Lesson 1 of 5
Symptoms of authorization issues
9 min
Listen to this lesson
During Contoso Motor Co.'s second test cycle in CMQ, Priya's defect log fills with tickets that say "no authorization". About half of them turn out to be something else: a closed posting period, a blocked supplier, a missing plant view on a material. Each mislabeled ticket costs a day, because it goes to Nadia's security team first, bounces back, and then waits in another queue. The first troubleshooting skill is therefore not tracing; it is recognizing what an authorization problem looks like.
What authorization failures look like
- Start refused: in SAP GUI, a message that you are not authorized to use the transaction. The check on
S_TCODEruns automatically when a transaction starts. - Action refused inside an app: a message naming a missing authorization, often with an organizational value, for example for company code 1710 or purchasing organization 1710.
- Fiori error on launch: the tile opens, then the app reports that data could not be loaded, and the browser's network log shows HTTP 403 (forbidden) for the OData call.
- Silent filtering: a list or report shows fewer rows than expected, because the program skips records the user may not see instead of raising an error.
- Missing options: buttons, menu entries or tiles that other users have are absent or greyed out.
- Background failure: a job or interface stops with an authorization message in the job log or application log, often for a system or communication user, not a person.
Silent filtering is the dangerous one for testers. Nothing on screen says "authorization"; the totals are just low. Maria once signed off a sales report in test that was missing all orders for sales organization 1710's export distribution channel because her test user lacked that channel. Always compare what a role-based user sees with what a broad-access user sees for the same selection.
Things that look like authorization errors but are not
| Symptom | Authorization cause | Common non-authorization cause |
|---|---|---|
| Posting refused for company code 1710 | Missing company code value in the role | Posting period closed for that account type |
| Cannot create a purchase order for a supplier | Missing purchasing organization value | Supplier blocked for purchasing, or no purchasing data for the organization |
| Material not found in plant 1720 | No plant authorization for 1720 | Material not extended to plant 1720 |
| Fiori app fails with an error on launch | Missing start authorization for the service | Service not activated, or wrong system alias |
| Document cannot be changed | Activity 02 (change) not granted | Document locked by another user, or status forbids change |
The fastest way to tell them apart is the one SAP itself suggests: run the last failed check display right after the error. If it reports that all authorization checks have so far been successful, the cause is probably not authorization. If it shows a failed check that matches the step the user was doing, you have your lead. The next lesson covers reading that output properly.
- Does the message itself name an authorization?Yes → capture SU53 now · No → read the message long text first
- Does SU53 show a failed check from this step?Yes → treat as an authorization lead · No → look at data, configuration or locks
- Does a broad-access user get the same error?Yes → not authorization; route to the functional team · No → authorization is likely
- Is the failure in a job, interface or Fiori call?Yes → plan a trace for the technical or service user · No → SU53 is usually enough
What would you do?
Ana, Contoso's AP clerk, tries to post a supplier invoice for company code 1710 in CMQ and gets an error. She raises an authorization ticket. A broad-access tester gets exactly the same error with the same invoice data. What should Priya do with the ticket?
- Authorization failures show up as refused starts, refused actions, Fiori 403 errors, silent filtering, missing options or failed jobs.
- Many errors that look like authorization are data, configuration or lock problems.
- If SU53 says all checks have so far been successful, the cause is probably not authorization.
- Compare with a broad-access user before routing a ticket to security.
Check your understanding · not graded
Lesson check
1. Which symptom is the hardest authorization problem for a tester to notice?
2. A posting for company code 1710 is refused. Which cause is not an authorization problem?
3. What does it suggest when SU53 reports that all authorization checks have so far been successful?
4. Which check object runs automatically when a user starts an SAP GUI transaction?