorization object.

Regards.

Ruchit.

[JPReyes]

You must be able to remove authorisation to execute those Z programs...

Just trace the user and remove right to execute on the right auth objects.

Regards

Juan

[Former Member]

Hi,

How can we trace the user is it using ST05..

If Iam wrong please let me know the transaction and procedure to trace and remove the Auth object..

Regds,

Satyanarayana N.

[JPReyes]

User Trace is ST01... you tick "authorization check" and filter the user...

Regards

Juan