Difference between S_PROGRAM and S_DEVELOP!!

[Former Member]

Hi All,

Can anyone please tell me the difference between S_PROGRAM and S_DEVELOP..??

I think both are used to protect the access to the ABAP programs..Then how it's different from each other?

Thanks in advance,

Ram

[jurjen_heeck]

A short one, definately not complete:

S_PROGRAM is for protecting the execution of programs, the object is called "ABAP: Program Flow Checks"

S_DEVELOP is for protecting changes and is called "ABAP Workbench"

So they protect different kinds of access.

[Former Member]

Hi,

Could you plz explain in detail?

[Former Member]

Hi,

Search this forum for the term "RSCSAUTH" and read those threads. They contain many details.

S_DEVELOP (very powerfull) can do more than S_PROGRAM (restricted to submittable reports), but S_PROGRAM can differentiate between types of "P_ACTION".

You should always change report authorization groups via RSCSAUTH, not in SE38 etc.

Cheers,

Julius

[Former Member]

Hello Ramkumar,

S_PROGRAM authorization object is used as mentioned, to protect execution of the program:

For example ig you have a program called "ZPROGRAM" and you want to secure the program such that only a select few people can execute it, you need to assign an "authorization group" (dont confuse this with the authorization group value used in S_TABU_DIS).

To assign the authorization group to the prgram go to transaction SE38 type in the progrm name and click on edit

(Please note that you need a DEVELOPER key to edit the program)

Then once you the program is displayed use the menu option:

GOTO--> attributes

One of the field displayed here is "authorization group". You have to assign the authotization group here (the field name is SECU) (these authorization group values are stored in table TPGP).

But as suggested by Julius RSCSAUTH is a better option especially since Security guys wont have access to developer keys.

Once this is done, the authorization group has to be assigned in the object S_PROGRAM in an authorization role.

Only if the role containing this object (with the appropriate value) is assigned to the user, he will be able to execute that program.

S_DEVELOP is used to create / modify / change programs (and their attributes). This authorization is only necessary for ABAP developers / prgrammers and you should avoid assigning this to anyone else.

Hope this helps.

Regards,

Prashant