Business Case:
When Business wants to give access for projects according to any specific object which is not given by SAP Standard than we have to create Custom Authorization Object to suffice this requirement.
I have encountered a situation where Business wants to restrict users on basis of Project Profile for Example: If User has Authorization for Profile1 than only user will able to Access/Open that Project having project Profile "Profile1".
Solution:
For above requirement below are the steps:
1: Create Authorization Field
The Authorization Object is used to check the user’s privileges for specific data selection. An Object Class contains one or more Authorization Objects.
Authorization is controlled by Authorization Object which is assigned/maintained in Profile/Roles and then this Role will be assigned to User Master Record.
Create Authorization Field using TCODE-SU20
2: Create Authorization Class (Object Class)
Transaction – SU21 Create a new Authorization Class (Object Class) by clicking on the Create button’s drop down icon, then select “Object Class”.
Enter Object Class Name and Description.
3: Create Authorization Object
Maintain Object name, Text, Class and Authorization Field.
4: Assign Authorization Object to Roles
TCODE-PFCG
5: Code to Check this Object in User Master Record.
for this ABAP Consultant has created as below
Code Behind report source "LCJWBF0Z" is:
*----------------------------------------------------------------------*
* FORM Profil
*----------------------------------------------------------------------*
* Profil lesen und in PROJ ablegen
* Sonstige Standardwerte bei Anlegen in PROJ fuellen
*----------------------------------------------------------------------*
* --> Profid Id
*----------------------------------------------------------------------*
form profil using value(pro_id) like tcj41-profidproj.
ENHANCEMENT 1 ZPSPROFILE.
AUTHORITY-CHECK OBJECT 'ZPSPROFILE'
ID 'PROFL' FIELD '*' .
if sy-subrc = 0 .
else.
if pro_id = 'ZLGLPRO' .
AUTHORITY-CHECK OBJECT 'ZPSPROFILE'
ID 'PROFL' FIELD pro_id." '__________'.
if sy-subrc <> 0 .
MESSAGE 'No Authorization for ZLGLPRO' type 'E' .
endif.
else.
AUTHORITY-CHECK OBJECT 'ZPSPROFILE'
ID 'PROFL' FIELD pro_id." '__________'.
if sy-subrc <> 0 .
MESSAGE 'NOT Authorized ' type 'E' .
endif.
endif.
endif.
ENDENHANCEMENT.
Testing for above Code:
Check Authorization:
If we create/change Project where Project Profile as ZCAPEX than system will allow to User to create/change
System will allow to create/change
Now check with Other project Profile:
Now system generate Error Message for Authorization.
Hope, this will Help a lot.
Enjoy SAP.. 