Authorization Checks During Dynamic Program Processing

Note

Besides developing programs using the ABAP Workbench, you may also create and generate ABAP programs at runtime. This type of program creation is called dynamic program development.

The required statements INSERT REPORT, GENERATE SUBROUTINE POOL, and EDITOR-CALL_FOR_REPORT do not perform any authorization or system checks. You must therefore program these checks yourself. The following cases are possible:

If the function of the dynamic program is unique, no special checks are necessary. For example, if the program created calls the table display mode using the transaction SE16, the authorization check is performed in precisely this transaction.
If the dynamic program is controlled by means of Customizing entries, the checks performed are limited to Customizing changes. This is a common procedure for generated programs in the application component HR, for example.
If you enter and execute ABAP statements as required, the programs created at runtime must contain the same checks that would take place if you created the program in the ABAP Workbench.

Examples

The function module RS_ACCESS_PERMISSION performs all checks that take place in the ABAP Editor. You must call the function module for the object class PROG.

If you only want to check the system change option, use the function module TR_SYS_PARAMS. You can use the following parameters:

SYSTEMEDIT to determine the general system change option
SYS_CLIINDDEP_EDIT to determine the system change option of cross-client Customizing
SYSTEM_CLIENT_EDIT to determine the system change option of client-specific Customizing data

If, however, you want to check the ABAP change authorization, use the following authorization check:

AUTHORITY-CHECK OBJECT 'S_DEVELOP'
               ID     'OBJTYPE'   FIELD 'PROG'
               ID     'DEVCLASS'         DUMMY
               ID     'P_GROUP'          DUMMY
               ID     'OBJNAME'          DUMMY
               ID     'ACTVT'     FIELD '02'.