Checking Authorizations

The data selection can be further restricted according to the authorizations of the user. This authorization check is executed using authorization objects or transferring an application-specific authorization provider and is already taking place on the database.

Below is a short description of the two alternatives:

Transferring the Authorization Object

Transferring the authorization object has the consequence that only that data is read from the database to which the current user actually has access. This can potentially drastically reduce the data transfer to the user server.

lo_alv_display->add_authorization_for_object( 
        iv_authorization_object = 'S_CARRID'
        it_activities           = VALUE #( ( field = 'ACTVT' von = '03' ) )
        it_field_mapping        = VALUE #( ( auth_field = 'CARRID' view_field = 'CARRID' ) ) ).

Interface	Method
`IF_SALV_GUI_TABLE_IDA`	`add_authorization_for_object`

Example report for an in-container display: SALV_IDA_AUTHORIZATION

Method add_authorization_for_object has three transfer parameters:

Name of the authorization object
A list of activity-related fields and their values which (usually) correspond to a read authorization.

If the authorization object contains an activity field (for example, ACTVT), the parameter must be set, otherwise it is optional.
A list of assignments between all remaining fields of the authorization object and the corresponding columns of the database table. However, the parameter must definitely be used if the names of the fields in the authorization object are different to this of the column name, otherwise it is also optional.

Note

If you want to check multiple authorization objects, you can call method add_authorization_for_object repeatedly. In this case the restructions of the data selection can be done one after the other according to an AND link between the authorization objects.

Using an Application-Specific Authorization Provider

The authorization provider must be type IF_SADL_COND_PROVIDER_AUTHS. An instance created in the application can be transferred using method set_authorization_provider.

Interface	Method
`IF_SALV_GUI_TABLE_IDA`	`set_authorization_provider`

Example reports for an fullscreen display: SALV_IDA_AUTH_PROVIDER_FS

Note A mixture of both alternatives on the same ALV instance will result in an exception.

More Information

You can, for example, find more information about the ABAP authorization concept in the keyword documentation on the command AUTHORITY-CHECK.