authorization-iamlisted

# SAP Authorization & IAM Authorization in SAP is a chain: **user → role → profile → auth object → field values**. Every `AUTHORITY-CHECK` walks this chain at runtime. ## Prerequisites - SAP GUI or ADT access (SU01, SU21, PFCG, SU53) - ABAP development rights (S_DEVELOP with ACTVT 03+) - For S/4HANA IAM: Fiori launchpad admin access - For BTP: `cf` CLI + XSUAA service instance ## 1. AUTHORITY-CHECK (ABAP) Always check `sy-subrc` immediately — no exceptions. ```abap " Check before any sensitive operation AUTHORITY-CHECK OBJECT 'M_MATE_MAN' ID 'ACTVT' FIELD '01' " 01=Create 02=Change 03=Display 06=Delete ID 'WERKS' FIELD lv_plant. IF sy-subrc <> 0. RAISE EXCEPTION TYPE cx_zrouter EXPORTING mv_text = |No authorization for plant { lv_plant }|. ENDIF. ``` **Custom auth object** (create via SU21): ```abap " Object: ZROUTER | Class: ZR | Fields: ACTVT, MODULE AUTHORITY-CHECK OBJECT 'ZROUTER' ID 'ACTVT' FIELD '03' ID 'MODULE' FIELD 'MM'. IF sy-subrc = 0. " User has display auth for MM module ENDIF. ``` ## 2. S_TABU_DIS — Table-Level Authorization Controls access via SM30, SM31, SE16, SE16N. ```abap AUTHORITY-CHECK OBJECT 'S_TABU_DIS' ID 'ACTVT' FIELD '03' " 03=Display 02=Change ID 'DICBERICH' FIELD lv_group. " Authorization group (e.g. 'ZMM') IF sy-subrc <> 0. " Denied — user cannot view tables in group lv_group ENDIF. ``` > Find auth group of a table: SE11 → table → Delivery/Maintenance tab → Auth. Group. > Tables without a group us