## 13.9.2.2.2  Authorizations
Transportation Management (TM) uses the authorization concept provided by the Application Server ABAP. Therefore, the recommendations and guidelines for authorizations as described in the Application Server ABAP Security Guide , Java Security Guide , and ABAP and Java Security Guides also apply to TM.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP and the User Management Engine's user administration console for the AS Java.
## Role and Authorization Concept for Transportation Management
Authorization objects are delivered with TM. For more information about the authorization objects and how to use them, see the following section.
## Standard Authorization Objects
For TM, there are two kinds of authorization objects:
- Static checks of the technical business objects along with their nodes and actions, or of organizational data objects
- Instance-based authorization objects, with which you can check authorization for the specified business documents or other objects, depending on business-relevant data such as organization information
For instance-based authorization checks, there are two basic concepts. First, you can define authorization values based on identifiers for all profiles or other objects that cannot be classified any further by specific types, but only depending on their identifier. Second, you can define authorization values based on category, type, and further characteristics such as organizational data that can classify business documents beyond their identifier.
Besides the standard activities that can be defined for each authorization object for authorization field ACTVT , you can also define whole groups of activities for several authorization actions as an activity area. This means that you can define a distinct activity area, thereby allowing or preventing a whole set of actions related to this area. For example, you do not have to define all actions relating to subcontracting activities separately for a role, but only to define the activity area for subcontracting.
For more information about authorizations in TM, see http:/ /help.sap.com/s4hana under Product Assistance Enterprise Business Applications Supply Chain Delivery and Transportation Transportation Management (TM) Basic Functions Authorizations .
If you want to display the authorization objects in TM, on the SAP Easy Access screen, choose Tools ABAP Workbench Development Other Tools Authorization Objects Objects and open object class SCTS .
##  Note
You can also create your own authorization objects and implement the corresponding checks in BAdIs Authorization Check and Data Retrieval Before Authorization Check .
For more information, see Customizing for Transportation Management under Business Add-Ins (BAdIs) for Transportation Management Basic Functions Authorizations .
In TM, you have a special permission object T\_ADMIN . System users who run batch jobs can use this permission object. To use this permission object, you must have all application specific permissions. Note that if you maintain this object in a certain role, all other TM permission objects will not be checked for this role anymore.
The table below shows the security-relevant authorization objects from other components that are used by TM. The list does not include basis authorization objects used for central functions or administration.
Standard Non-TM Authorization Objects
| Authorization Object     | Field                                  | Value                                                                                                                               | Description                                                                                                                                        |
|--------------------------|----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP SCM Basis 7.0        |                                        |                                                                                                                                     |                                                                                                                                                    |
| /SCMB/PESL               | ACTVT , USER                           | (06) Delete (34) Write In the USER field, you can en- ter the user for which you want to execute the activities in the ACTVT field. | Define Planning Service Man- ager (PSM) Selection. The authorization object enables the specified user to save and delete his or her selec- tions. |
| /SCTM/SCU                | /SCMB/SCU ACTVT                        |                                                                                                                                     | Use of supply chain units in routes.                                                                                                               |
| C_MD_SCU                 | /SCMB/SCU , ACTVT                      |                                                                                                                                     |                                                                                                                                                    |
| Business Rules Framework |                                        |                                                                                                                                     |                                                                                                                                                    |
| FDT_OBJECT               | FDT_ACT FDT_APPL FDT_OBJTYP            |                                                                                                                                     | You use this authorization object to control usage of ob- jects of the specified type in BRFplus.                                                  |
| FDT_WORKB                | FDT_WB_ACT                             |                                                                                                                                     | This authorization object controls whether a user is authorized to use the BRFplus workbench and its tools.                                        |
| APO                      |                                        |                                                                                                                                     |                                                                                                                                                    |
