Skip to Content

Introduction:

More than once I have seen mistakes made with security and development to assign custom transaction codes to standard SAP reports because no one can find the standard assigned transaction code for a report. This blog will show a common mistake made by security, analyst, and sometimes ABAP resources when looking for transaction codes associated with standard SAP reports.

Intended Audience:

  • Security
  • Analyst
  • ABAP programmer

Example Scenario:

  • ECC 6.0
  • A few business users have access to transaction SA38 in production to run program RSSCD100 (Display Change Documents)
  • A decision is made by Security and Audit to no longer allow SA38 in production
  • Security looks at the RSSCD100 program and determines there is no standard SAP tcode
  • Security opens a request with ABAP Team to add a custom transaction to RSSCD100
  • A custom transaction is added; ZRSSCD100
  • Security roles are updated to add the new tcode
  • The new tcode and updated roles are moved to Production

What Went Wrong:

Security relied on table TSTC (SAP Transaction Codes) to see if a transaction code was assigned to the program; they found no entries in the table. Note: The same result would be found if looking at the program via SE80; i.e., there would be no “Transactions” folder showing assigned tcodes. With this finding, Security then proceeded to request the custom development from the ABAP Team.

What They Needed to Know:

Transaction codes have what are called “Start Objects.” For transactions where the start object is a program, then searching table TSTC (SAP Transaction Codes) by program name (PGMNA) is sufficient. But for programs that have been assigned a transaction code that uses a start object of “Transaction with parameters” the program name is in the parameters. For these transactions, PGMNA in table TSTC will be blank. The additional information that links the program name to the tcode is found in table TSTCP (Parameters for Transactions).

Here is an example of what a “Transaction with parameters” that calls a report might look like:

How to Search Table TSTCP:

Notice in the below screenshots that two (2) assigned transaction codes are found; RSSCD100 and S_ALR_87101238.

♦ Tip: Put a semi-colon after the program name to ensure you do not pick-up other entries that are named similar to the program name you are searching. The data in the PARAM field is separated by semi-colons.

 

Conclusion:

When searching for transaction codes assigned to a program do the following:

  1. Search Table TSTC where PGMNA = program name
  2. If nothing is found in Step 1 (or even if something is found), then search Table TSTCP where PARAM includes pattern *program name;*

If Security would have followed these steps in our example scenario, then they would have still made the role updates, but could have avoided additional custom (and unnecessary) development.

 

 

To report this post you need to login first.

5 Comments

You must be Logged on to comment or reply to a post.

  1. Bärbel Winkler

    Thanks for the tip, Brian!

    Table TSTCP somehow managed to escape my attention in the 18 years I’ve dabbled with SAP – not sure how this could have happened, but possibly because I never actively worked with a parameter transaction.

    Cheers

    Bärbel

     

    (1) 
  2. Jelena Perfiljeva

    Good tip but using START_REPORT in a parameter transaction like this really should be avoided. In one of my old jobs. some consultants created transaction codes like this and it caused nothing but problems. After we officially banned such practice it became much simpler to maintain and search for transactions. This blog is actually a great argument in favor of a ban on this practice.

    As a side note, is there any reason you could not use the standard transaction AUT10 (audit trail) to see the change documents?

    (0) 
    1. Brian Atkinson Post author

      Hi Jelena,

      Yep, I have seen the START_REPORT transaction before so I knew to look, but would never use it for my own development. I have not used AUT10. Thank you for the tip. I will look into it.

      Brian

      (0) 
    1. Brian Atkinson Post author

      Hi Diogo,

      Yes, thank you for pointing that out. For users that want to try this, in the PARAM field type *SM30*[viewname;]*

      E.g., *SM30*V_TVKO;*

       

      Brian

      (0) 

Leave a Reply