What is the use of Authorization Checks? ABAP Interview Questions

To ensure that a user has the appropriate authorizations when he or she
performs an action, users are subject to authorization checks.

The following actions are subject to authorization checks that are performed
before the start of a program or table maintenance and which the SAP
applications cannot avoid:

· Starting SAP transactions (authorization object S_TCODE)

· starting reports (authorization object S_PROGRAM)

· Calling RFC function modules (authorization object S_RFC)

· Table maintenance with generic tools (S_TABU_DIS)

In coming posts, we will see how to add authorization checks for Reports and
transactions.

Today we will discuss about table authorization checks.

Purpose of assigning authorization groups for tables:

You can assign authorization groups to tables to avoid users accessing tables
using general access tools (such as transaction SE16). A user requires not only
authorization to execute the tool, but must also have authorization to be permitted
to access tables with the relevant group assignments. For this case, we deliver
tables with predefined assignments to authorization groups. The assignments
are defined in table TDDAT; the checked authorization object is S_TABU_DIS.

Now we will see how to assign/create authorization group for a table:
Go to SE54, Give the table name and choose authorization group and then click
on create/change. You can
create an authorization group.

Example:

You can assign a table to authorization group Z001. (Use transaction SM30 for
table TDDAT) A user that
wants to access this table must have authorization object S_TABU_DIS in his or
her profile with the value
Z001 in the field DICBERCLS (authorization group for ABAP Dictionary objects).

Authorization Check:
In the earlier post, we came to know the importance of authorization check in real
time environment. We know how to check authorization for table maintenance.
(Please refer earlier post).
Now we will see how to check authorization for Reports, Transactions, RFC
function modules.

The following actions are subject to authorization checks that are performed
before the start of a program or table maintenance and which the SAP
applications cannot avoid:


 Starting SAP transactions (authorization object S_TCODE)
 starting reports (authorization object S_PROGRAM)
 Calling RFC function modules (authorization object S_RFC)
 Table maintenance with generic tools (S_TABU_DIS)

The authorization objects S_TCODE, S_PROGRAM, S_RFC, and S_TABU_DIS
are standard SAP provided.
Creating a new authorization object is not in the scope of ABAP developer. It will
be taken care by SAP BASIS team.

To add authorization check to your program, you need to add the following code in
your report. Imagine that you have created a transaction code for your report, then
you should use the authorization object S_TCODE to check the authorization.

You can place the code in initialization event.

*Initialization
INITIALIZATION.
AUTHORITY-CHECK OBJECT 'S_TCODE'
ID 'TCD' FIELD 'ZEXAMPLE'.

IF sy-subrc <> 0. "Not Authorized
MESSAGE e003(ZZ) WITH 'TCD' 'ZEXAMPLE'.
ENDIF.

Here zexample is the transaction code created for the report.