Auth Object S_Program - why exclusive auth for submit when auth is available for variant?

[Former Member]

Hi All.

I just want to understand the usage of S_Program. And how it works.

It has 2 fields :  P_ACTION,  P_GROUP

P_ACTION - says values as

Variant : Maintain variants and executive ABAP program

Submit : Execute ABAP Program.

BTCSubmit : Schedule program for background processing

P_GROUP - values for auth group - which we could add.

Acc to the above, if a role has this auth object S_Program

With values as Variant

And authgroup z_one, assigned,

To my understanding, this implies automatically for the auth group z_one, submit authorisation will also be available, if variant authorisation is given.

However, when we check the authorisations, end users very often get missing authorisation for submit for auth group z_one.

Why is this so.

And if we also give submit option, explicitly, it works. And there are no errors from end users.

I wish to understand as to why the system is asking for submit authorisation when variant authorisation is already available.

Am i missing something anywhere.

Can anyone help me understand this.

Many thanks

indu

[Former Member]

Hi Indu,

P_ACTION=VARIANT allows user to maintain variants for programs and only execute them via their variants thru' transaction like SM37 or SA38 or shortcuts. However, if program is to be executed thru' workbench transactions like SE38, then P_ACTION= SUBMIT is necessary. Hope this clarifies.

Thanks

Sandipan

[Former Member]

Hi Sandipan.

Thx for the inputs.

I shall discuss these with the developers. And understand.

Because these are Z programs / Z auth groups / z transactions.

Kind regards

indu

[Former Member]

Hi Sandipan.

Just one more question :

http://wiki.sdn.sap.com/wiki/display/ABAP/ABAP+Workbench

To my basic understanding : No 2 programs can have the same tcode.

And you could have a tcode, to run a program which may not call a work bench.

And also not all programs run thro SE38.  (Or use that work bench engine(?))

Basically what i wish to understand is : how do you define (or differentiate )a transaction to be a work bench. or non workbench transaction.

If you could share some inputs please that would be helpful.

Many Thanks

indu

[Former Member]

Hi Indu,

Workbench is not a "type" of transaction. By Workbench transactions, I meant transaction codes used to call ABAP workbench tools individually. Easiest way to find all workbench transactions is to go to SAP Menu and traverse to subfolders Tools--> ABAP Workbench.

Hope this helps.

Thanks

Sandipan

[Former Member]

Hi.

Thank you for the info and for the clarified response.

Regards

indu