SAP Library - Find your answers

When a user starts a transaction, the system performs the following checks:

• The system checks in table TSTC whether the transaction code is valid and whether the system administrator has locked the transaction.
• The system then checks whether the user has authorization to start the transaction. The SAP system performs the authorization checks every time a user starts a transaction from the menu or by entering a command. Indirectly called transactions are not included in this authorization check. For more complex transactions, which call other transactions, there are additional authorization checks.
  • The authorization object S_TCODE (transaction start) contains the field TCD (transaction code). The user must have an authorization with a value for the selected transaction code.
  • If an additional authorization is entered using transaction SE93 for the transaction to be started, the user also requires the suitable defined authorization object (TSTA, table TSTCA).
    If you create a transaction in transaction SE93, you can assign an additional authorization to this transaction. This is useful, if you want to be able to protect a transaction with a separate authorization. If this is not the case, you should consider using other methods to protect the transaction (such as AUTHORITY-CHECK at program level).
• The system checks whether the transaction code is assigned an authorization object. If so, a check is made that the user has authorization for this authorization object.
  The check is not performed in the following cases:
  • You have deactivated the check of the authorization objects for the transaction (with transaction SU24) using check indicators, that is, you have removed an authorization object entered using transaction SE93. You cannot deactivate the check for objects from the SAP NetWeaver and HR areas.
  • This can be useful, as a large number of authorization objects are often checked when transactions are executed, since the transaction calls other work areas in the background. In order for these checks to be executed successfully, the user in question must have the appropriate authorizations. This results in some users having more authorization than they strictly need. It also leads to an increased maintenance workload. You can therefore deactivate authorization checks of this type in a targeted manner using transaction SU24.
  • You have globally deactivated authorization objects for all transactions with transaction SU24 or transaction SU25.
  • So that the entries that you have made with transactions SU24 and SU25 become effective, you must set the profile parameter AUTH/NO_CHECK_IN_SOME_CASES to “Y” (using transaction RZ10).

All of the above checks must be successful so that the user can start the transaction. Otherwise, the transaction is not called and the system displays an appropriate message.

Checking Assignment of Authorization Groups to Tables
You can also assign authorization groups to tables to avoid users accessing tables using general access tools (such as transaction SE16). A user requires not only authorization to execute the tool, but must also have authorization to be permitted to access tables with the relevant group assignments. For this case, we deliver tables with predefined assignments to authorization groups. The assignments are defined in table TDDAT; the checked authorization object is S_TABU_DIS.

What are the checks that the SAP authorization tool performs when a TCODE is executed in order to ensure authorization of that user?

EXPERT RESPONSE

When initiating a transaction, a system program performs a series of checks to ensure the user is authorized.

1. The program checks whether the transaction code exists in table TSTC.

2. The program checks whether the transaction code is locked by the administrator (transaction code SM01).

3. The program checks whether the user has the authority to start the transaction. Authorization object S_TCODE (transaction start) contains the authorization field TCD (transaction code). The user must have the appropriate authorization for the transaction code to be started (for example, FK01, Create Vendor).

4. The program checks whether an authorization object is assigned to the transaction code. If this is the case, the program checks whether the user has an authorization for this authorization object. The transaction code/authorization object assignment is stored in table TSTCA.
Note: An SAP program controls steps 1 through 4. It displays an automatic message to the user if an authorization attempt fails in the step.

5. The system performs authorization checks in the ABAP program using the ABAP statement AUTHORITY-CHECK.

Keyword: BASIS
Title : Authorization Checks

When a transaction is called, a system program makes various checks to
ensure that the user has the appropriate authorization.
1. Is the transaction code valid? (table TSTC check).
2. Is the transaction locked by the system administrator? (table
TSTC check).
3. Is the user authorized to call the transaction?
4. The authorization object S_TCODE (call transaction) contains the
field TCD (transaction code).
5. The user must have an authorization with a value for the selected
transaction code.
6. Does the transaction code have an authorization object? If so, a
check is made that the user has authorization for this authorization
object.
Then there are check at ABAP program level and if these checks
are succesful the the authorization checks are successful. If any one
of the checks fail, the user cannot execute the tcode.

When a transaction is called, a system program makes various checks to
ensure that the user has the appropriate authorization.

Is the transaction code valid? (table TSTC check).

Is the transaction locked by the system administrator? (table
TSTC check).

Is the user authorized to call the transaction?


The authorization object S_TCODE (call transaction) contains the
field TCD (transaction code).

The user must have an authorization with a value for the selected
transaction code.

Does the transaction code have an authorization object? If so, a
check is made that the user has authorization for this authorization
object.

Then there are check at ABAP program level and if these checks
are succesful the the authorization checks are successful. If any one
of the checks fail, the user cannot execute the tcode.

Keyword: BASIS
Title : DB Administration: Periodic Checks