[434] in SAPr3-news
Re: Authority objects and transactions
daemon@ATHENA.MIT.EDU (CorwinS)
Thu Jul 27 20:47:17 1995
To: sapr3-news@MIT.EDU
Date: 25 Jul 1995 22:47:26 -0400
From: corwins@aol.com (CorwinS)
Reply-To: corwins@aol.com (CorwinS)
SU53 and the ABAP/4 trace each have their limitations.
SU53 only reports the first authorization failure. If there are two (or
sometimes more) objects protecting a transaction you will have to add
authority to your profile then try again. This can be much more time
consuming than a trace but it does yield values.
The trace only reports objects and never values. It also reports objects
that the programmer called but if he doesn't handle the return code from
the authority check you may not be protected at all (or as thoroughly as
you think.)
Anecdotally, I have heard that SAP has some program attributes that cause
a program not to trace. This is certainly true for debug but does not seem
so for trace. If it is true for trace there could be authorization objects
that are not reported.
A third method of checking could be debugging but this is should only be
done when troubleshooting.
In our current implementation we have used traces, SU53 along with a
thorough analysis of SAP's documentation and some decent testing to
establish profiles.
SAP's profiles may be alright for a small mnufacturing company with
centralized management but that's as far as I would go with them. I do
agree that some folks try to hard to protect everything with access
control. It can cause more problems than it solves.
Corwin Slack
