Security - HR Authorizations

[Former Member]

What report will be able to provide me the role and the infotype it is associated with and the authorization values.

[jurjen_heeck]

> What report will be able to provide me the role and the infotype it is associated with and the authorization values.

I haven't got an HR system within reach, but PLOG and P_ORGIN come to mind as objects to look for. They also have a counterpart for structural authorizations, with a longer name, so if you search table AGR_1251 for roles containing objects PLOG* and/or P_ORGIN* you should find your roles. Maybe the SUIM report Roles -> by authorization object (report RSUSR070) will help as well.

Jurjen

[Former Member]

Typically SUIM is utilized but I would like roles and all the authorization objects and the authorization values. For example, p_origin, p_abap, infotype, and the authorization values.

Thanks

Maritza

[Former Member]

See [this thread|].

>

> Unforutanately the resultlist is not expandable completely, you have to check role by role.

That would be from SUIM navigability. The problem as I see it is that all the AGR* tables for role analysis may be incorrect if the authorization data of the profiles are not correct. And composite roles make this much more complicated as well...

Cheers,

Julius

[jurjen_heeck]

> Typically SUIM is utilized but I would like roles and all the authorization objects and the authorization values. For example, p_origin, p_abap, infotype, and the authorization values.

Maritza,

Search table AGR_1251 (with SE16) for all roles containg fields called INFTY or INFOTYP. Those are the fields holding the infotypes so the roles you'll find with this query are the ones (i think) you're looking for.

To have a look at other objects and values explore this table for all found roles as well as tables AGR_1250 (objects per role) and AGR_1252 (organizational field values).

As Julius pointed out, difference between roles and profiles can make this information unreliable so you have to make sure all profiles are generated properly. (which in my opinion should always be the case)

Hope this helps

Jurjen

[former_member74904]

perhaps I'm being slightly off-topic here, but I find using the RHANALYSIS_TOOL (T-code: HRAUTH) to be quite useful for this.

this actually displays HR authorization per user only in the same manner report RHUSERRELATIONS does.

if you, for example, have a (test)user who is assigned to all HR roles you will be able to get an overview of all related objects and their values.

I hope this helps a litlle.