The SAP authorization trace is a valuable tool for analyzing authorization checks and maintaining authorization default values in SU24. Unlike the shorter-term system trace using transactions STAUTHTRACE and ST01, the authorization trace is a system-wide, long-term trace. The data collected by the trace can be evaluated using transaction STUSOBTRACE.
In this article, you’ll learn everything about the value of the authorization trace, what preparations you should make before starting it, and how to get the most out of evaluating the trace results.
The SAP authorization trace is a cross-client, cross-instance, long-term trace in SAP. Its main purpose is to log and evaluate authorization checks and their values. With the associated transaction STUSOBTRACE, you can evaluate the collected data in a structured way.
Authorization proposals are the linchpin of proper role building. They form the foundation of your authorization concept, whether you’re still on SAP ECC or already on SAP S/4HANA with, for example, SAP Fiori.
Info: Switching from SAP ECC to SAP S/4HANA
SAP S/4HANA, introduced in 2015, is the successor to SAP ERP 6.0 (also known as SAP ECC). SAP has announced that customers using SAP ERP 6.0 must migrate to SAP S/4HANA by december of 2027, although individual deadlines may vary depending on their support agreements and circumstances.
That makes migrating to SAP S/4HANA unavoidable if you want to keep using SAP to support your company’s growth.
Analysis via the authorization trace is possible for all menu objects, such as transactions, RFC function modules, OData services, and more, and using these authorization default values greatly simplifies the effort involved in role maintenance.
Before you can start maintaining your authorization default values via the authorization trace, you first need to activate the required profile parameter.
Figure 1 illustrates how to temporarily change the required profile parameter auth/authorization_trace using transaction RZ11. Setting the parameter to “F” activates the Authorization Trace.
However, the trace first needs to be restricted to a specific scenario using an appropriate filter in transaction STUSOBTRACE (for example, execution by user X or by authorization object) before data is collected. There are also the options “Y” (activate trace) and “N” (deactivate trace).
Note that when the authorization trace is activated with a filter, only up to 5 users or authorization objects can be filtered. We recommend running this trace with a filter to prevent potential performance issues. It also shouldn’t run continuously, but only during predefined test periods.
The data collected by the long-term trace is stored in the database table USOB_AUTHVALTRC. Since this is a database table rather than a system file, the data is not overwritten using a ring-buffer mechanism.
It’s worth noting that, per authorization check, the trace collects data for one application at a time. In other words, this doesn’t produce a user-specific evaluation; instead, the focus is on the application itself. That makes sense here, since you’re using this tool to maintain your authorization default values and check indicators, not authorization data for roles and end users (more on that in the article on the SAP user trace via STUSERTRACE).
The way authorization trace results are displayed is similar to the system trace. Here, too, you can:
Unlike the system trace, this trace doesn’t include return codes. The simple reason is that this information isn’t needed, since you’re maintaining the data in transaction SU24 per application.
Note:
Not all the values listed here need to be maintained, since not every authorization check is inherently meaningful or necessary for successfully calling a transaction. You don’t necessarily need to maintain this so-called “background noise” within transaction SU24. This can save you valuable time.
To show you how to use the authorization trace via transaction STUSOBTRACE and what it can do, we’ll walk you through a common use case.
Xiting’s internal security officer needs to maintain or update the list of forbidden passwords for the SAP system. For security reasons, they should not have full access to all SAP tables through transactions SE16 or SM30. Instead, their access should be limited to table USR40, with authorization to display and maintain only that specific table.
Therefore it´s up to the system or authorization administrators to create a new function in the form of a suitable parameter transaction, and then maintain the necessary authorization values in transaction SU24 for this new transaction code.
The administrator uses the authorization trace for this as follows:
First, the administrator (XITING) activates the profile parameter auth/authorization_trace with the value “F” on the target system, so the authorization trace is switched on with a filter. They then set the filter in transaction STUSOBTRACE for the test user (X_FI) and set the application type to “transaction” (Figure 3).
This means the authorization trace only collects the relevant application data for transactions run by user X_FI.
Using the test user, they now run the new parameter transaction ZSM30_PASSWORDS. This takes the user directly via transaction SM30 into table USR40, without being able to access the initial maintenance screen of transaction SM30 in any way. They can now maintain a few test entries to simulate everyday work as closely as possible and then end the test activity.
