My personal Supplemental Guide to Authorizations Made Easy

Transcription

1 My personal Supplemental Guide to Authorizations Made Easy Introduction to Table Security Identify Custom Authorization Groups Create a Custom Authorization Group How to Find a Table Identify Authorization Group for Table Assign a Table to an Authorization Group 1.0 Table Security The ability to display or update a table should be restricted appropriately. Table Security is highly controlled because when display or updating a table, SAP Security Organization Hierarchy is NOT checked. Thus, if a user has access to the table, the user has the ability to see all the data in the table. For example, if a user has access to table BKPF, then the user would be able to see documents including doc type GL, for all company codes because no security organization hierarchy is checked via tables. SAP intended users to access data via functional transaction codes instead of accessing tables directly. Transaction codes check security authorizations that can allow security by security organization hierarchy. However, in certain situations, tables may be required to be displayed or updated by a certain group or end-users. If a table is required to be displayed or updated, the content of the data in the table should be considered. To control the risks associated with tables, the following guidelines are to be used related to Table Security: Transactions codes SE16, SE16N, SE17, SM30, SM31 and SM31_OLD should not be given to the general end-user population. In the situation where a table is required to be granted to an end-user, a custom transaction code will be created that gives access to only the one table that is required. The custom transaction code will be mapped to the required end-user role. If a standard SAP transaction codes exits, then the standard SAP transaction code will be assigned to the role. If a custom transaction cannot be created, table access will be restricted using authorization object S_TABU_DIS or S_TABU_NAM. The creation of a custom transaction is ideal, but not each site has the bandwidth to create custom transactions. Creating custom Transactions and use of

2 objects S_TABU_DIS or S_TABU_NAM will be discussed in document Creating Custom Table Transactions and use of S_TABU_DIS/NAM. SAP tables are grouped into authorization groups, which are logical groupings of tables based on the functions the tables perform. Custom tables by default are not assigned to an authorization group. The SAP security team will assign all custom tables to an authorization group and will group the tables based on functional group (i.e., FI, CO, MM, etc.). Any custom tables that are created should be assigned to custom authorization groups: These are examples and may include additional tables and auth groups depending on the project. 2.0 Identify Custom Authorization Groups 2.1 Type in transaction SE54 and click enter. 2.2 Check Authorization Groups and click Display. 2.3 All the authorization groups, including SAP standard and custom groups will be displayed. Custom groups are created by the SAP security team and these begin with Z or a Y. If another authorization group is required to be created, the programmer should notify the SAP security team. Although the programmer has access, the programmer should NOT create another authorization group. This process is required to be followed so the SAP security team can adjust necessary security roles if another authorization group is created. Additionally, the creation of additional authorization groups is client dependent, thus needs

3 to be completed in the development client and transported. The assignment of a table to an authorization group is cross client so when the table is assigned to the authorization group in client 100, the assignment is included in all other clients (example if development has client 100, client 105, and 150) clients 105 and 150 will have the assignment without transporting. 2.4 Sample output of running SE Create a Custom Authorization Group 3.1 Type in transaction SE54 and click enter. 3.2 Click on Authorization Groups and Click the Create/Change button. 3.3 Click on the New Entries button.

4 3.4 The Table Authorization Group can only be four Characters. The name should begin with a Y or Z and should be descriptive of the tables that are being grouped together. It should be noted that a naming convention and grouping convention should have already been addressed at this time. Example you may want to create authorization groups for the following: *Basis *Security *FI In this example we created a custom auth group called ZZBA with Description of Basis Custom Tables. 3.5 Click on the Save button and the system will prompt you for a transport request to be created. 4.0 How to Find a Table 4.1 Often times a user knows the transaction they use but not the table. In order to grant access to a table (Table names T_XXX) or a table view (View names V_XXX) you must identify the name of the table.

5 For this example the user knows they use transaction OB Enter transaction OB Place cursor in any field in the table and click on the F1 button. 4.4 Click on the Technical Information Button. 4.5 The field for Table Name shows the table.

6 5.0 Identify Authorization Group for Table 5.1 Type in transaction Code SE54 and click enter. 5.2 Click on the Assign Authoriz. Group and then Display. 5.3 The following screen will appear. Check off Table Name and click execute.

7 5.3 Type in the table name and click on execute. In this example we will use the table we searched for on Transaction OB The screen shows the table name and the authorization group associated with the table. 6.0 Assign a Table to an Authorization Group. 6.1 Type in transaction code SE54 and click enter 6.2 Click on Assign Authoriz Group and click Create/Change.

8 6.3 The following screen will appear. Since we are going to be adding an authorization group to a table we will select Table Name and click on green checkmark. 6.4 Type in the table name and click the green checkmark. (for this example the table is YZSTUD) 6.5 Type in the Authorization group and click on Save. (for this example, the table YZSTUD is being added to Authorization group XXDB).

9 6.6 The system will automatically prompt for a transport request. This type of change is client independent.