| C_APO_DEF                | ACTVT , APO_PLNR , APO_DEFT , APO_DEFN | (01) Create or generate (02) Change (03) Display (06) Delete                                                                        | APOAuthorization Object: Master Data, Resource Defi- nitions                                                                                       |
| Authorization Object   | Field                                             | Value                                                                               | Description                                                                                                                                                                     |
|------------------------|---------------------------------------------------|-------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| C_APO_LOC              | ACTVT , APO_LOC                                   | (01) Create or generate (02) Change (03) Display (06) Delete (16) Execute (32) Save | APOAuthorization Object: Master Data, Locations                                                                                                                                 |
| C_APO_PROD             | ACTVT , APO_LOC , APO_PROD                        | (01) Create or generate (02) Change (03) Display (06) Delete (16) Execute           | APOAuthorization Object: Master Data, Products                                                                                                                                  |
| C_APO_RES              | ACTVT , APO_PLNR , APO_LOC , APO_RES              | (01) Create or generate (02) Change (03) Display (06) Delete (16) Execute           | APOAuthorization Object: Master Data, Resources                                                                                                                                 |
| EH&S                   |                                                   |                                                                                     |                                                                                                                                                                                 |
| C_EHSP_TPP             | ACTVT , LANGUAGE , ESECATPIN , ESEPHRGRP , PPSTAT | (02) Change (03) Display                                                            | This authorization is checked in the transactions for phrase management for entry into the hit list.                                                                            |
| C_SHEP_TPG             | ACTVT , ESECATPIN , ESEPHRGRP                     | (01) Create or generate (02) Change (03) Display (59) Distribute                    | This authorization object is checked in the phrase management transactions when entering and leaving the hit list. The activities 'change' and 'display' are also checked here. |
| Authorization Object                    | Field                                   | Value                                                                                    | Description                                                                                                                                                                                                                       |
|-----------------------------------------|-----------------------------------------|------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| M_MATE_DGM                              | ACTVT                                   | (01) Create or generate (02) Change (03) Display (06) Delete (61) Export (82) Supplement | Using the authorization ob- ject M_MATE_DGM , you can prevent dangerous goods master data from being dis- played or edited.                                                                                                       |
| Formula & Derivation Tool               |                                         |                                                                                          |                                                                                                                                                                                                                                   |
| FDT_OBJECT                              | FDT_APPL , FDT_OBJTYP , FDT_ACT         | (1) Create (2) Change (3) Display (4) Delete (5) Activate                                | You use this authorization object to control the author- ization to display, create, change, or delete objects in the Formula &Derivation Tool (including functions, ex- pressions, expression types, filters, and applications). |
| SAP SCM Optimizer                       |                                         |                                                                                          |                                                                                                                                                                                                                                   |
| S_RFC                                   | ACTVT , RFC_NAME , RFC_TYPE             | (16) Execute                                                                             | Required authorization to start the SAP SCMOptimizer and use most of the adminis- trator transactions.                                                                                                                            |
| SAP Event Management                    |                                         |                                                                                          |                                                                                                                                                                                                                                   |
| X_EM_EH                                 | ACTVT , /SAPTRX/PN , / SAPTRX/PV        | (03) Display (10) Post                                                                   | Event handler authorization                                                                                                                                                                                                       |
| X_EM_EH_CH                              | ACTVT , /SAPTRX/SO                      | (01) Create or generate (02) Change (05) Lock (06) Delete                                | Event handler changes                                                                                                                                                                                                             |
| X_EM_EVM                                | ACTVT , /SAPTRX/CS , / SAPTRX/CD        | (32) Save the sender code set and sender code ID                                         | Event messages                                                                                                                                                                                                                    |
