SU22 – SAP Delivered Checks
During installation or an upgrade, SAP delivers a set of default authorization objects which are checked for each t-code which are defined in the system. These default values delivered from SAP are stored in two tables, USOBT and USOBX. The delivered check indicators for a tcode can be displayed through the SU22 transaction the initial screen of which is shown below.
On clicking the execute button we are taken to the next screen which display the delivered values for the check indicators. We can even select an object and display the field values proposed by SAP for it as shown below.
Three unique combination of values are possible for each of the objects maintained in SU22.
- Check Ind – Do not check, Proposal – No – The authorization object is not checked during the execution of the tcode. Checks for objects for the Basis and HR classes can never be switched off through this option.
- Check Ind – Check, Proposal – No – The check for the authorization object depends on the ABAP code of the program which is being executed. In case an authority-check ABAP statement is present in the code for the object, the object would need to be present in the user buffer for a successful execution. However, since proposal is No, SAP doesn’t pull the object during authorization maintenance in PFCG if the tcode is added to the role. Typically these objects will not be checked during standard execution of the tcode but might be checked while following some of the many navigation options that are present inside a tcode.
- Check Ind – Check, Proposal -Yes – The authorization object is checked ( through ABAP) during the execution of the tcode and is proposed (pulled into role) during authorization maintenance in PFCG.
Many a time, we need to change the SAP delivered values for the check indicators. This is done through the SU24 transaction which we will discuss in our next articles. The SAP defaults in SU22 sould never be manually changed by a customer. The SU22 values are only modifed by SAP (automatically) during initial installation or during a service pack upgrade.
Hello Aninda,
Great piece of work!
one question..What do you mean saying *SAP doesn’t pull the object during authorization maintenance in PFCG if the tcode is added to the role* and what is the impact of not doing so..?
thanks in advance.
Cheers
Sunny
Hi Sunny,
I was trying to explain the impact of the different check indicators for a tcode while adding it to a role. For a object maintained as Check Ind – Check, Proposal – No, the object will not be inserted into the authorizations for the role even if this tcode is added to the role. Hope this helps 🙂
Regards,
Aninda
Hi Aninda, Thanks for discussing about the tables USOBT and USOBX. I was wondering what’s the difference between these two tables. When I checked these tables in the system, I see that USOBT table has additional columns like authorization field and authorization value when compared against USOBX table. Is that the only difference that USOBT also has additional columns giving more details about the objects of the tcode? Could you elaborate your thoughts on it? Thanks again.
Hi Asha,
Open the SU22 entry for a particular tcode and also display the entries for this same tcode in the two tables….you will get your answer. One of the USOB tables stores the check indicators while the other stores the default values for objects.
Thanks,
Aninda
I see that USOBX is storing all the object values irrespective of check indicators. Thanks Aninda for the hint about the check indicators!