Restrict access on Transaction Code Level

Question: Is there a fast method of restricting a particular to use a certain transaction code??

Thanks

Answer:
yes. give them a role with the access they need.

Answer:
What you are trying to do flies in the face of what you should be trying to achieve. tcode is just 1 of the entry points into the system / process.

From a control perspective you would be better off ignoring it and only using it as a reference to design the access rights which you actually want the user to have - this is what PFCG with SU24 attempted to achieve and introduce to the process, but many didn't bother to read the instructions...

The "fastest" surefire way to control the access which the user has, is to grant authorizations for the path in the process which they require and try to delimit what is available around it. Do you have a process blue print?

This happens almost completely independently of your restricting object S_TCODE and is subject to your ability to control which tcode the user is realy in, not that which they have.

Additionally, there are oodles of OSS notes which resolve the symptom that users can enter transactions for which they are not authorized and there likely to be more.
Copyright ?2007 - 2008 www.jt77.com