| Cross-Application Authorization Objects | Cross-Application Authorization Objects | Cross-Application Authorization Objects                                                  | Cross-Application Authorization Objects                                                                                                                                                                                           |
| Authorization Object   | Field                                                                    | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Description                                                          |
|------------------------|--------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------|
| CA_POWL                | POWL_APPID , POWL_QUERY , POWL_CAT , POWL_LSEL , POWL_TABLE , POWL_RA_AL | POWL_QUERY : (01) Users are allowed to cre- ate, change, and delete their own queries for all POWLob- ject types assigned to them (compare with Customizing tables POWL_TYPE_USR and POWL_TYPE_ROL ). (02) Users are only al- lowed to create their own queries on the ba- sis of admin queries as- signed to them in Customiz- ing tables POWL_QUERY_USR and POWL_QUERY_ROL re- spectively. (Note: this is also subject to the user-POWL object type assignments.) (03) (and other values): Users are only allowed to change admin queries as- signed to them with respect to the select options restric- tions of those admin quer- ies (thus creating a separate 'derivation' for each admin query transparently) POWL_CAT: (01) Users are allowed to cre- ate, change, and delete their own categories and assign queries to them. (02) Users are only allowed to assign queries to the ex- isting categories and change the order of queries. (03) (and other values): Users are not allowed to re- assign queries or change the query order. Note: if field | Specifies the authorities for Personal Object Worklist (POWL) iViews |
| Authorization Object   | Field                                                                         | Value                   | Description                                                                                                                                                       |
|------------------------|-------------------------------------------------------------------------------|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| S_SERVICE              | SRV_NAME , SRV_TYPE                                                           |                         | This authorization object is automatically checked when external services are started. This is required for Gateway Services used by the TMCol- laboration Portal |
| S_RFCACL               | RFC_SYSID , RFC_CLIENT , RFC_USER , RFC_EQUSER , RFC_TCODE , RFC_INFO , ACTVT | (16) Execute            | Authorization check for RFC users, especially for trusted systems. This is required for Gateway Services used by the TMCollaboration Portal.                      |
| S_WFAR_OBJ             | ACTVT OAARCHIV OADOKUMENT OAOBJEKTE                                           | (01) Create or generate | This authorization object is used to control access to ar- chived documents.                                                                                      |
| S_ARCHIVE              | ACTVT APPLIC ARCH_OBJ                                                         |                         | This authorization object is used in SAP archiving pro- grams to protect the access to archive files                                                              |
| B_BUPA_RLT             | ACTVT RLTYP                                                                   |                         | With this authorization ob- ject you define which BP roles can be edited.                                                                                         |
| B_BUPR_BZT             | ACTVT RELTYP                                                                  |                         | With this authorization ob- ject you establish which re- lationship categories can be processed.                                                                  |
| S_DATASET              | ACTVT FILENAME PROGRAM                                                        |                         | You use this object to assign authorizations for accessing operating system files.                                                                                |
| S_WF_WI                | TASK_CLASS WFACTVT WI_TYPE                                                    |                         | Authorization object for working with work items in SAP Business Workflow                                                                                         |
| S_SCD0                 | ACTVT                                                                         |                         |                                                                                                                                                                   |
##  Recommendation
To segregate duties using roles and authorization values in TM, we recommend that you restrict the authorizations of the different roles to the business-related minimum.
With the authorization concept provided by TM, you can restrict authorization based on business document categories, such as Freight Order or Freight Booking , or on business document types, which you can create for the supplied business document categories. Furthermore, all critical business-related activities can be restricted for the different roles. These activities include creating business documents, displaying business documents or master data, triggering charge calculations, subcontracting freight documents, requesting customs declarations, and others activities or activity areas for the authorization objects of object class SCTS . Duties can, therefore, be segregated according to your business and scenarios.
Note that we do not recommend providing one role with full authorization for a business document or process, so that one role cannot be used, for example, to create and maintain a business document, add charge data to it, send it to a business partner, and create the invoice for that document. Such activities should be spread over different roles.
In addition, one user must not be assigned to different roles that would provide full authorization for a business document or process as described above.
##  Note
If your scenario contains an approval workflow process, you need to create or maintain user WF-BATCH accordingly.
For general information about creating and maintaining the WF-BATCH user, see SAP Note 1251255 .