The new authorisation class will be shown in the tree structure. The creation of own authorisation objects will start with the creation of a new authorisation class.Ĭlick icon – and create a new Authorisation Object Class. In SU21 all authorisation classes will be displayed as folders and the authorisation objects are displayed within these folders. The screen shots will document 2 topics which might help to get started on new ideas. They will explain how we can easily create customer authorisation objects and related to the topic of the blog they will show a really simple implementation of the BAdI.Ĭreation of an new authorisation object – Transaction SU21 I like to enable people to start trying and playing even if they have not used BAdIs and ABAP as much. But I think that everybody should get the chance to read through and to understand. Maybe some of you might find that there are too many screen shots in here. That will allow to follow the idea I have described above. Following I will provide the screen shots of my answer. It is fantastic.Īs mentioned earlier there was a question in the SDN forum about an authorisation check on the Payroll area. You can think about many options which SAP provided us with that BAdI. The doors are open for all sorts customer enhancements of HR security. And last but not least as long as we call the check of the authorisation object in the good old ABAP standard way, the result will show up in a security trace (transaction ST01). Even more, that example would do the check only for certain infotypes. How good is that? That example will allow to check authorisations for a cost centre of an employee when accessing HR data. If standard checks are passed we can check additional customer specific criterias for the user who tries to get access to that specific infotype. Our customer check could for example look up the employee assignment to a cost centre. With the employee cost centre it could then call the authorisation check on authorisation object K_CSKS. In that case we could call the SAP standard authorisation check first. Here we can implement additional checks for certain and critical infotype records. Once this is done select the method you want to enhance and call additional checks in the method.įor example method ‘CHECK_AUTHORIZATION’. When the BAdI will be switched on always start with the implementation of every method and call the SAP standard authorisation class method with the same name. That is something what I would recommend. The implementation will switch of the HR standard authorisation checks but no worries they can easily be called from our BAdI again. There are some things we should know about the BAdI when we start using it. The BAdI which will help us to enhance the HR Authorisations is HRPAD00AUTH_CHECK

Rich Heilman provided a good wiki on that:

BAdIs are places in the SAP standard which allow to add customer specific logic without changing standard. Now the Payroll Area is not included in P_ORGIN and it will be hard to find a HR authorisation object which will do the check.īut SAP is prepared for these sorts of specific needs in the area of HR security. He was after a solution to check whether the user has access to a certain Payroll Area.

Re: Authorizations for report PC00_M99_CIPE by field PayrollArea Just a few weeks ago I found some SDN member with a quite similar issue in the forum. There might be a manager who has responsibility for a cost centre but their cost centre might not be the only one with employees in a certain HR org unit. And who says that the HR organisational structure will match the Cost Centre or Profit Centre hierarchy of the company. Additionally a HR organisational structure check can be called to find out if the user has access to the part of the structure of the employee. The first option will mainly work with SAP authorisation object P_ORGIN. The second option however requires to switch on and to maintain at least HR structural authorisations.Ī look at P_ORGIN will quickly show that there is no field cost centre or profit centre available. SAP HR security is mainly based on the organisational assignment of employees which is stored in Infotype 0001 of the employee master record. In my recent work I came across some questions if or how it could be achieved to check if a user with Finance/Controlling Authorisations can see employees of their cost centres or profit centres only.

Std checksite