Organisationally restrict table editing permissions
Background processing
Are you using SAP NetWeaver Business Client instead of SAP GUI? The arrangement of the applications on the screen is controlled by PFCG roles. The SAP NetWeaver Business Client (NWBC) is an alternative to SAP GUI for access to SAP applications. This allows you to centrally access applications that reside in different SAP systems and have different UI technologies. The NWBC enables you to call not only transactions, but also Web-Dynpro applications and external service applications. In this tip, we will show you how to use PFCG roles to control the design of the NWBC user interface.
Employees should only be able to access data relevant to their work, country or accounting area in tables? Set up organisational criteria to ensure this. Do you want users to be able to read or maintain specific tables, but only have access to the table contents that are relevant to them? The S_TABU_DIS and S_TABU_NAM permissions objects allow you to access the tables, but if you want a user to see or maintain only parts of the table, these authorization objects will reach their limits.
Correct settings of the essential parameters
You can limit the recording to a specific user. You can also use the trace to search only for permission errors. The evaluation is similar to the evaluation of the system trace in the transaction ST01. In transaction STAUTHTRACE, however, you can also evaluate for specific authorization objects or for specific permission check return codes (i.e. after positive or negative permission checks). You can also filter multiple entries.
Business objects to which companies refer authorizations are defined in the system as authorization objects. For individual conditions, SAP delivers the authorization objects F_FICO_IND and F_FICO_AIN. With F_FICO_IND you can define which individual conditions are checked when processing the contract depending on the defined authorization fields and their characteristics. Using the authorization object F_FICO_AIN, companies can define whether and how individual conditions are to be checked when processing in the BAPI channel depending on the defined authorization fields and their characteristics.
Authorizations can also be assigned via "Shortcut for SAP systems".
In addition, various technical system components must be analyzed and adapted to the new environment.
Since the report updates automatically, companies have no additional effort to document the changes - one less unloved (and often "forgotten") task.