Transaction variant for SM37

[Former Member]

Hi all,

I am trying to create a transaction variant for the "job overview" screen - this is the screen after you have selected the list of jobs. I have the deactivated some items "menu functions" - program SAPLBTCH - status - JOV_STATUS, but there are not working when I test these.

Any ideas ?

[Former Member]

Hi JC,

For what it's worth, I have not seen anything like that before.

What I do know is that you can use S_BTCH_JOB JOB_ACTION field to control the menu's for release, delete, etc, however these are overwritten if an authority-check on S_BTCH_ADM = Y is successfull. But I guess you already know that .

There was a thread recently about a similar topic (see ) for the start condition screen. I couldn't make it work, but there might be a (btc)option for the job overview (perhaps I was looking in the wrong place).

Even if you do create a variant transaction, try to navigate back and forth a bit or use the "job overview" button in other transactions.

Cheers,

Julius

[Former Member]

Julius,

Thanks.

Yes the role will require S_BTCH_ADM so can't use S_BTCH_JOB to control access. The transaction variant works fine for the first screen of SM37 since I can create a screen variant for it, but the job overview screen is apparently a "menu" screen. I could modify the user interface in menu painter but then that is a code modification.

[Former Member]

Hi JC,

Why does the user require S_BTCH_ADM? (Don't believe the trace! Look at the code in the trace...)

If they have S_BTCH_ADM (which they do not need to use SM37 client dependently) then you have anyway lost your control on most things S_BTCH_JOB related. What makes the job status in the overview a requirement? Perhaps there is a better way?

Cheers,

Julius

[Former Member]

These are not end users, but technical support people. The auditors - in their wisdom - have deemed certain functions should not be available. So what I am trying to achieve is to allow all admin access on any job in SM37, but with certain functions removed.

[Former Member]

Which functions do they want you to remove? The client overview? The debugger?

[Former Member]

In the Job overview screen, the ability to "delete".

[Former Member]

Hi JC,

This is how it works (sorry for the German :-):

*   Pruefen der Loesch-Berechtigung,
*   Eigene Jobs duerfen ohne weitere Pruefung gelscht werden.
*   Jobs anderer Benutzer drfen nur gelscht werden, wenn Lsch-
*   berechtigung bzw. Batchadministratorberechtigung vorliegt.
*
  IF tbtco-sdluname <> sy-uname.
    AUTHORITY-CHECK OBJECT 'S_BTCH_JOB'
      ID 'JOBGROUP'  FIELD '*'
      ID 'JOBACTION' FIELD 'DELE'.
    IF sy-subrc > 0.
      PERFORM check_batch_admin_privilege.
      IF batch_admin_privilege_given EQ btc_no .
        PERFORM deq_tbtco_entry
          USING
            jobname jobcount retcode.
        MESSAGE s125
          WITH
            tbtco-jobname sy-uname.
        RAISE no_delete_authority.
      ENDIF.
    ENDIF.
  ENDIF.

... and check_batch_admin_privilege is...

*---------------------------------------------------------------------*
*      FORM CHECK_BATCH_ADMIN_PRIVILEGE                               *
*---------------------------------------------------------------------*
* Prüfe, ob Benutzer Batchadministratorberechtigung hat. Diese Routine*
* setzt die globale Variable BATCH_ADMIN_PRIVILEGE.                   *
*---------------------------------------------------------------------*

FORM check_batch_admin_privilege.

  AUTHORITY-CHECK
    OBJECT 'S_BTCH_ADM'
        ID 'BTCADMIN' FIELD 'Y'.

  IF sy-subrc EQ 0.
    batch_admin_privilege_given = btc_yes.
  ELSE.
    batch_admin_privilege_given = btc_no.
  ENDIF.

ENDFORM. " CHECK_BATCH_ADMIN_PRIVILEGE.

So, if you do not give up the S_BTCH_ADM to be able to use the S_BTCH_JOB job_action 'DELE', then you cannot.

But it works like this for many of the S_BTCH_JOB checks, so perhaps the support users do not really need the S_BTCH_ADM?

As a compensating control, you can consider SAP note 850885 with some organizational measures (e.g. training) around it.

Cheers,

Julius

[Former Member]

Hi Julius,

Thanks for all your efforts. Yes S_BTCH_ADM is needed since the team needs admin access to other ids jobs, but just not to delete them. The OSS note is useful but it is only relevant for SAP 6.0 and up and my client is on 4.7. I activated logging on the job tables so this will give them a compensating control.

[Former Member]

Hi JC,

Yes, there is a check on S_BTCH_ADM there, but it is only needed to extend the overview to other clients. It does not restrict the overview to other users within the same client.

Cheers,

Julius

[Former Member]

Yes - but with only the auth object S_BTCH_JOB - no admin functions like change or copy are available for jobs that belong to another id. You need S_BTCH_ADM for that.

[Former Member]

True, but it does permit action 'DELE'.

Cheers,

Julius