Authorization Error Analysis Functions 

The following special functions are available to you in transaction SU53 and SU56:

Functions in SU53

You can use the print function to print a completely-expanded tree of the authorization data.

You can choose the Other User button to displays the failed authorization check of another user, though only if the user in question has already started transaction SU53 himself or herself.

Functions in SU56

You can use the print function to print a completely-expanded tree of the authorization data to print, or print only all authorization objects with the associated class and the name of the authorization that contains the object.

The input help for Other User/Authorization Object provides all users of the system or all objects from the user buffer of the selected user.

The tree display contains an empty class with an authorization object if there are authorization objects in the user master that are not assigned to any class.

The tree display only contains roles or profiles of a reference user for an authorization object if the authorizations are not contained in a role or profile that is directly assigned to the user.

Functions in SU53 and SU56

The search only displays the next hit in the tree display. To obtain all hits in a separate window, use the search in the print preview (Text View button). You can also select sections of the tree in the print preview.

The tree display contains all profiles (composite and single profiles) that are directly assigned to the user and contain the authorization. If the authorization is contained in a single role, which is in turn contained in a composite role, only the single role that is indirectly assigned to the user is displayed.