Authorization Checks in the HR Cluster 

Use

Different employee data is stored in the PCLx files (x = 1, 2, 3, 4). The application program usually has access to this data by means of the PCLx buffer (an interface for accessing the HR cluster that is supported by HR). If you try to access PCLx using the PCLx buffer, the system performs and authorization check (cluster authorization).

To check the cluster authorization, the system uses the HR: cluster (technical name: P_PCLX) object. The object is made up of two fields. One field contains the two-character name of the cluster (the name of the cluster determines a data area within the PCLx), the other field describes the authorization type (write, read).

If the system determines during authorization checks that the necessary authorization for a cluster does not exist, then the procedure (read, write, delete) specified for the cluster by the application program is not performed.

We make the following distinctions:

Read denotes that data is imported from PCLx. Write denotes that data is written to the buffer.

The system does not read/write PCLx data records for the cluster.

Technical information: the MAIN-SUBRC and SY-SUBRC fields are set. MAIN-SUBRC = 12 , SY-SUBRC <> 0 . These fields can be queried by the application program.

The data records that are to be deleted are first flagged in an internal table by the DELETE_REQUEST routine. By calling up the UPDATE_PERG_BUFFER(SAPUP50R) update routine, the data records flagged in the internal table are deleted.

The authorization check occurs when the data records are flagged. If no authorization exists, the records for that particular cluster are not flagged for deletion. (Technical information: SY-SUBRC <> 0 then applies.)

The authorization check does not check the dependencies between different clusters. When assigning authorizations, please ensure that a user has the same authorization for all clusters that are connected to one another. It makes no sense for a user to be able to obtain information from one cluster, but unable to obtain information from one of its connected clusters, because of his or her authorizations.