# SAP ABAP AUTHORITY-CHECK Snippet Generator > Source: https://netray.co/tools/sap-abap-authority-check-snippet-generator > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Fill in an authorization object, activity and organisational field and get a ready ABAP AUTHORITY-CHECK block with error handling. ## Category developer ## Erp SAP ECC and S/4HANA ## Audience - ABAP developer - SAP security administrator ## Tool **Kind:** template **Output:** code **Language:** abap **Fields:** #### Authorization object **Key:** object **Type:** text **Default:** Z_ORDAPPR **Help:** Custom objects should be in the customer namespace, created in SU21. #### Organisational field name **Key:** org_field **Type:** text **Default:** BUKRS #### Variable holding the org value **Key:** org_var **Type:** text **Default:** lv_bukrs #### Activity (ACTVT) value **Key:** activity **Type:** select **Options:** - 01 - 02 - 03 - 06 - 16 **Default:** 02 **Help:** 01 create, 02 change, 03 display, 06 delete, 16 execute. #### Message class **Key:** msg_class **Type:** text **Default:** ZSEC #### Message number **Key:** msg_no **Type:** text **Default:** 001 **Blocks:** #### Authority check block **Body:** DATA lv_bukrs TYPE bukrs. * Check that the user may perform activity {{activity}} for this value AUTHORITY-CHECK OBJECT '{{object}}' ID 'ACTVT' FIELD '{{activity}}' ID '{{org_field}}' FIELD {{org_var}}. IF sy-subrc <> 0. MESSAGE e{{msg_no}}({{msg_class}}) WITH '{{object}}' {{org_var}}. ENDIF. #### Variant with a function module wrapper **Body:** FORM check_auth USING iv_value TYPE bukrs. AUTHORITY-CHECK OBJECT '{{object}}' ID 'ACTVT' FIELD '{{activity}}' ID '{{org_field}}' FIELD iv_value. IF sy-subrc <> 0. MESSAGE e{{msg_no}}({{msg_class}}) WITH '{{object}}' iv_value. ENDIF. ENDFORM. **Notes:** Verify before use: the field names must exist in the object created in SU21, and the data type of the variable must match the field. Unit test with a user that has and does not have the authorization (SU53 shows the failed check). Do not use AUTHORITY-CHECK as a replacement for a proper role design, and never skip it for performance reasons in code that exposes sensitive data. ## Content **Intro:** A custom report or function module that touches sensitive data needs an authorization check, and the syntax is easy to get slightly wrong. This generator builds the AUTHORITY-CHECK block with the activity field, an organisational field and a failure message. **Sections:** #### How to use it **Body:** Enter the name of the authorization object you created in SU21, the organisational field, the variable that holds the value to test, the activity code, and the message class and number you want to raise on failure. The output gives you a block you can paste into a report, class method or function module, plus a form routine variant. Copy it, adjust the data declarations to your program and test with users who do and do not have the authorization. **Bullets:** - Create the object and fields in SU21 first - Use ACTVT values from the standard activity list - Check sy-subrc immediately after the statement - Test with SU53 to see which check failed #### How AUTHORITY-CHECK works **Body:** The statement compares the field values you supply against the authorizations assigned to the user through roles. If the user holds at least one authorization of the object where every checked field matches, sy-subrc is 0. Any other value, commonly 4 for no authorization, 12 for no authorization for the object in the user master, means the check failed. Fields you do not list in the statement are not checked, so list each field you need, or use DUMMY for a field you want to skip. #### Design guidance **Body:** Check as early as possible and before reading sensitive data. Prefer one object per business meaning, with the fields that actually vary between roles, instead of many objects with a single field. Keep the message generic enough that it does not reveal internal data. Record the object, its fields and the default values in your security design documentation so role builders know which activities to assign, and remember to add the object to the default values for the transaction in SU24. #### Common mistakes **Body:** A missing check after the statement means the program continues even when the user is not authorized. Checking in the user interface layer only, while a function module is exposed through RFC or a service, leaves a gap. Hard-coding user names instead of using the authorization concept is another frequent audit finding. Also avoid placing AUTHORITY-CHECK inside tight loops over thousands of records without caching the result. **Cta:** If you want a reviewer for custom ABAP that checks for missing authorization checks, Netray can discuss a private, on-prem code review assistant. **Faq:** #### What does sy-subrc 4 mean here? **Answer:** After AUTHORITY-CHECK, sy-subrc 0 means the user has a matching authorization. A value of 4 means the user has the object but no authorization with matching values, and 12 means the user has no authorization for the object. Treat any non-zero value as failure. #### Do I need SU21 first? **Answer:** Yes. A custom authorization object and its fields must exist before the statement can run. Create the object in SU21 under an authorization class, then add it to roles through PFCG and set default values in SU24. #### Where do I see why the check failed? **Answer:** Run SU53 for the affected user right after the failure, or use the authorization trace in ST01 or STAUTHTRACE. They show the object, field values and the missing authorization, which is what the role administrator needs. #### Can I check several fields at once? **Answer:** Yes. Add more ID FIELD pairs to the same statement. The user passes only if one authorization of that object matches all the supplied field values together, which is different from several separate checks. ## Search terms abap authority-check example, abap authority check code generator, sap custom authorization object abap, authority-check object actvt abap, abap sy-subrc authority check message, sap su21 authorization object abap, abap authorization check bukrs, sap security abap snippet --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json