Info: SAP Authorization Trace on Production Systems
A sensible approach for maintaining authorization default values is also to switch on the authorization trace in the production system (PRD) and let it collect the business-relevant data for specific applications, especially custom developments. You can then evaluate that data and maintain it sensibly for specific applications based on everyday business use.
The administrator then starts transaction STUSOBTRACE again to evaluate the test. As shown in Figure 4, they restrict the trace to the transaction code ZSM30_PASSWORDS.
Using the “Evaluate” button, they then reach the results screen. The result is clear (Figure 5).
Transaction ZSM30_PASSWORDS accesses a client-independent table, so the authorization object S_TABU_CLI with the field value “X” for the authorization field CLIIDMAINT is also required. In addition, the authorization object S_TABU_NAM (table access via generic standard tools) is needed with the authorization field values 02 (change) for ACTVT and USR40 for TABLE, in order to open the table at all or change data in it.
It’s also possible not only to evaluate the missing authorization proposals directly via transaction STUSOBTRACE, but also to maintain them through the integrated trace function in transaction SU24. There, you can adopt the appropriate authorizations directly into transaction SU24 for the respective application (or, technically speaking, into tables USOBT_C and USOBX_C) with a click.
However, you first need to make sure the required authorization objects are stored (Figure 6).
Once that’s done, you can then maintain the authorization field values using the second integrated trace function, the “Trace” button (Figure 7).
Important!
Be sure to click through the individual authorization objects in the upper selection area of Figure 7 and adopt the required authorization values per object for the respective application there. The proposal status “Y” (proposal with field values) should be selected in most cases.
You don’t need to maintain the authorization object S_TCODE, since the SAP system automatically transfers this object into the role authorization profile, if you build roles properly via the role menu. You do not need to maintain authorization object S_TCODE, as the SAP system automatically transfers it to the role’s authorization profile when roles are properly built using the role menu.
Once you’ve maintained the required authorization proposals, you can use them by adding the transaction to the role menu (via the Profile Generator). To do this, you need to have maintained any open authorization fields in the role’s authorization profile and generated the new profile.
In addition to SAP’s standard analysis tools, the Xiting Authorizations Management Suite (XAMS) offers far more functionality for evaluating authorization trace data in a targeted, clear way. For example, you can use our ‘Xiting SU24 Checkman,’ which shows you a wide variety of authorization default values in bulk and in a clear format, and lets you maintain any missing data directly from the results list with a click.
The functions in SU24 just described can be carried out more conveniently and efficiently using the SU24 Checkman:
Double-clicking the blue update arrow automatically stores the authorization default values from STUSOBTRACE in SU24:
Our XAMS also offers an integrated allow-/denylist that flags the validation of background noise and critical authorizations, reliably alerting you to potential risks.
With transaction STUSOBTRACE, you can quickly and easily update the authorization data for your custom developments, provided they include security-compliant AUTHORITY-CHECK statements in the source code.
The authorization trace via transaction STUSOBTRACE significantly reduces the maintenance effort for your roles. Even SAP itself uses the authorization trace to maintain the necessary authorization data for applications in transaction SU24.
Finally, it’s important to note that this tool should still be used with caution, since critical authorization objects are often checked that you may not actually need, so you should not simply adopt everything from the trace.
Xiting’s XAMS software solution offers countless other innovative features for your everyday authorization work. We also have a broad portfolio of services and products to support you in maintaining your authorization landscape.
>> Sign up today for a free, no-obligation initial consultation or Demo with our SAP security experts and find out how pleasant we can make managing your SAP landscape.
The main difference between transactions STAUTHTRACE and STUSOBTRACE lies in their duration and purpose:
STUSOBTRACE is user-independent and collects authorization data in the application context, primarily to maintain default values (SU24). STUSERTRACE is a specific user trace that specifically records the activities of individual users in order to validate their authorizations. It’s essentially a STUSOBTRACE filtered down to specific users. Both transactions are long-term traces.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Facebook. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from hCaptcha to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from Turnstile to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Hubspot Embedded Content. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Hubspot Meetings. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from X. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information