SCC8 Auth check S_TABU_DIS

[AlainR2000]

Hello All,

Any idea why the Sap system requires object s_tabu_dis with act 02 group SS in order to run SCC8 ?

I want to give access to a clerk to run a SAP_USER client export, which basically only reads a whole bunch of tables and creates a transport request, no data alteration or what so ever, so why is this feature implemented ?

I did set the "Nio control" in SU24 for that obeject and tcode, but still, it looks like hardcoded that unless you have s_tabu_dis 02 wth SS, you will not be able to run SCC8.

Can somebody explain the logic behind that behavior ? Of course, I was told by Sap... "Works as expected !"

Thank you all !

Shawn

[msr01]

Hi Shawn,

you've given the answer by yourself : "....and creates a transport request...."
Transport requests will be stored in tables.

msr

[AlainR2000]

Thank you but this is not true. We have people creating transport requests (Abaper) and none of them have access to object s_tabu_dis auth grouip SS.

[AlainR2000]

I guess I forgot to mention that the issue is granting auth grp value SS, not s_tabu_dis...

The auditors will flag any user with s_tabu_dis , act 02, grp SS as they are potentially at risks even tough the cabn only run SCC8. I tried changing the Auditor's perception, buthey, not achievable short term !

[Al.]

Hi,

The whole client copy/export/import function needs to have a reasonably high level of control around it hence the 02/SS auths. If you think about the volumes of data that support some of the client export options you can see how having for most activities in this area. While you are not changing table contents a client export will potentially store a huge amount of data on the server which could have serious implications.

Cheers

[Gary Morris]

Because SAP_USER is an export of the SECURITY, user master records and role assignments. It makes sense to require someone to have at least the authorization mentioned if they are going to export and import the security tables.