How a Transaction Works in SAP?

Understanding Authorization Checks in SAP Security

In SAP security, authorization checks play a crucial role in ensuring that users have the appropriate permissions to execute transactions. This process helps prevent unauthorized access and safeguards sensitive business data. Let’s explore how SAP performs these checks when a user starts a transaction and how authorization groups control access to tables.

How Authorization Checks Work in SAP Transactions

Whenever a user initiates a transaction in SAP, the system performs a series of checks to determine whether the user is authorized to proceed. These steps include:

1. Validating the Transaction Code

The system first verifies whether the transaction code (Tcode) is valid by checking table TSTC. It also ensures that the system administrator has not locked the transaction.

2. Checking User Authorization

SAP then checks whether the user has the necessary authorization to start the transaction. This verification occurs whenever a user executes a transaction from the menu or enters a command manually. However, transactions called indirectly by other transactions are not subjected to this initial authorization check.

For transactions that call other processes, additional authorization checks are performed.

3. Verifying Authorization Object S_TCODE

Each transaction start is controlled by the authorization object S_TCODE, which contains the field TCD (Transaction Code). The user must have an authorization entry that includes the specific transaction code to proceed.

4. Additional Authorization Checks (SE93 & TSTA)

If an additional authorization requirement is assigned to a transaction using SE93, the user must also have the corresponding authorization object. These additional checks are stored in table TSTCA.

When creating a custom transaction in SE93, assigning an additional authorization object can provide extra security. This is useful when a transaction requires special restrictions beyond standard access controls. However, if additional security is unnecessary, other methods such as using an AUTHORITY-CHECK statement at the program level may be more suitable.

5. Authorization Object Verification

If a transaction is linked to a specific authorization object, the system ensures that the user has the necessary permissions to use that object.

---

When Authorization Checks Are Not Performed

Authorization checks may be skipped in certain cases:

• Deactivation via SU24

  • Using SU24, administrators can deactivate authorization checks for specific transactions. However, this does not apply to SAP NetWeaver and HR-related authorization objects, which remain active.
  • This deactivation is useful when many authorization objects are checked in the background. Reducing these checks can simplify user authorizations and minimize maintenance efforts.

• Global Deactivation via SU24 or SU25

  • Administrators can globally disable authorization objects for all transactions using SU24 or SU25.
  • To activate these changes, the profile parameter AUTH/NO_CHECK_IN_SOME_CASES must be set to “Y” using transaction RZ10.

If any of the above authorization checks fail, the transaction will not be executed, and the system will display an error message.

---

Authorization Groups for Table Access

SAP also allows administrators to control access to database tables using authorization groups. This prevents unauthorized users from accessing tables through general tools like SE16.

For a user to access a table, they must have:
✅ Authorization to execute the tool (e.g., SE16).
✅ Authorization to access tables assigned to specific authorization groups.

SAP delivers predefined authorization groups, and their assignments are stored in table TDDAT. The system checks access using the authorization object S_TABU_DIS.

---

Conclusion

Authorization checks in SAP ensure that users only access transactions and data they are permitted to use. These security measures protect critical business processes and help maintain compliance with organizational policies.

By understanding how S_TCODE, SE93, SU24, and S_TABU_DIS work, SAP administrators can fine-tune access control and minimize unnecessary authorizations while maintaining security.

Would you like a visual representation of this process? I can generate an infographic to make these concepts easier to understand! 🚀