Authorization Checks for HR Data Maintenance
Use
When a user selects a personnel administration transaction (for editing personal data and not setting up HR system tables), the system performs a general authorization check. In order for a user to be able to start a human resources transaction, they must at least have a read authorization for HR infotypes, that is, they must have the indicators
R or * in the Authorization level field in the HR: Master Data (P_ORGIN) object, for the transaction to be executed.If a user only has a read authorization for their own personnel number, they also need an R-authorization for the HR: Master Data (P_ORGIN) object.
The general authorization check also take place when the main switch for HR: Master data (ORGIN) is inactive.
After the user has entered a personnel number for a HR data maintenance transaction, the system checks whether the user has the relevant authorization for the person. If you are authorized to maintain the fields in the Organizational Assignment (0001) infotype for which authorization is required for the person and period in question, you can continue processing. Authorization-related fields in the infotype Organizational Assignment (0001) are Personnel Area, Employee Group, Employee Subgroup and Organizational Key.
If you are authorized to maintain a particular person’s data and you perform a user-controlled transaction (menu screens), the system checks that you have the authorization for the infotype/subtype needed to perform the action. This check is carried out after you have entered the infotype/subtype and specified the action. If transactions are system-guided, the system calls up the infotype/subtype instead of you having to enter it yourself. If there is no authorization for an infotype/subtype that is accessed by a system-guided transaction, the system skips it.
If you have authorization for the person and the operation required for the infotype/subtype, the system reads the infotype/subtype records from the database to a buffer. Each infotype/subtype data record in the buffer is assigned an indicator on the basis of organizational assignment data records; this indicator shows the administrator’s authorization.
Before an infotype record is saved to the database after editing, the system checks that you have the appropriate authorization. If not, it displays an error message.