SAP R/3 Document : BASIS (Authorizations – Transactions)

Different Tcodes involved in Authorizations concept :

1. Using SU24 you can set check indicators to exclude or include certain authorization
objects from authority checks. You can also use the check indicators to control which
objects appear in the PG and which fields are displayed for editing before the
authorization profiles are automatically generated

Execute the Tcode SU24

Enter a Tcode to and click on the excute icon

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

On the screen that you get, click on the Display Check ID or Change Check ID icon to
get a list of check indicators for the transaction code.

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

Select the authorization object and then click on the Display Field Values icon or Change
icon to get the list of fields and their values of the selected authorization object

You can now click on the Change icon to change the field values for the authorization
objects.

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

If you try to change a transaction code provided by SAP then the system will first ask you
to enter a Change Request number then allow you to change the value of the fields

Point the cursor on the field value that you would like to change and click it. After
sometime you should get the following box where you can change the field values.

Check or uncheck the field value check boxes and then click on the copy icon on the box
to save the changes.

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

After making the changes click on the Back icon till you come to the initial screen.

2. Using transaction SU25 (Copy initial defaults), copy the supplied SAP defaults,
tables USOBX and USOBT. This step imports the SAP check indicator defaults for
the authorization objects within a transaction and the authorization field values for
the PG into customer tables USOBX_C and USOBT_C. You can edit these values
later in transaction SU24

Here you can do fill in the default data in the profile generator customer tables by
clicking on the Initially fill the customer tables icon for installing the Profile generator

Next click on the Transport the customer tables icon.

This will transport the customer tables USOBX_C and USOBT_C and all the changes
made to the check indicators in transaction code SU24 to a transport request.

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

When you click the Transport the customer tables icon, you will first get a Message box
and after clicking the enter icon, the system will ask you to enter a Change Request
number. Click on the enter icon here to confirm the Change Request number.

Now click on the back icon to come out the SU25 screen.

The core transaction is always protected by object S_TCODE,

You can deactivate the authorizations that are not being used by the user by using the
Tcode SU24

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

You can display a generated authorization profile and its authorizations using the Tcode
SUIM. You will get the following screen :

Next, expand the Profile node and finally execute the By profile name, text

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

In the screen that you get, check the active version, generated profiles check boxes

and click the execute icon on the application toolbar. You should a list of all generated
profiles

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

Place your cursor on any of the authorization profile and click on the Choose icon on the
application toolbar and in the following screen expands the profile. You should get a list
of the authorization object that is part of that profile. You can further expand the auth.
Objs to display the authorizations till field level

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

Regenerating Authorization Profiles in the Target System

after Import of Activity Groups/Responsibilities
The system will generate a list of all activity groups with existing authorization data in
the system. Activity groups in red need to be regenerated after post-maintaining any open
Authorization fields. Select one of these activity groups and click Maintain profile. From
SUPC, call transaction PFCG.

The screen for the Tcode SUPC will look like this :

From the above screen select the radio buttons Activity Group Only, Also Act. Groups To
Be Adjusted and check the Generate automatically check box

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

Click the Execute icon on the application toolbar

If you have made any changes in the authorizations and have not regenerated the
authorizations, then you will get the ungenerated activity group in yellow color.

Select the activity group and click on generate profile icon.

You will get a pop screen.

Click on the Online button

Created By : P. M. V. Subba Rao

SAP R/3 Document : BASIS (Authorizations – Transactions)

The activity group will be generated.

Click the back icon thrice to come out

By calling transaction SU53, the user can see which authorization check failed.

Created By : P. M. V. Subba Rao