{"id":511,"date":"2012-01-18T03:26:07","date_gmt":"2012-01-18T03:26:07","guid":{"rendered":"http:\/\/sapsecurityanalyst.com\/WP\/?page_id=511"},"modified":"2021-06-28T05:15:42","modified_gmt":"2021-06-28T05:15:42","slug":"su24-concept-in-sap","status":"publish","type":"page","link":"https:\/\/sapsecurityanalyst.com\/WP\/general-disclaimer\/su24-concept-in-sap\/","title":{"rendered":"SU24 (Maintain Check Indicators)"},"content":{"rendered":"

 <\/p>\n

<\/span><\/p>\n


\nAs we discussed earlier, a tcode is like a command which when executed executes an ABAP program, report etc. When the program gets executed, it may check for certain authorization objects.<\/span>
\n<\/span>
\n
\nThese authorization objects are coded in the program under “AUTHORITY-CHECK<\/span><\/a><\/span>” statement.<\/span><\/p>\n


\n<\/span><\/p>\n


\nSU24 is one of the most important tcodes in SAP Security. It is used to maintain authorization objects that are checked during the execution of a particular transaction code. <\/span>
\n
\n For example – a screenshot of SU24 entry for<\/span> PFCG<\/strong> transaction code is shown in the below figure:<\/span><\/span><\/p>\n


\n<\/span><\/p>\n

<\/a><\/p>\n


\n\"\"<\/a><\/p>\n


\n<\/a>
\n
\nSU24 is like a check and check-maintain “container” which is used for maintaining those authorization objects which are checked when ABAP programs are executed.<\/span><\/span><\/p>\n


\nWhenever any tcode (or program) is executed and if it checks if the user has access to some authorization object performing the task concerned, then it is always a good practice to add that authorization object in SU24 entry for that transaction code.<\/span><\/p>\n


\n Lets go through some of the important concepts related to SU24 tcode. For that lets have a look at the SU24 screenshot for tcode FPE3S below:<\/span>
\n<\/span><\/p>\n

 <\/p>\n

<\/a><\/p>\n


\n\"\"
\n<\/a><\/p>\n

<\/span><\/p>\n

 <\/p>\n

As we can see this screen shows SU24 entries for tcode FPE3S. On the left side, we have tcode name and description and on the right side, we have authorization objects and other fields like TSTCS, Check Indicator and Proposal.<\/span>
\n<\/span>
\n <\/span><\/p>\n


\nThe Object field shows the list of authorization objects which are checked for tcode FPE3S.<\/span><\/p>\n

 <\/p>\n


\n<\/span><\/p>\n


\nWe have already discussed that SU24 maintains the authorization objects which are checked by a tcode. Although just maintaining any authorization object does not mean that the object will be checked. It is necessary that the object is coded in the “Authority-Check” statement in the ABAP code. Simply inserting an authorization object in SU24 which is not checked in the program is not going to make any difference.
\n<\/span><\/p>\n

 <\/p>\n

<\/span><\/p>\n


\n SU24 provides us with an option to set if any authorization object can be set to “Do not check”, i.e even if the object is coded in the program, the object will not be checked while executing the tcode. As shown in the figure above, we can see that Check Indicator Field gives us this option to set the authorization object check value to<\/span> “<\/span>Check” <\/span><\/strong>or “Do Not Check”.<\/strong>
\n<\/span>
\n
\nNext to Check Indicator field is<\/span> Proposal field<\/strong>. It can have values<\/span> “<\/span>Yes”<\/span><\/strong>\u00a0or No”<\/strong>. Lets discuss this “Proposal” field via the below screenshot:<\/span>
\n<\/span><\/p>\n

<\/p>\n

 <\/p>\n


\n\"\"<\/a><\/p>\n


\n<\/a><\/p>\n


\n
\nWe can see in the above figure that for object F_KKKO_BEG, the proposal value is set to “<\/span><\/span>Yes”.<\/span><\/strong><\/p>\n


\n<\/strong><\/p>\n


\nIf we double click on the object F_KKKO_BEG or if we click on “Field Values” (as shown in the figure), we get to see some authorization field values for object F_KKKO_BEG at the bottom of the screen as shown above. These are the proposed values and when the tcode FPE3S (as per this example) is added to any role menu, these values automatically get pulled in the role.<\/span><\/span><\/p>\n


\n<\/span><\/p>\n


\n These are helpful as the important objects which are set to proposal “Yes”\u00a0automatically\u00a0get pulled to the role and thus are very helpful in role maintenance.<\/span><\/p>\n

 <\/p>\n


\n
\nIf the proposal value is set to “No” and the Check Indicator is set to “Check”, then it means that the object will be checked while tcode execution but no default proposed value gets pulled to the role during assignment of tcode to the role menu.<\/span><\/span><\/p>\n

 <\/p>\n


\n Lets have a\u00a0summarized\u00a0look at what we discussed about check indicators:\u00a0<\/span><\/p>\n

 <\/p>\n

<\/p>\n