SAP: HOW TO CHECK THE USER STATUS IN THE TABLE

Defined User Status details are stored in the Table: ENT5854. You can
see the number of status details for one status profile. These details
may differ from client to client. Also differs from one status profile
to another. Against each status(ENT5854-TXT04) you can see the
technical status(ENT5854-ESTAT) details. Here the technical status
(ENT5854-ESTAT) is the main reference to check details further.

In the Table: VICN01, for every RE-Contract (VICN01- RECNNR) you can
see the Object number (VICN01- RECNOBJNR).

Now, use the same object number in the Table: JEST in the Object
number (JEST- OBJNR) field and execute for the entries. Now you can
see multiple entries in the output. For one object number you can see
multiple entries.

To get the latest status relating to the object (JEST-OBJNR), check
the particular entry, which is with 'active' status (JEST-INACT) and
with the latest 'change number' (JEST-CHGNR).

This status check procedure is same even in case of Rental Object,
Internal Order, WBS Element, etc.,

Always user status starts with 'E0001'and system status starts with
'I0001'. Logic to check the status is also same i.e., active status
having the latest change number.

ABAP Development Standards concerning Security

You know the Secure Programming Guidelines but you want to do more?

Well, here are my top priority security recommendations for developing secure ABAP applications:

New database tables

 

1. Assign table authorization group
    Usually you create 3 table authorization groups per application:
    a) for customizing tables (<appl>C)
    b) for master data and transaction data or other application data (<appl>A)
    c) for system data (<appl>S)

You can use the report RDDPRCHK (or RDDTDDAT_BCE) to analyze the settings.
Use transaction SM30 for view V_BRG_54 to maintain authorization groups respective view V_DDAT_54 to maintain authorization group assignments.

Maintain authorization groups
http://help.sap.com/saphelp_nw70/helpdata/en/a7/5134d2407a11d1893b0000e8323c4f/frameset.htm
Maintain authorization group assignments
http://help.sap.com/saphelp_nw70/helpdata/en/a7/5134df407a11d1893b0000e8323c4f/frameset.htm

2. Set the maintenance flag, which controls SE16 am SM30, correctly

    Data Browser/Table View Maintenance
    http://help.sap.com/saphelp_nw70/helpdata/en/a6/03883acb00d768e10000000a114084/content.htm

3. Activate table logging for customizing table or create a change document object for master data.

    You can use the report RDDPRCHK (or RDDTDDAT_BCE) to analyze the settings.

    Check the settings of profile parameter rec/client and the tp parameter RECCLIENT, too.

Activate/Deactivate Table Change Logging 
http://help.sap.com/saphelp_nw70/helpdata/en/7e/c81ebb52c511d182c50000e829fbfe/frameset.htm 
Note 1916 Logging table changes in R/3 
https://service.sap.com/sap/support/notes/1916 
Note 84052 R3trans: Table logging
https://service.sap.com/sap/support/notes/84052  

4. Create specialized SM30 maintenance views instead of offering maintenance using SE16 and add additional authorization checks if required.

Create a Maintenance Dialog
http://help.sap.com/saphelp_nw70/helpdata/en/a1/e4521aa2f511d1a5630000e82deaaa/frameset.htm
Event 25: At the Start of the Maintenance Dialog
http://help.sap.com/saphelp_nw70/helpdata/en/c2/703037301f327ae10000009b38f839/frameset.htm 

 

New transactions

 

1. Assign authorization object with appropriate field values in the definition of the transaction using transaction SE93

Authorization Checks
http://help.sap.com/saphelp_nw70/Helpdata/en/52/67129f439b11d1896f0000e8322d00/frameset.htm

2. Enter authorization proposals using transaction SU24

Check Indicators
http://help.sap.com/saphelp_nw70/helpdata/en/52/671470439b11d1896f0000e8322d00/frameset.htm

3. If the transaction is a report transaction and you have decided that the authorization check for the transaction is important: Check the authorization again using function AUTHORITY_CHECK_TCODE within the code of the report.

New BAPI / RFC Function

1. Ensure that application specific authorization checks are executed
2. Put critical and non-critical RFC functions into separate function groups.

New Web UI

See Secure Programming Guide chapter "Secure User Interface"
http://help.sap.com/saphelp_nw70/helpdata/en/58/4d767ed850443c891ad27208789f56/frameset.htm

Critical ABAP statements

Have a close look at critical ABAP statements

 

 -  INSERT REPORT / GENERATE SUBROUTINE POOL
These statements allow to create arbitrary code. Avoid anything which would enable users to inject ABAP code.

INSERT REPORT
http://help.sap.com/abapdocu_70/en/ABAPINSERT_REPORT.htm
GENERATE SUBROUTINE POOL http://help.sap.com/abapdocu_70/en/ABAPGENERATE_SUBROUTINE_POOL.htm

-  CALL TRANSACTION
The statement CALL TRANSACTION does not check the authorization of the current user to execute the called transaction automatically. To do this, either the calling (preferred) or the called program must call function module AUTHORITY_CHECK_TCODE.

CALL TRANSACTION
http://help.sap.com/abapdocu_70/en/ABAPCALL_TRANSACTION.htm

Generic functionality

Avoid developing generic functionality which enables the user to choose any target table, file, report or transaction. Have a close look to these statements:

 - Generic access to tables to SELECT … FROM (variable)
    http://help.sap.com/abapdocu_70/en/ABAPFROM_CLAUSE.htm
 - Generic access to files using OPEN DATASET variable
    http://help.sap.com/abapdocu_70/en/ABAPOPEN_DATASET.htm
 - Generic access to reports using SUBMIT (variable)
    http://help.sap.com/abapdocu_70/en/ABAPSUBMIT.htm
 - Generic access to transactions using CALL TRANSACTION variable
    http://help.sap.com/abapdocu_70/en/ABAPCALL_TRANSACTION.htm

 

source: sdn. sap. com

author: Frank Buchholz is security evangelist for securing SAP systems.

How to Log Changes in Plan Data Using DataStore Object

Overview

In many planning project it is not only necessary to create new plan data but also to keep track how this new data originated. Thus a mechanism is necessary that logs all changes done in the plan data – either when new data is created or existing data is changed. Usually the logging information contains information about the user who has done the changes and the date and time when these changes where performed. This paper gives an example how the new logging BAdI delivered with SAPNetWeaver 7.0 EHP1 (SP6) can be used to log information about these changes in a DataStore Object. As the example is very generic the contained coding can be easily adapted to a given customer scenario.

 

Full Story --> Click Here

 

source: sdn. sap. com

author: sap