SAP ABAP Authorizations / SAP Authorizations

SAP ABAP Authorizations / SAP Authorizations

While writing code in ABAP for example reports/interfaces/enhancements developers should take care that the Authorizations are taken care of. In ABAP code the SQL statements (Database Access) does not trigger Authorizations. This makes the code vulnerable. A program that has been transported to production without proper authorizations gives access to all the data that the SQL and Native SQL statements are querying to any user who is executing that program.

Hence it becomes mandatory for the developer to take care of Authorizations in the code.

SAP Authorization Concept

In SAP Authorization are user specific and in the user master record the authorization is assigned. Data in SAP must be protected so that only those users who have permission should be able to access the data. For example certain users may have access to Sales Side data amongst these users certain users may have permission only to view the data and other to change it. Also certain users may have permissions only to view MM side data.

Authorization Objects are used to take care of the Authorizations in SAP. Each Authorization Object can have 10 fields.

As a developer if required you can create your own Authorization Object. For example if you create an Authorization Object Z_Sales then it can have 2 authorization fields and the activity field can have  3 actions associated with it like create (01), change (02) and display (03).

Important tables associated with Authorization are as follows

Some of the tables associated with SAP Authorizations.

TACT        Activities which can be Protected
TACTZ      Valid activities for each authorization object
TSTCA      Values for transaction code authorizations

For example customers can be divided into certain regions say NORTH, SOUTH, EAST, WEST.

and the Authorization object S_Sales has a filed REGIONID to define the region, then you can create an authorization object as follows.

Aythorization Object                        Authorization Display for S_SALES
S_SALES                                           REGIONID '*'  (For All Regions)
REGIONID (Region)                         ACTVT 'DISPLAY'
ACTVT (Activity)                          

S_SALES                                           REGIONID 'NORTH'  (Only North Region)
REGIONID (Region)                         ACTVT 'CHANGE'
ACTVT (Activity)                          

This object shows how to restrict certain users from changing customer data not related to regions in SOUTH, EAST and WEST.

Transactions associated with Authorization Objects are as follows

SU20  Fields
SU21 Objects