"In SAP for logging in to the system you need a user ID and a password. This user ID is created by the system administrator. The first time you login to the SAP system you need to change that password which has been assigned to you while creating the user ID. Every user ID will have certain roles assigned to it. The System Admin (Basis Administrator) is responsible for creating these roles after consulting the Functional team. Each user will typically have several roles assigned to their user ID. The user roles are predefined in the SAP system and each employee would have a combination of several roles which have been predefined in the SAP system. The roles are defined using the activity groups in the SAP system. A proper understating of the activity groups is necessary for creating and assigning Roles in the SAP system. Once a pre-defined user role is assigned to a user the system then automatically displays the appropriate User menu when the user logs on and provides the required authorization. An activity group can contain Transactions, Reports, Files, Web Links. Once the activity group has been assigned it defines the user specific menus. Once the user logs on to SAP a user specific menu is displayed this menu is controlled by the activity group that has been assigned to the user. To display a list of descriptions of the pre-defined user roles, select Tools---- Administration----User Maintenance--'Repository Infosys--' Activity Groups----' List of activity groups according to complex selection criterion---' Selection according to activity group name or call transaction S_BCE_68001418. The pre-defined user roles are delivered as templates and have names beginning with 'SAP_' and suffix _AG. Composite activity groups can be built with individual activity groups. A composite activity group does not contain any authorization."
"A subset of Standard SQL that is fully integrated in ABAP is Open SQL statements. Their role is to help you by giving permission to access data irrespective of the database system, which the R/3 installation is using. The Data Manipulation Language (DML) part of the Standard SQL is present in the Open SQL. In other words, it gives you the permission to read (SELECT) and change (INSERT, UPDATE, DELETE) data. In the R/3 system, the tasks of the Data Definition Language (DDL) and Data Control Language (DCL) parts of the Standard SQL are performed by the ABAP dictionary and the authorization system."
The SPA SET PARAMETERS and GPA GET parameters is a useful way in passing values to SAP memory. Using these Parameters you can pass values to SAP programs and even get values generated from SAP Programs.
SPA/GPA parameters are values that the system stores in the global, user-specific SAP memory. It is important to note that the values are stored in GLOBAL and User-Specific Memory.
A Parameter ID can be 20 Characters long.
You can pass values to the SAP memory using SET PARAMETER ID <pid> field <f> and get the values from the SAP Memory using GET PARAMETER ID <pid> field<f>.
On a selection screen, you link fields to parameters using the MEMORY ID addition in the PARAMETERS or SELECT-OPTIONS statement. If you specify an SPA/GPA parameter ID when you declare a parameter or selection option, the corresponding input field is linked to that input field.
Now we will see an example as to how SET PARAMETER and GET PARAMETER can be used in a real life Scenario.
Suppose you want to call a Transaction and Skip the Initial Screen. For example in transaction VA01 if the parameters on the initial screen are fixed and you want to preset to the user screen no 2. then it can be done as follows.
data: d_order_type_field like vbak-auart value 'OR'.
SET PARAMETER ID 'AAT' FIELD d_order_type_field. CALL TRANSACTION 'VA01' AND SKIP FIRST SCREEN.
Please not that the PARAMETER ID AAT can be obtained by pressing F1 on the filed. See the figure shown below.
You can also get the latest Order number from SAP using GET PARAMETER ID as follows.
data: d_order_no like vbak-vbeln.
Code for BDC. GET PARAMETER ID 'AUN' FIELD d_order_no.
While writing code in ABAP for example reports/interfaces/enhancements developers should take care that the Authorizations are taken care of. In ABAP code the SQL statements (Database Access) does not trigger Authorizations. This makes the code vulnerable. A program that has been transported to production without proper authorizations gives access to all the data that the SQL and Native SQL statements are querying to any user who is executing that program.
Hence it becomes mandatory for the developer to take care of Authorizations in the code.
SAP Authorization Concept
In SAP Authorization are user specific and in the user master record the authorization is assigned. Data in SAP must be protected so that only those users who have permission should be able to access the data. For example certain users may have access to Sales Side data amongst these users certain users may have permission only to view the data and other to change it. Also certain users may have permissions only to view MM side data.
Authorization Objects are used to take care of the Authorizations in SAP. Each Authorization Object can have 10 fields.
As a developer if required you can create your own Authorization Object. For example if you create an Authorization Object Z_Sales then it can have 2 authorization fields and the activity field can have 3 actions associated with it like create (01), change (02) and display (03).
Important tables associated with Authorization are as follows
Some of the tables associated with SAP Authorizations.
TACT Activities which can be Protected TACTZ Valid activities for each authorization object TSTCA Values for transaction code authorizations
For example customers can be divided into certain regions say NORTH, SOUTH, EAST, WEST.
and the Authorization object S_Sales has a filed REGIONID to define the region, then you can create an authorization object as follows.
Aythorization Object Authorization Display for S_SALES S_SALES REGIONID '*' (For All Regions) REGIONID (Region) ACTVT 'DISPLAY' ACTVT (Activity)
Always specify your conditions in the Where-clause instead of checking
them yourself with check statements. The database system can then use an index
(if possible) and the network load is considerably less.
Always use Pretty Printer and Extended Program Check before releasing the code.
Do not leave unused code in the program. Comment the code thoroughly. Align the comments and the Code. Follow the SAP Standards and SAP Best Practices guidelines. It’s a good practice to take a dump of the code on your local drive.
