MM Related Authorization Objects – How to Find out & Assign

Introduction & Scope:

This document explains the basic details of authorization object, how to find out and assign missing authorizations objects and what are the common authorization objects used in Materials Management module. This document does not include creation of user roles, creation of custom authorization objects, creation of authorization class etc.

Important Note: Assigning authorization is a highly sensitive transaction, which has direct impact on your customer confidentiality and user authorizations. So, kindly use this knowledge to work with your BASIS/Security team. Or, carry out the changes only with prior approval from your system administrator.

*************************************************************************************************************************************************

1. 1.       Authorization object:

Authorization object is an element of the authorization system. Authorizations are checked against objects in the system. Authorization objects enable complex checks (linked to several conditions) of an authorization. For the authorization check to be successful, the user must pass the check for each field contained in the object.

1. 2.       Field of an Authorization object:

In authorization objects, authorization fields represent the values to be tested during authorization checks. For example, Movement type in material movements, document type, plant etc in purchasing documents etc. An authorization object combines up to 10 authorization fields.

1. 3.       Finding out missing authorization object:

The most common and easiest way of finding out missing authorization is through Transaction SU53. Whenever user finds a missing authorization, User needs to enter /nSU53 in Command field and see the authorization data for the user.

Here, make a note to drill down and get both authorization object and field name. This will make the job of Basis/Security consultants easy and they can provide the required authorization correctly.

When you find such messages, go to SU53.

In SU53,

Here, Authorization object, fields and corresponding values will be displayed. This data is sufficient to provide required authorizations.

Another way of finding out Authorization object is to check in table TOBJ.

Here, in SE16N, for table TOBJ, Enter the authorization class (Say MM_E for Materials Management: Purchasing).

You can see the list of authorization object and fields relevant for entered class.

1. 4.       Assigning missing Authorization objects:

Authorization objects are assigned to user roles. First, find out the user role in Transaction SU01.

Enter the user ID and click display.Click on Roles tab and copy the user specific role.

Go to Transaction PFCG.

Enter the User Role and click on change.

Click on Authorizations Tab and click on Change Authorization data.

Click on Find (or press CTRL+F) and enter the missing authorization object identified earlier. Enter the field also, if required.

System will take you to the respective Authorization object. Click on Edit and enter the required values.Click on * if authorization needs to be provided for all the possible values of a particular authorization field.

1. 5.       List of Commonly used Authorization objects in MM Module: