REPORT ZSF_DT_AUTH_OBJECT_MANAGEMENT. *&---------------------------------------------------------------------* *& Dynamic Tool: auth_object_management *& Description: SAP Authorization Object Management Tool - SU24 and *& AUTH_SWITCH_OBJECTS automation for auth object catalog, *& SU24 analysis, and global disable/enable *& Author: SAP Fever Premium Tools *& Version: 1.0.0 *& Category: Security / Administration *& Operations: CHECK, SEARCH, SU24_SCAN, SU24_REVERSE, SU24_COMPARE, *& DISABLED_LIST, DISABLE, ENABLE, SET_CHECK *&---------------------------------------------------------------------* FORM execute USING it_params TYPE ztt_zmcp_params CHANGING ct_result TYPE ztt_zmcp_params ct_messages TYPE bapiret2_t. " Clear output parameters CLEAR: ct_result, ct_messages. REFRESH: ct_result, ct_messages. " Local variables for parameters DATA: lv_operation TYPE string, lv_auth_object TYPE tobj-objct, lv_tcode TYPE string, lv_search_type TYPE string, lv_search_pattern TYPE string, lv_auth_class TYPE string, lv_field_name TYPE string, lv_okflag TYPE c LENGTH 1, lv_field_values TYPE string, lv_show_defaults TYPE string, lv_language TYPE sy-langu, lv_max_results TYPE i. " Return and result variables DATA: ls_message TYPE bapiret2, lv_result_json TYPE string, ls_result TYPE zmcp_param. FIELD-SYMBOLS: TYPE zmcp_param. " ── Extract operation parameter ────────────────────────────────────── READ TABLE it_params ASSIGNING WITH KEY name = 'operation'. IF sy-subrc = 0. lv_operation = -value. TRANSLATE lv_operation TO UPPER CASE. ELSE. ls_message-type = 'E'. ls_message-message = 'Operation parameter is required (CHECK/SEARCH/SU24_SCAN/SU24_REVERSE/SU24_COMPARE/DISABLED_LIST/DISABLE/ENABLE/SET_CHECK)'. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing operation parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. " ── Extract all parameters ─────────────────────────────────────────── READ TABLE it_params ASSIGNING WITH KEY name = 'authObject'. IF sy-subrc = 0. lv_auth_object = -value. TRANSLATE lv_auth_object TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'tcode'. IF sy-subrc = 0. lv_tcode = -value. TRANSLATE lv_tcode TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'searchType'. IF sy-subrc = 0. lv_search_type = -value. TRANSLATE lv_search_type TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'searchPattern'. IF sy-subrc = 0. lv_search_pattern = -value. TRANSLATE lv_search_pattern TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'authClass'. IF sy-subrc = 0. lv_auth_class = -value. TRANSLATE lv_auth_class TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'fieldName'. IF sy-subrc = 0. lv_field_name = -value. TRANSLATE lv_field_name TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'okflag'. IF sy-subrc = 0. lv_okflag = -value. TRANSLATE lv_okflag TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'fieldValues'. IF sy-subrc = 0. lv_field_values = -value. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'showDefaults'. IF sy-subrc = 0. lv_show_defaults = -value. TRANSLATE lv_show_defaults TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'language'. IF sy-subrc = 0 AND -value IS NOT INITIAL. lv_language = -value. TRANSLATE lv_language TO UPPER CASE. ELSE. lv_language = 'E'. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'maxResults'. IF sy-subrc = 0. TRY. lv_max_results = -value. CATCH cx_sy_conversion_no_number. lv_max_results = 100. ENDTRY. ENDIF. IF lv_max_results <= 0. lv_max_results = 100. ENDIF. " ── Validate required parameters per operation ─────────────────────── CASE lv_operation. WHEN 'CHECK' OR 'SU24_REVERSE' OR 'DISABLE' OR 'ENABLE'. IF lv_auth_object IS INITIAL. ls_message-type = 'E'. ls_message-message = |authObject parameter is required for { lv_operation } operation|. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing authObject parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. WHEN 'SU24_SCAN' OR 'SU24_COMPARE'. IF lv_tcode IS INITIAL. ls_message-type = 'E'. ls_message-message = |tcode parameter is required for { lv_operation } operation|. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing tcode parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. WHEN 'SET_CHECK'. IF lv_tcode IS INITIAL OR lv_auth_object IS INITIAL OR lv_okflag IS INITIAL. ls_message-type = 'E'. ls_message-message = 'tcode, authObject, and okflag parameters are required for SET_CHECK'. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing required parameters for SET_CHECK (tcode, authObject, okflag)"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. WHEN 'SEARCH'. IF lv_search_type IS INITIAL. ls_message-type = 'E'. ls_message-message = 'searchType parameter is required for SEARCH (PATTERN, CLASS, FIELD)'. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing searchType parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. WHEN 'DISABLED_LIST'. " No additional required parameters WHEN OTHERS. ls_message-type = 'E'. ls_message-message = |Invalid operation: { lv_operation }. Use CHECK, SEARCH, SU24_SCAN, SU24_REVERSE, SU24_COMPARE, DISABLED_LIST, DISABLE, ENABLE, or SET_CHECK|. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Invalid operation: { lv_operation }"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDCASE. " ── Dispatch to operation handler ──────────────────────────────────── CASE lv_operation. WHEN 'CHECK'. PERFORM op_check USING lv_auth_object lv_language CHANGING lv_result_json ct_messages. WHEN 'SEARCH'. PERFORM op_search USING lv_search_type lv_search_pattern lv_auth_class lv_field_name lv_language lv_max_results CHANGING lv_result_json ct_messages. WHEN 'SU24_SCAN'. PERFORM op_su24_scan USING lv_tcode lv_show_defaults lv_language lv_max_results CHANGING lv_result_json ct_messages. WHEN 'SU24_REVERSE'. PERFORM op_su24_reverse USING lv_auth_object lv_show_defaults lv_language lv_max_results CHANGING lv_result_json ct_messages. WHEN 'SU24_COMPARE'. PERFORM op_su24_compare USING lv_tcode lv_language lv_max_results CHANGING lv_result_json ct_messages. WHEN 'DISABLED_LIST'. PERFORM op_disabled_list USING lv_language lv_max_results CHANGING lv_result_json ct_messages. WHEN 'DISABLE'. PERFORM op_disable USING lv_auth_object CHANGING lv_result_json ct_messages. WHEN 'ENABLE'. PERFORM op_enable USING lv_auth_object CHANGING lv_result_json ct_messages. WHEN 'SET_CHECK'. PERFORM op_set_check USING lv_tcode lv_auth_object lv_okflag lv_field_values CHANGING lv_result_json ct_messages. ENDCASE. " Add result to output ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. ENDFORM. *&---------------------------------------------------------------------* *& Utility: GET_OBJECT_FIELDS *&---------------------------------------------------------------------* *& Extract field names from TOBJ record (FIEL1..FIEL0 = 10 fields) *&---------------------------------------------------------------------* FORM get_object_fields USING ps_tobj TYPE tobj CHANGING pt_fields TYPE string_table. DATA: lv_field TYPE fieldname. CLEAR pt_fields. DO 10 TIMES. CLEAR lv_field. CASE sy-index. WHEN 1. lv_field = ps_tobj-fiel1. WHEN 2. lv_field = ps_tobj-fiel2. WHEN 3. lv_field = ps_tobj-fiel3. WHEN 4. lv_field = ps_tobj-fiel4. WHEN 5. lv_field = ps_tobj-fiel5. WHEN 6. lv_field = ps_tobj-fiel6. WHEN 7. lv_field = ps_tobj-fiel7. WHEN 8. lv_field = ps_tobj-fiel8. WHEN 9. lv_field = ps_tobj-fiel9. WHEN 10. lv_field = ps_tobj-fiel0. ENDCASE. IF lv_field IS NOT INITIAL. APPEND lv_field TO pt_fields. ENDIF. ENDDO. ENDFORM. *&---------------------------------------------------------------------* *& Utility: ESCAPE_JSON_STRING *&---------------------------------------------------------------------* *& Escape backslash and double quotes for safe JSON embedding *&---------------------------------------------------------------------* FORM escape_json_string CHANGING pv_string TYPE string. REPLACE ALL OCCURRENCES OF '\' IN pv_string WITH '\\'. REPLACE ALL OCCURRENCES OF '"' IN pv_string WITH '\"'. ENDFORM. *&---------------------------------------------------------------------* *& Utility: GET_OBJECT_DESCRIPTION *&---------------------------------------------------------------------* *& Get auth object description from TOBJT with language fallback *&---------------------------------------------------------------------* FORM get_object_description USING pv_object TYPE tobj-objct pv_language TYPE sy-langu CHANGING pv_description TYPE string. CLEAR pv_description. SELECT SINGLE ttext FROM tobjt INTO pv_description WHERE object = pv_object AND langu = pv_language. IF sy-subrc <> 0 AND pv_language <> 'E'. SELECT SINGLE ttext FROM tobjt INTO pv_description WHERE object = pv_object AND langu = 'E'. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Utility: MAP_OKFLAG *&---------------------------------------------------------------------* *& Map OKFLAG value to readable check indicator text *&---------------------------------------------------------------------* FORM map_okflag USING pv_okflag TYPE c CHANGING pv_indicator TYPE string. CASE pv_okflag. WHEN 'Y'. pv_indicator = 'CHECK_WITH_DEFAULTS'. WHEN 'X'. pv_indicator = 'CHECK'. WHEN 'N'. pv_indicator = 'NO_CHECK'. WHEN ' '. pv_indicator = 'NOT_SET'. WHEN OTHERS. pv_indicator = pv_okflag. ENDCASE. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_CHECK *&---------------------------------------------------------------------* *& Full auth object details: fields, class, description, activities, *& disabled status *&---------------------------------------------------------------------* FORM op_check USING pv_auth_object TYPE tobj-objct pv_language TYPE sy-langu CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check if auth object exists in TOBJ DATA: ls_tobj TYPE tobj. SELECT SINGLE * FROM tobj INTO ls_tobj WHERE objct = pv_auth_object. IF sy-subrc <> 0. ls_message-type = 'W'. ls_message-message = |Auth object { pv_auth_object } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "exists": false, "auth_object": "{ pv_auth_object }"{ '}' }|. RETURN. ENDIF. " Get description DATA: lv_description TYPE string, lv_desc_safe TYPE string. PERFORM get_object_description USING pv_auth_object pv_language CHANGING lv_description. lv_desc_safe = lv_description. PERFORM escape_json_string CHANGING lv_desc_safe. " Get auth class description DATA: lv_class_desc TYPE string, lv_class_desc_safe TYPE string. SELECT SINGLE ctext FROM tobct INTO lv_class_desc WHERE oclss = ls_tobj-oclss AND langu = pv_language. IF sy-subrc <> 0 AND pv_language <> 'E'. SELECT SINGLE ctext FROM tobct INTO lv_class_desc WHERE oclss = ls_tobj-oclss AND langu = 'E'. ENDIF. lv_class_desc_safe = lv_class_desc. PERFORM escape_json_string CHANGING lv_class_desc_safe. " Extract fields DATA: lt_fields TYPE string_table, lv_field TYPE string, lv_fields_json TYPE string, lv_fields_count TYPE i. PERFORM get_object_fields USING ls_tobj CHANGING lt_fields. lv_fields_count = lines( lt_fields ). lv_fields_json = '['. LOOP AT lt_fields INTO lv_field. IF sy-tabix > 1. lv_fields_json = lv_fields_json && ','. ENDIF. lv_fields_json = lv_fields_json && |"{ lv_field }"|. ENDLOOP. lv_fields_json = lv_fields_json && ']'. " Get permitted activities from TACTZ DATA: lt_tactz TYPE TABLE OF tactz, ls_tactz TYPE tactz, lv_activities_json TYPE string. SELECT * FROM tactz INTO TABLE lt_tactz WHERE brobj = pv_auth_object. lv_activities_json = '['. LOOP AT lt_tactz INTO ls_tactz. IF sy-tabix > 1. lv_activities_json = lv_activities_json && ','. ENDIF. lv_activities_json = lv_activities_json && |"{ ls_tactz-actvt }"|. ENDLOOP. lv_activities_json = lv_activities_json && ']'. " Check disabled status in TOBJ_OFF DATA: lv_disabled TYPE abap_bool VALUE abap_false, lv_disabled_date TYPE string, lv_disabled_by TYPE string. DATA: ls_tobj_off TYPE tobj_off. SELECT SINGLE * FROM tobj_off INTO ls_tobj_off WHERE objct = pv_auth_object. IF sy-subrc = 0. lv_disabled = abap_true. lv_disabled_date = ls_tobj_off-step_date. lv_disabled_by = ls_tobj_off-step_user. ENDIF. " Build result JSON DATA: lv_disabled_text TYPE string. IF lv_disabled = abap_true. lv_disabled_text = |, "disabled_since": "{ lv_disabled_date }", "disabled_by": "{ lv_disabled_by }"|. ENDIF. pv_result_json = |{ '{' }"success": true, "exists": true, | && |"auth_object": "{ pv_auth_object }", | && |"description": "{ lv_desc_safe }", | && |"auth_class": "{ ls_tobj-oclss }", | && |"class_description": "{ lv_class_desc_safe }", | && |"fields": { lv_fields_json }, "fields_count": { lv_fields_count }, | && |"permitted_activities": { lv_activities_json }, | && |"disabled": { COND string( WHEN lv_disabled = abap_true THEN 'true' ELSE 'false' ) }| && |{ lv_disabled_text }{ '}' }|. ls_message-type = 'S'. ls_message-message = |Auth object { pv_auth_object } check completed|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SEARCH *&---------------------------------------------------------------------* *& Browse auth object catalog by PATTERN, CLASS, or FIELD *&---------------------------------------------------------------------* FORM op_search USING pv_search_type TYPE string pv_search_pattern TYPE string pv_auth_class TYPE string pv_field_name TYPE string pv_language TYPE sy-langu pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Result structures TYPES: BEGIN OF ty_search_result, objct TYPE tobj-objct, oclss TYPE tobj-oclss, END OF ty_search_result. DATA: lt_results TYPE TABLE OF ty_search_result, ls_result TYPE ty_search_result, lv_results_json TYPE string, lv_results_count TYPE i. CASE pv_search_type. WHEN 'PATTERN'. IF pv_search_pattern IS INITIAL. ls_message-type = 'E'. ls_message-message = 'searchPattern is required for SEARCH by PATTERN'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing searchPattern parameter"{ '}' }|. RETURN. ENDIF. " Convert * wildcard to SQL % DATA: lv_pattern TYPE string. lv_pattern = pv_search_pattern. REPLACE ALL OCCURRENCES OF '*' IN lv_pattern WITH '%'. SELECT objct oclss FROM tobj INTO TABLE lt_results UP TO pv_max_results ROWS WHERE objct LIKE lv_pattern. WHEN 'CLASS'. IF pv_auth_class IS INITIAL. ls_message-type = 'E'. ls_message-message = 'authClass is required for SEARCH by CLASS'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing authClass parameter"{ '}' }|. RETURN. ENDIF. SELECT objct oclss FROM tobj INTO TABLE lt_results UP TO pv_max_results ROWS WHERE oclss = pv_auth_class. WHEN 'FIELD'. IF pv_field_name IS INITIAL. ls_message-type = 'E'. ls_message-message = 'fieldName is required for SEARCH by FIELD'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing fieldName parameter"{ '}' }|. RETURN. ENDIF. SELECT objct oclss FROM tobj INTO TABLE lt_results UP TO pv_max_results ROWS WHERE fiel1 = pv_field_name OR fiel2 = pv_field_name OR fiel3 = pv_field_name OR fiel4 = pv_field_name OR fiel5 = pv_field_name OR fiel6 = pv_field_name OR fiel7 = pv_field_name OR fiel8 = pv_field_name OR fiel9 = pv_field_name OR fiel0 = pv_field_name. WHEN OTHERS. ls_message-type = 'E'. ls_message-message = |Invalid searchType: { pv_search_type }. Use PATTERN, CLASS, or FIELD|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Invalid searchType: { pv_search_type }"{ '}' }|. RETURN. ENDCASE. lv_results_count = lines( lt_results ). " Get class description for CLASS search DATA: lv_class_name TYPE string, lv_class_name_safe TYPE string. IF pv_search_type = 'CLASS' AND pv_auth_class IS NOT INITIAL. SELECT SINGLE ctext FROM tobct INTO lv_class_name WHERE oclss = pv_auth_class AND langu = pv_language. IF sy-subrc <> 0 AND pv_language <> 'E'. SELECT SINGLE ctext FROM tobct INTO lv_class_name WHERE oclss = pv_auth_class AND langu = 'E'. ENDIF. lv_class_name_safe = lv_class_name. PERFORM escape_json_string CHANGING lv_class_name_safe. ENDIF. " Build results array lv_results_json = '['. LOOP AT lt_results INTO ls_result. IF sy-tabix > 1. lv_results_json = lv_results_json && ','. ENDIF. DATA: lv_desc TYPE string, lv_desc_safe TYPE string. CLEAR lv_desc. PERFORM get_object_description USING ls_result-objct pv_language CHANGING lv_desc. lv_desc_safe = lv_desc. PERFORM escape_json_string CHANGING lv_desc_safe. lv_results_json = lv_results_json && |{ '{' }"auth_object": "{ ls_result-objct }", | && |"description": "{ lv_desc_safe }", | && |"auth_class": "{ ls_result-oclss }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. " Build search info for result DATA: lv_search_info TYPE string. CASE pv_search_type. WHEN 'PATTERN'. lv_search_info = |"search_type": "PATTERN", "search_pattern": "{ pv_search_pattern }"|. WHEN 'CLASS'. lv_search_info = |"search_type": "CLASS", "auth_class": "{ pv_auth_class }", "class_description": "{ lv_class_name_safe }"|. WHEN 'FIELD'. lv_search_info = |"search_type": "FIELD", "field_name": "{ pv_field_name }"|. ENDCASE. pv_result_json = |{ '{' }"success": true, { lv_search_info }, | && |"results": { lv_results_json }, "results_count": { lv_results_count }{ '}' }|. ls_message-type = 'S'. ls_message-message = |SEARCH ({ pv_search_type }) returned { lv_results_count } results|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SU24_SCAN *&---------------------------------------------------------------------* *& Show all auth objects a tcode checks with OKFLAG + defaults *&---------------------------------------------------------------------* FORM op_su24_scan USING pv_tcode TYPE string pv_show_defaults TYPE string pv_language TYPE sy-langu pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Get customer SU24 check indicators TYPES: BEGIN OF ty_usobx, object TYPE tobj-objct, okflag TYPE c LENGTH 1, END OF ty_usobx. DATA: lt_usobx TYPE TABLE OF ty_usobx, ls_usobx TYPE ty_usobx. SELECT object okflag FROM usobx_c INTO TABLE lt_usobx UP TO pv_max_results ROWS WHERE name = pv_tcode AND type = 'TR'. IF lt_usobx IS INITIAL. ls_message-type = 'W'. ls_message-message = |No SU24 entries found for tcode { pv_tcode }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "tcode": "{ pv_tcode }", | && |"auth_objects": [], "auth_objects_count": 0, | && |"checked_count": 0, "unchecked_count": 0{ '}' }|. RETURN. ENDIF. " Optionally get default field values from USOBT_C TYPES: BEGIN OF ty_usobt, object TYPE tobj-objct, field TYPE fieldname, low TYPE string, END OF ty_usobt. DATA: lt_usobt TYPE TABLE OF ty_usobt. IF pv_show_defaults = 'TRUE' OR pv_show_defaults = 'X'. SELECT object field low FROM usobt_c INTO TABLE lt_usobt WHERE name = pv_tcode AND type = 'TR'. ENDIF. " Build results DATA: lv_objects_json TYPE string, lv_checked TYPE i, lv_unchecked TYPE i, lv_total TYPE i. lv_objects_json = '['. LOOP AT lt_usobx INTO ls_usobx. IF sy-tabix > 1. lv_objects_json = lv_objects_json && ','. ENDIF. " Get description DATA: lv_obj_desc TYPE string, lv_obj_desc_safe TYPE string. CLEAR lv_obj_desc. PERFORM get_object_description USING ls_usobx-object pv_language CHANGING lv_obj_desc. lv_obj_desc_safe = lv_obj_desc. PERFORM escape_json_string CHANGING lv_obj_desc_safe. " Map OKFLAG DATA: lv_indicator TYPE string. PERFORM map_okflag USING ls_usobx-okflag CHANGING lv_indicator. " Count checked vs unchecked IF ls_usobx-okflag = 'N' OR ls_usobx-okflag = ' '. lv_unchecked = lv_unchecked + 1. ELSE. lv_checked = lv_checked + 1. ENDIF. lv_objects_json = lv_objects_json && |{ '{' }"auth_object": "{ ls_usobx-object }", | && |"description": "{ lv_obj_desc_safe }", | && |"okflag": "{ ls_usobx-okflag }", | && |"check_indicator": "{ lv_indicator }"|. " Add defaults if requested IF pv_show_defaults = 'TRUE' OR pv_show_defaults = 'X'. DATA: lv_defaults_json TYPE string, lv_def_count TYPE i. lv_defaults_json = '['. lv_def_count = 0. LOOP AT lt_usobt INTO DATA(ls_usobt) WHERE object = ls_usobx-object. lv_def_count = lv_def_count + 1. IF lv_def_count > 1. lv_defaults_json = lv_defaults_json && ','. ENDIF. DATA: lv_low_safe TYPE string. lv_low_safe = ls_usobt-low. PERFORM escape_json_string CHANGING lv_low_safe. lv_defaults_json = lv_defaults_json && |{ '{' }"field": "{ ls_usobt-field }", "low": "{ lv_low_safe }"{ '}' }|. ENDLOOP. lv_defaults_json = lv_defaults_json && ']'. lv_objects_json = lv_objects_json && |, "defaults": { lv_defaults_json }|. ENDIF. lv_objects_json = lv_objects_json && '}'. ENDLOOP. lv_objects_json = lv_objects_json && ']'. lv_total = lines( lt_usobx ). pv_result_json = |{ '{' }"success": true, "tcode": "{ pv_tcode }", | && |"auth_objects": { lv_objects_json }, | && |"auth_objects_count": { lv_total }, | && |"checked_count": { lv_checked }, | && |"unchecked_count": { lv_unchecked }{ '}' }|. ls_message-type = 'S'. ls_message-message = |SU24 scan for { pv_tcode }: { lv_total } objects ({ lv_checked } checked, { lv_unchecked } unchecked)|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SU24_REVERSE *&---------------------------------------------------------------------* *& Reverse lookup: find all tcodes that check a given auth object *&---------------------------------------------------------------------* FORM op_su24_reverse USING pv_auth_object TYPE tobj-objct pv_show_defaults TYPE string pv_language TYPE sy-langu pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Get all tcodes that reference this auth object TYPES: BEGIN OF ty_reverse, name TYPE string, okflag TYPE c LENGTH 1, END OF ty_reverse. DATA: lt_reverse TYPE TABLE OF ty_reverse, ls_reverse TYPE ty_reverse. SELECT name okflag FROM usobx_c INTO TABLE lt_reverse UP TO pv_max_results ROWS WHERE object = pv_auth_object AND type = 'TR'. IF lt_reverse IS INITIAL. ls_message-type = 'W'. ls_message-message = |No SU24 entries found for auth object { pv_auth_object }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"tcodes": [], "tcodes_count": 0{ '}' }|. RETURN. ENDIF. " Get object description DATA: lv_obj_desc TYPE string, lv_obj_desc_safe TYPE string. PERFORM get_object_description USING pv_auth_object pv_language CHANGING lv_obj_desc. lv_obj_desc_safe = lv_obj_desc. PERFORM escape_json_string CHANGING lv_obj_desc_safe. " Optionally get defaults TYPES: BEGIN OF ty_rev_default, name TYPE string, field TYPE fieldname, low TYPE string, END OF ty_rev_default. DATA: lt_defaults TYPE TABLE OF ty_rev_default. IF pv_show_defaults = 'TRUE' OR pv_show_defaults = 'X'. SELECT name field low FROM usobt_c INTO TABLE lt_defaults WHERE object = pv_auth_object AND type = 'TR'. ENDIF. " Build results DATA: lv_tcodes_json TYPE string, lv_total TYPE i. lv_tcodes_json = '['. LOOP AT lt_reverse INTO ls_reverse. IF sy-tabix > 1. lv_tcodes_json = lv_tcodes_json && ','. ENDIF. DATA: lv_rev_indicator TYPE string. PERFORM map_okflag USING ls_reverse-okflag CHANGING lv_rev_indicator. lv_tcodes_json = lv_tcodes_json && |{ '{' }"tcode": "{ ls_reverse-name }", | && |"okflag": "{ ls_reverse-okflag }", | && |"check_indicator": "{ lv_rev_indicator }"|. " Add defaults if requested IF pv_show_defaults = 'TRUE' OR pv_show_defaults = 'X'. DATA: lv_rev_defaults_json TYPE string, lv_rev_def_count TYPE i. lv_rev_defaults_json = '['. lv_rev_def_count = 0. LOOP AT lt_defaults INTO DATA(ls_rev_def) WHERE name = ls_reverse-name. lv_rev_def_count = lv_rev_def_count + 1. IF lv_rev_def_count > 1. lv_rev_defaults_json = lv_rev_defaults_json && ','. ENDIF. DATA: lv_rev_low_safe TYPE string. lv_rev_low_safe = ls_rev_def-low. PERFORM escape_json_string CHANGING lv_rev_low_safe. lv_rev_defaults_json = lv_rev_defaults_json && |{ '{' }"field": "{ ls_rev_def-field }", "low": "{ lv_rev_low_safe }"{ '}' }|. ENDLOOP. lv_rev_defaults_json = lv_rev_defaults_json && ']'. lv_tcodes_json = lv_tcodes_json && |, "defaults": { lv_rev_defaults_json }|. ENDIF. lv_tcodes_json = lv_tcodes_json && '}'. ENDLOOP. lv_tcodes_json = lv_tcodes_json && ']'. lv_total = lines( lt_reverse ). pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"description": "{ lv_obj_desc_safe }", | && |"tcodes": { lv_tcodes_json }, "tcodes_count": { lv_total }{ '}' }|. ls_message-type = 'S'. ls_message-message = |SU24 reverse lookup for { pv_auth_object }: { lv_total } tcodes found|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SU24_COMPARE *&---------------------------------------------------------------------* *& Delta: SAP standard (USOBX/USOBT) vs customer (USOBX_C/USOBT_C) *&---------------------------------------------------------------------* FORM op_su24_compare USING pv_tcode TYPE string pv_language TYPE sy-langu pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Get SAP standard entries TYPES: BEGIN OF ty_su24_entry, object TYPE tobj-objct, okflag TYPE c LENGTH 1, END OF ty_su24_entry. DATA: lt_sap TYPE TABLE OF ty_su24_entry, ls_sap TYPE ty_su24_entry, lt_cust TYPE TABLE OF ty_su24_entry, ls_cust TYPE ty_su24_entry. SELECT object okflag FROM usobx INTO TABLE lt_sap WHERE name = pv_tcode AND type = 'TR'. SELECT object okflag FROM usobx_c INTO TABLE lt_cust WHERE name = pv_tcode AND type = 'TR'. IF lt_sap IS INITIAL AND lt_cust IS INITIAL. ls_message-type = 'W'. ls_message-message = |No SU24 entries found for tcode { pv_tcode } in either SAP or customer tables|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "tcode": "{ pv_tcode }", | && |"deltas": [], "unchanged_count": 0, "modified_count": 0, | && |"added_count": 0, "removed_count": 0{ '}' }|. RETURN. ENDIF. " Compare SAP vs Customer DATA: lv_deltas_json TYPE string, lv_unchanged TYPE i, lv_modified TYPE i, lv_added TYPE i, lv_removed TYPE i, lv_delta_idx TYPE i. lv_deltas_json = '['. " Check each SAP standard entry against customer LOOP AT lt_sap INTO ls_sap. READ TABLE lt_cust INTO ls_cust WITH KEY object = ls_sap-object. IF sy-subrc = 0. " Object exists in both — check if modified IF ls_sap-okflag = ls_cust-okflag. lv_unchanged = lv_unchanged + 1. ELSE. lv_modified = lv_modified + 1. lv_delta_idx = lv_delta_idx + 1. IF lv_delta_idx > 1. lv_deltas_json = lv_deltas_json && ','. ENDIF. DATA: lv_sap_ind TYPE string, lv_cust_ind TYPE string. PERFORM map_okflag USING ls_sap-okflag CHANGING lv_sap_ind. PERFORM map_okflag USING ls_cust-okflag CHANGING lv_cust_ind. DATA: lv_cmp_desc TYPE string, lv_cmp_desc_safe TYPE string. CLEAR lv_cmp_desc. PERFORM get_object_description USING ls_sap-object pv_language CHANGING lv_cmp_desc. lv_cmp_desc_safe = lv_cmp_desc. PERFORM escape_json_string CHANGING lv_cmp_desc_safe. lv_deltas_json = lv_deltas_json && |{ '{' }"auth_object": "{ ls_sap-object }", | && |"description": "{ lv_cmp_desc_safe }", | && |"status": "MODIFIED", | && |"sap_okflag": "{ ls_sap-okflag }", "sap_indicator": "{ lv_sap_ind }", | && |"customer_okflag": "{ ls_cust-okflag }", "customer_indicator": "{ lv_cust_ind }"{ '}' }|. ENDIF. ELSE. " Object in SAP but not in customer = REMOVED lv_removed = lv_removed + 1. lv_delta_idx = lv_delta_idx + 1. IF lv_delta_idx > 1. lv_deltas_json = lv_deltas_json && ','. ENDIF. DATA: lv_rem_desc TYPE string, lv_rem_desc_safe TYPE string. CLEAR lv_rem_desc. PERFORM get_object_description USING ls_sap-object pv_language CHANGING lv_rem_desc. lv_rem_desc_safe = lv_rem_desc. PERFORM escape_json_string CHANGING lv_rem_desc_safe. DATA: lv_rem_sap_ind TYPE string. PERFORM map_okflag USING ls_sap-okflag CHANGING lv_rem_sap_ind. lv_deltas_json = lv_deltas_json && |{ '{' }"auth_object": "{ ls_sap-object }", | && |"description": "{ lv_rem_desc_safe }", | && |"status": "REMOVED", | && |"sap_okflag": "{ ls_sap-okflag }", "sap_indicator": "{ lv_rem_sap_ind }", | && |"customer_okflag": "", "customer_indicator": ""{ '}' }|. ENDIF. ENDLOOP. " Check for customer-only entries (ADDED) LOOP AT lt_cust INTO ls_cust. READ TABLE lt_sap INTO ls_sap WITH KEY object = ls_cust-object. IF sy-subrc <> 0. " Object in customer but not in SAP = ADDED lv_added = lv_added + 1. lv_delta_idx = lv_delta_idx + 1. IF lv_delta_idx > 1. lv_deltas_json = lv_deltas_json && ','. ENDIF. DATA: lv_add_desc TYPE string, lv_add_desc_safe TYPE string. CLEAR lv_add_desc. PERFORM get_object_description USING ls_cust-object pv_language CHANGING lv_add_desc. lv_add_desc_safe = lv_add_desc. PERFORM escape_json_string CHANGING lv_add_desc_safe. DATA: lv_add_cust_ind TYPE string. PERFORM map_okflag USING ls_cust-okflag CHANGING lv_add_cust_ind. lv_deltas_json = lv_deltas_json && |{ '{' }"auth_object": "{ ls_cust-object }", | && |"description": "{ lv_add_desc_safe }", | && |"status": "ADDED", | && |"sap_okflag": "", "sap_indicator": "", | && |"customer_okflag": "{ ls_cust-okflag }", "customer_indicator": "{ lv_add_cust_ind }"{ '}' }|. ENDIF. ENDLOOP. lv_deltas_json = lv_deltas_json && ']'. pv_result_json = |{ '{' }"success": true, "tcode": "{ pv_tcode }", | && |"deltas": { lv_deltas_json }, | && |"unchanged_count": { lv_unchanged }, | && |"modified_count": { lv_modified }, | && |"added_count": { lv_added }, | && |"removed_count": { lv_removed }{ '}' }|. ls_message-type = 'S'. ls_message-message = |SU24 compare for { pv_tcode }: { lv_unchanged } unchanged, { lv_modified } modified, { lv_added } added, { lv_removed } removed|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_DISABLED_LIST *&---------------------------------------------------------------------* *& List all globally disabled auth objects from TOBJ_OFF *&---------------------------------------------------------------------* FORM op_disabled_list USING pv_language TYPE sy-langu pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check if disabling feature is active DATA: lv_disabling_active TYPE abap_bool VALUE abap_false. TRY. CALL FUNCTION 'PRGN_DISABLING_ACTIVE_CHECK'. " If no exception, disabling is active lv_disabling_active = abap_true. CATCH cx_root. " FM may not exist in some releases — fall back to direct table check DATA: lv_off_count TYPE i. SELECT COUNT(*) FROM tobj_off INTO lv_off_count. IF lv_off_count > 0. lv_disabling_active = abap_true. ENDIF. ENDTRY. " Get disabled objects DATA: lt_tobj_off TYPE TABLE OF tobj_off, ls_tobj_off TYPE tobj_off. SELECT * FROM tobj_off INTO TABLE lt_tobj_off UP TO pv_max_results ROWS. IF lt_tobj_off IS INITIAL. pv_result_json = |{ '{' }"success": true, | && |"disabling_active": { COND string( WHEN lv_disabling_active = abap_true THEN 'true' ELSE 'false' ) }, | && |"disabled_objects": [], "disabled_count": 0{ '}' }|. ls_message-type = 'S'. ls_message-message = 'No disabled auth objects found'. APPEND ls_message TO ct_messages. RETURN. ENDIF. " Build results with descriptions DATA: lv_disabled_json TYPE string, lv_disabled_count TYPE i. lv_disabled_json = '['. LOOP AT lt_tobj_off INTO ls_tobj_off. IF sy-tabix > 1. lv_disabled_json = lv_disabled_json && ','. ENDIF. DATA: lv_dis_desc TYPE string, lv_dis_desc_safe TYPE string. CLEAR lv_dis_desc. PERFORM get_object_description USING ls_tobj_off-objct pv_language CHANGING lv_dis_desc. lv_dis_desc_safe = lv_dis_desc. PERFORM escape_json_string CHANGING lv_dis_desc_safe. lv_disabled_json = lv_disabled_json && |{ '{' }"auth_object": "{ ls_tobj_off-objct }", | && |"description": "{ lv_dis_desc_safe }", | && |"disabled_since": "{ ls_tobj_off-step_date }", | && |"disabled_by": "{ ls_tobj_off-step_user }"{ '}' }|. ENDLOOP. lv_disabled_json = lv_disabled_json && ']'. lv_disabled_count = lines( lt_tobj_off ). pv_result_json = |{ '{' }"success": true, | && |"disabling_active": { COND string( WHEN lv_disabling_active = abap_true THEN 'true' ELSE 'false' ) }, | && |"disabled_objects": { lv_disabled_json }, | && |"disabled_count": { lv_disabled_count }{ '}' }|. ls_message-type = 'S'. ls_message-message = |{ lv_disabled_count } disabled auth objects found|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_DISABLE *&---------------------------------------------------------------------* *& Globally disable an auth object (insert into TOBJ_OFF) *&---------------------------------------------------------------------* FORM op_disable USING pv_auth_object TYPE tobj-objct CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Validate object exists in TOBJ DATA: lv_obj_exists TYPE i. SELECT COUNT(*) FROM tobj INTO lv_obj_exists WHERE objct = pv_auth_object. IF lv_obj_exists = 0. ls_message-type = 'E'. ls_message-message = |Auth object { pv_auth_object } does not exist in TOBJ|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Auth object { pv_auth_object } does not exist"{ '}' }|. RETURN. ENDIF. " Check if already disabled DATA: lv_already_disabled TYPE i. SELECT COUNT(*) FROM tobj_off INTO lv_already_disabled WHERE objct = pv_auth_object. IF lv_already_disabled > 0. ls_message-type = 'W'. ls_message-message = |Auth object { pv_auth_object } is already disabled|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"message": "Already disabled", "already_disabled": true{ '}' }|. RETURN. ENDIF. " Insert into TOBJ_OFF DATA: ls_tobj_off TYPE tobj_off. ls_tobj_off-mandt = sy-mandt. ls_tobj_off-objct = pv_auth_object. ls_tobj_off-step_date = sy-datum. ls_tobj_off-step_time = sy-uzeit. ls_tobj_off-step_user = sy-uname. ls_tobj_off-release = sy-saprl. INSERT tobj_off FROM ls_tobj_off. IF sy-subrc = 0. COMMIT WORK AND WAIT. ls_message-type = 'S'. ls_message-message = |Auth object { pv_auth_object } disabled successfully|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"message": "Auth object disabled globally", | && |"disabled_by": "{ sy-uname }", "disabled_since": "{ sy-datum }"{ '}' }|. ELSE. ls_message-type = 'E'. ls_message-message = |Failed to disable auth object { pv_auth_object }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Failed to insert into TOBJ_OFF"{ '}' }|. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_ENABLE *&---------------------------------------------------------------------* *& Re-enable a disabled auth object (delete from TOBJ_OFF) *&---------------------------------------------------------------------* FORM op_enable USING pv_auth_object TYPE tobj-objct CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check if currently disabled DATA: lv_is_disabled TYPE i. SELECT COUNT(*) FROM tobj_off INTO lv_is_disabled WHERE objct = pv_auth_object. IF lv_is_disabled = 0. ls_message-type = 'W'. ls_message-message = |Auth object { pv_auth_object } is not disabled|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"message": "Not disabled - no action needed", "was_disabled": false{ '}' }|. RETURN. ENDIF. " Delete from TOBJ_OFF DELETE FROM tobj_off WHERE objct = pv_auth_object. IF sy-subrc = 0. COMMIT WORK AND WAIT. ls_message-type = 'S'. ls_message-message = |Auth object { pv_auth_object } enabled successfully|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "auth_object": "{ pv_auth_object }", | && |"message": "Auth object re-enabled globally", "was_disabled": true, | && |"enabled_by": "{ sy-uname }"{ '}' }|. ELSE. ls_message-type = 'E'. ls_message-message = |Failed to enable auth object { pv_auth_object }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Failed to delete from TOBJ_OFF"{ '}' }|. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SET_CHECK *&---------------------------------------------------------------------* *& Set SU24 check indicator + default values for tcode/object pair *&---------------------------------------------------------------------* FORM op_set_check USING pv_tcode TYPE string pv_auth_object TYPE tobj-objct pv_okflag TYPE c pv_field_values TYPE string CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Validate okflag IF pv_okflag <> 'X' AND pv_okflag <> 'N'. ls_message-type = 'E'. ls_message-message = |Invalid okflag: { pv_okflag }. Use X (check) or N (no-check)|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Invalid okflag. Use X or N"{ '}' }|. RETURN. ENDIF. " Validate auth object exists DATA: lv_obj_exists TYPE i. SELECT COUNT(*) FROM tobj INTO lv_obj_exists WHERE objct = pv_auth_object. IF lv_obj_exists = 0. ls_message-type = 'E'. ls_message-message = |Auth object { pv_auth_object } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Auth object { pv_auth_object } does not exist"{ '}' }|. RETURN. ENDIF. " Check if entry exists in USOBX_C DATA: ls_usobx_c TYPE usobx_c, lv_entry_existed TYPE abap_bool VALUE abap_false. SELECT SINGLE * FROM usobx_c INTO ls_usobx_c WHERE name = pv_tcode AND type = 'TR' AND object = pv_auth_object. IF sy-subrc = 0. lv_entry_existed = abap_true. " Update existing entry UPDATE usobx_c SET okflag = pv_okflag WHERE name = pv_tcode AND type = 'TR' AND object = pv_auth_object. ELSE. " Insert new entry CLEAR ls_usobx_c. ls_usobx_c-name = pv_tcode. ls_usobx_c-type = 'TR'. ls_usobx_c-object = pv_auth_object. ls_usobx_c-okflag = pv_okflag. INSERT usobx_c FROM ls_usobx_c. ENDIF. " Process field values if provided DATA: lv_fields_updated TYPE i VALUE 0, lv_field_results_json TYPE string. lv_field_results_json = '['. IF pv_field_values IS NOT INITIAL. " Parse comma-separated FIELD=LOW pairs DATA: lt_pairs TYPE TABLE OF string, lv_pair TYPE string. SPLIT pv_field_values AT ',' INTO TABLE lt_pairs. LOOP AT lt_pairs INTO lv_pair. " Trim whitespace CONDENSE lv_pair. IF lv_pair IS INITIAL. CONTINUE. ENDIF. " Split on = DATA: lv_fld TYPE string, lv_val TYPE string. SPLIT lv_pair AT '=' INTO lv_fld lv_val. TRANSLATE lv_fld TO UPPER CASE. IF lv_fld IS INITIAL. CONTINUE. ENDIF. " MODIFY USOBT_C (insert or update) DATA: ls_usobt_c TYPE usobt_c. CLEAR ls_usobt_c. ls_usobt_c-name = pv_tcode. ls_usobt_c-type = 'TR'. ls_usobt_c-object = pv_auth_object. ls_usobt_c-field = lv_fld. ls_usobt_c-low = lv_val. MODIFY usobt_c FROM ls_usobt_c. lv_fields_updated = lv_fields_updated + 1. IF lv_fields_updated > 1. lv_field_results_json = lv_field_results_json && ','. ENDIF. DATA: lv_val_safe TYPE string. lv_val_safe = lv_val. PERFORM escape_json_string CHANGING lv_val_safe. lv_field_results_json = lv_field_results_json && |{ '{' }"field": "{ lv_fld }", "low": "{ lv_val_safe }"{ '}' }|. ENDLOOP. ENDIF. lv_field_results_json = lv_field_results_json && ']'. COMMIT WORK AND WAIT. " Map the okflag for response DATA: lv_set_indicator TYPE string. PERFORM map_okflag USING pv_okflag CHANGING lv_set_indicator. DATA: lv_action TYPE string. IF lv_entry_existed = abap_true. lv_action = 'updated'. ELSE. lv_action = 'created'. ENDIF. pv_result_json = |{ '{' }"success": true, | && |"tcode": "{ pv_tcode }", | && |"auth_object": "{ pv_auth_object }", | && |"okflag": "{ pv_okflag }", | && |"check_indicator": "{ lv_set_indicator }", | && |"action": "{ lv_action }", | && |"field_defaults": { lv_field_results_json }, | && |"fields_updated": { lv_fields_updated }, | && |"message": "SU24 check indicator { lv_action } successfully"{ '}' }|. ls_message-type = 'S'. ls_message-message = |SU24 entry { lv_action } for { pv_tcode }/{ pv_auth_object } (OKFLAG={ pv_okflag })|. APPEND ls_message TO ct_messages. ENDFORM.

auth_object_management

Related Tools

user_management

role_management