Problem Description

Unnecessary performance losses can occur if there are redundancies after the structural authorizations have been defined, that is if the entries in the T77PR table ( Definition of Authorization Profiles ) overlap for a user. This is illustrated in the following example.

Example of an overall profile that leads to redundant checks:

This type of profile (several evaluation paths) is often used to implement authorization requirements that cannot be met using a standard evaluation path.

In the present example, the profile needs to contain authorization for organizational units, positions, jobs, and persons. This combination is not covered by any standard evaluation path, which is why the two evaluation paths mentioned above are used.

However, the creation of the set of objects takes longer because specific objects (O, S) are read several times:

Evaluation Path O-S-P

O B002 O

O B002 S

S A008 P

Evaluation Path O_O_S_C:

O B002 O

O B003 S

S A007 C

If these two evaluation paths are used simultaneously, organizational units (O) and positions (S) are read redundantly during the creation of the set of objects.

Solution

You can avoid this by defining your own evaluation path that meets all the requirements of the profile and reads the necessary objects only once. In the present example, you could define a Z_O_S_C_P evaluation path, for instance:

Evaluation Path Z_O_S_C_P:

O B002 O

O B003 S

S A008 P

S A007 C