CODEWITHSUNDEEP
abapdynprosap-selection-screens
user14674462
user14674462

Reputation: 3

Show a block of selection screen only to certain users

I was trying to give an access to one block of selection screen that should only a few people see. For the rest of SAP users, it should be invisible but I've made some mistakes.

Declaration of the block that I want to hide:

SELECTION-SCREEN BEGIN OF BLOCK b3  WITH FRAME TITLE TEXT-004.
  SELECTION-SCREEN SKIP 2.
  SELECTION-SCREEN PUSHBUTTON 3(45) TEXT-ba5 USER-COMMAND x.
  SELECTION-SCREEN SKIP 2.
  SELECTION-SCREEN PUSHBUTTON 3(45) TEXT-bb3 USER-COMMAND y.
  SELECTION-SCREEN SKIP 2.
SELECTION-SCREEN END OF BLOCK b3.

Fragment of code that should've done the job:

DATA: lt_authorized_users TYPE STANDARD TABLE OF sy-uname,
      ls_user             TYPE sy-uname.

 lt_authorized_users = VALUE #(  ( 'USER 1' )
                                 ( 'USER 2' ).

                              
  LOOP AT lt_authorized_users INTO ls_user.
  ENDLOOP.


AT SELECTION-SCREEN OUTPUT.
  LOOP AT SCREEN.
    IF screen-group1 = 'BLK'.
      IF sy-uname = ls_user.
        screen-active = 1.
      ELSE.
        screen-active = 0.
      ENDIF.
      MODIFY SCREEN.
    ENDIF.
  ENDLOOP.

Upvotes: 0

Views: 2067

Answers (1)

Philipp
Philipp

Reputation: 69703

You are on the right track with LOOP AT SCREEN in AT SELECTION-SCREEN OUTPUT. But for IF screen-group1 = 'BLK' to work, you actually have to state which elements of the selection screen belong to the group "BLK". You do that with the addition MODIF ID id that is available for most selection screen elements:

SELECTION-SCREEN PUSHBUTTON 3(45) TEXT-ba5 USER-COMMAND x MODIF ID blk.

And then there is another problem in your code that isn't really a technical problem but really, really bad practice: Building your own authorization system! SAP already has an authorization system. It is built around roles defined in tcode PFCG, which contain authorizations for authorization objects defined in tcode SU21 and get assigned to users with tcode SU01. You can check if a user is authorized to do something with the ABAP instruction AUTHORITY-CHECK. Whenever you deal with user authorizations, you should be building on this system. Homebrewed authorization systems are a nightmare for maintenance, administration, troubleshooting and compliance. Only build them when you have a really good reason why the SAP standard system doesn't work for you.

SELECTION-SCREEN BEGIN OF BLOCK b3  WITH FRAME TITLE TEXT-004.
  SELECTION-SCREEN SKIP 2.
  SELECTION-SCREEN PUSHBUTTON 3(45) TEXT-ba5 USER-COMMAND x MODIF ID blk.
  SELECTION-SCREEN SKIP 2.
  SELECTION-SCREEN PUSHBUTTON 3(45) TEXT-bb3 USER-COMMAND y MODIF ID blk.
  SELECTION-SCREEN SKIP 2.
SELECTION-SCREEN END OF BLOCK b3.

AT SELECTION-SCREEN OUTPUT.
  LOOP AT SCREEN.
    IF screen-group1 = 'BLK'.
      AUTHORITY-CHECK OBJECT Z_SEEBUTTONS
                      ID ACTVT = '03'. "Just an example
      IF sy-subrc <> 0.
        screen-active = 0.
        MODIFY SCREEN.
      ENDIF.
    ENDIF.
  ENDLOOP.

You might wonder what's about the BLOCK and the SKIP. Don't they need a modifier ID, too? No, they don't. They can't have one. But they don't need one either, because when a block contains no visible elements, then the whole block disappears without taking up any space on the selection-screen.

Upvotes: 3

Related Questions