<\/p>\n
P_PERNR controls the authorization of HR master data, hence the infotype range for this authorization object is 0000-0999. It gives users authorization to display\/maintain HR master data for their own personnel number.<\/p>\n
<\/p>\n
If the personnel number check is active and the user has been assigned a personnel number, P_PERNR authorizations override all other checks (including P_ORGIN) except Test Procedures.\u00a0This check does not take place if the user has not been assigned a personnel number, or if the user accesses a personnel number other than his or her own.<\/p>\n
<\/p>\n
P_PERNR authorization fields:<\/p>\n
| \u00a0AUTHC<\/td>\n | \u00a0Authorization Level<\/td>\n<\/tr>\n |
| \u00a0PSIGN<\/td>\n | \u00a0Interpretation of Assigned Authorization<\/td>\n<\/tr>\n |
| \u00a0INFTY<\/td>\n | \u00a0Infotype<\/td>\n<\/tr>\n |
| \u00a0SUBTY<\/td>\n | \u00a0Subtype<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n <\/div>\n <\/p>\n The most important field for this check is PSIGN<\/strong> , which is used to I<\/strong>nclude \/ E<\/strong>xclude (I<\/strong> \/ E<\/strong>) own personnel number during authorization check.<\/div>\n <\/div>\n <\/div>\n Let us take an example to understand how this authorization object works. Suppose a payroll administrator is responsible for the basic pay of employees of a given personnel area, say 1000.<\/div>\n <\/div>\n The infotype for Basic Pay is 0008.<\/div>\n <\/div>\n To perform his duty, the administrator should have following authorization:<\/div>\n <\/div>\n <\/div>\n P_ORGIN<\/strong>:<\/div>\n INFTY : 0008<\/div>\n SUBTY : *<\/div>\n AUTHC : *<\/div>\n PERSA : 1000<\/div>\n PERSG : 1<\/div>\n VDSK1 : *<\/div>\n <\/div>\n <\/div>\n <\/div>\n From security point of view, the administrator should get authorization so that he is able to perform his responsibility (i.e. to administer the basic pay of employess). But he\u00a0should only be allowed to display his personnel data.\u00a0He\u00a0should not be allowed to change his own basic pay.<\/div>\n <\/div>\n <\/div>\n It is here that the concept of P_PERNR authorization object comes into picture.<\/div>\n <\/div>\n <\/div>\n He needs to be assigned the following authorizations also:<\/div>\n <\/div>\n <\/div>\n P_PERNR<\/strong>:<\/div>\n AUTHC : R,M<\/div>\n PSIGN : I<\/div>\n INFTY : *<\/div>\n SUBTY : *<\/div>\n <\/div>\n <\/div>\n And,<\/div>\n <\/div>\n <\/div>\n P_PERNR<\/strong>:<\/div>\n AUTHC : W,S,D,E<\/div>\n PSIGN : E<\/div>\n INFTY : 0008<\/div>\n SUBTY : *<\/div>\n <\/div>\n <\/div>\n From the first instance of P_PERNR, user gets authorization (PSIGN : I) to read his own infotypes. And from the second instance of P_PERNR, he loses (PSIGN : E) write access to his infotype 0008 i.e. basic pay.<\/div>\n <\/div>\n Hence, we see that P_PERNR in a way acts as providing negative authorization where it overrides the authorization provided by P_ORGIN.<\/div>\n","protected":false},"excerpt":{"rendered":" P_PERNR controls the authorization of HR master data, hence the infotype range for this authorization object is 0000-0999. It gives users authorization to display\/maintain HR master data for their own personnel number. If the personnel number check is active and the user has …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1706"}],"collection":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/comments?post=1706"}],"version-history":[{"count":8,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1706\/revisions"}],"predecessor-version":[{"id":1714,"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/pages\/1706\/revisions\/1714"}],"wp:attachment":[{"href":"https:\/\/sapsecurityanalyst.com\/WP\/wp-json\/wp\/v2\/media?parent=1706"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |