Required SAP authorizations for Studio - Automate_Studio - 20.3

Transaction: Required SAP authorizations

Customers running SAP with Basis level 700 Support Pack stack 24 or higher will need to implement the custom Automate Function Module for Non-Batch recording modes to work.

Transaction authorization via SAP GUI:

The Transaction module cannot run a transaction if you cannot run that transaction in the SAP GUI. If you do not have access to a particular transaction, please obtain authorization for it before you record or run that transaction in the Transaction module.

Remote Function Calls (RFC) authorization:

The Transaction module makes RFC calls to SAP. You must have this additional access assigned to you. In most cases, these authorizations are already assigned to you. The following objects with the indicated values should be in your SAP user profile for working with the Transaction module.

For the S_RFC authorization object:

• Field RFC_TYPE Value FUGR (function group)

• Field ACTVT Value 16 (execute) or *

• Field RFC_NAME

The following values are required for running shuttle files: SYST, SRFC, SUSR, RFC1, RFCH, SBDC, ATSV, STTF, SDTX

The following additional values are required for recording shuttle files: SBDR, SCAT, STTM, SDTX

The following values are required to use document attachment: BDS_BAPI, SDC_MIME, OPTA, OPTB, CVBAPI, CVAPI01, ARCHIVOBJECT, SWOR, BREL, SOA1, SOC3, SOC8

Additionally, document attachment requires access to object S_BDS_DS with all values except lock and delete.

The following value is required to use SAP List of Values (F4) with forms: SWFMOD_Workflow

The following values are required for Addin F4 help: RHF4

F4 in WFM: SIMG, BDL5, SUNI

Add Long Text: STXKS, ALFA, ITOB_BAPI_EQ, ITOB_BAPI_FL, IBAPI_ALM_ORDER, IWOPM, MEWI ,0012, 1022

Additional Automate Utility RFM’s : 1001MASSUEB

Create and run: RFCH, RFC1, SRFC, SUSO, SUSR, SYST, SYGU

To check if a user is authorized to use a given rFM, the Transaction module validates that the user has EXECUTE(16) permission on the Function Group. Accordingly, when a given Function Module executes, it accesses the structures defined in the Function group too, so authorization for the Function Group is needed.

The Authority_Check rFM validates whether the user is authorized to use the Function Module of a given Function Group.

The following values are required for WFM 12.x:

• WFM rfms self check: /WINSHTLQ/*
• F4 in WFM: SIMG, BDL5
• Add Long Text: STXKS, ALFA
• Record in WFM: SBDR, SCP2
• Record, User Format in WFM: RFC1, SU_USER
• Validation WFM -BATG
• Document Attachment: SDC_MIME, OPTA, OPTB, CVBAPI, CVAPI01, ARCHIVOBJECT
• Additional Customer specific Wrapper RFM’s- SSRV, BPC3,TSRV, SSRV2
• Vendor master functionality call via Direct in WFM: FIN_AP_AR_BANK, 1011, BAPT, 1013, ACC9
• Vendor master functionality call via Direct in WFM(Only for S4HANA): BUBA_3 , BUBA_4
• Calculate prices BAPI call in WFM: WVK8
• Customer master functionality call via Direct in WFM: SZAK

Table Level authorizations:

The Transaction module can get logs, extended comments, field descriptions, and messages during the debug process. For this, the user must have access to certain tables. Table level access is controlled by authorization object S_TABU_DIS. Transaction needs access to the following tables: T100, TFDIR, DD03L, DD04L, TSTCT, D020T, and DD03M. To enable this access, please set up the following authorization:

Authorization Object: S_TABU_DIS

Field Authorization Group (DICBERCLS) = SS, &NC&

Field Activity (ACTVT) = 03 (Display only)

Transaction (non-WFM)

GUI Scripting authorizations:

In addition to RFC calls, the Transaction module also provides access to the SAP system using the SAP GUI Scripting mode. To check whether GUI scripting is enabled, look on the right-end of the SAP GUI status bar.

If you see the barber-pole icon on your status bar, GUI scripting is enabled.

If you do not see the icon, ask your security team to use the RZ11 transaction to enable GUI scripting. To enable SAP GUI scripting on the SAP server, the administrator must set the profile parameter sapgui/user_scripting to TRUE on the application server. To enable this parameter, run transaction RZ11. See OSS note 480149 for specific information.

Additionally, please enable scripting on the SAP GUI front-end as follows:

1. Open the Options dialog box from the main GUI screen.

   

2. Select the Scripting tab, and select the Enable Scripting check box.

   

SAP authorizations table

Query: Required SAP authorizations

Remote Function Calls (RFC) authorization:

The Studio v12 Query module makes RFC calls to SAP. You must have this additional access assigned to you. In most cases, these authorizations are already assigned to you. The following objects with the indicated values should be in your SAP user profile for working with the Query module.

For the S_RFC authorization objects:

• Field RFC_TYPE: FUGR (function group)
• Field ACTVT: 16 (execute) or *
• Field RFC_NAME: *

Create and run: RFCH, RFC1, SRFC, SUSO, SUSR, SYST, SYGU

F4 value – RHF4

Create and Run: SDIFRUNTIME

T-code recording to table SBDR, SDTX, SBDC

InfoSets SQ02 and queries SQ01: INSTALL, AQRC, AQCF

The following values are required for WFM 12.x:

• WFM rfms self check: /WINSHTLQ/*
• LDB process via WFM: SDIFRUNTIME, SEU2, SEQ0, ALDB
• Orphaned Chunk clearing in WFM: SGWY
• Background Query run in WFM: BDL3, THFB, RSSG, BTCH

Table Level authorizations:

To access a specific table in the Query module, you need table-level access. Table-level access in SAP is independent of a transaction. For example, you may have access to the transaction MM01 which uses the Material Master table (MARA), but this does not give you automatic access to that table. Table-level access is controlled by the authorization object S_TABU_DIS for client dependent tables and by S_TABU_CLI for client independent tables.

Query non-WFM table names:

Authorization object:

S_TABU_DIS

Fields:

Authorization group (DICBERCLS): &NC&

Activity (ACTVT): 03 (Display)

For example:

Almost every client-dependent table in SAP is assigned to a specific authorization group in the SAP table TDDAT, field CCLASS. For example, the table MARA is assigned to the authorization group MA.

To access Table MARA, authorization group MA must be assigned to your SAP profile in the authorization object S_TABU_DIS as indicated below:

Authorization object:

S_TABU_DIS

Fields:

Authorization group (DICBERCLS): MA (For table MARA)

Activity (ACTVT): 03 (Display)

Notes

• Each table can belong to a different authorization group. For you to access different tables, your profile must have the proper authorization for the appropriate groups.
• For client-independent tables (where field ‘MANDT’ is not present in the table), you need the following authorization object in your SAP profile:

  Authorization Object:

  S_TABU_CLI

  Fields:

  CLIIDMAINT: X

• If your required table is not listed in the SAP table TDDAT, you can attain the specific authorization group by assigning the following:

  Authorization object:

  S_TABU_DIS

  Fields:

  Authorization group (DICBERCLS): &NC&

  Activity (ACTVT): 03 (Display)