SAP Authorization concept and Authorization Objects, Object Class

To clear the air all at once, SAP Authorization Objects and Object Class have nothing much in common with Object Oriented classes and objects and differ vastly from them.

Authorization objects detail the current user's privileges which are used to authorize user activities and data availability. The Authorization Object is the place where configurations pertaining to permissions are set up and initialized against fields.

An object class, on the other hand, is a grouping of Authorization objects. It may contain one or more authorization objects.

Understanding Authorization Objects

Authorization objects contain authorization fields that define what actions a user can perform. Each field represents a specific criterion that must be checked during authorization. For example, an authorization object for financial data might include fields for company code, account type, and activity (display, change, create).

Object Class Structure

Object classes serve as containers that logically group related authorization objects. This hierarchical structure helps administrators organize and manage permissions more efficiently. Common object classes include ?

• HR ? Human Resources related authorization objects
• FI ? Financial authorization objects
• MM ? Materials Management authorization objects
• SD ? Sales and Distribution authorization objects

Example Structure

Here's how the relationship between object class and authorization objects appears in SAP ?

Object Class: FI (Financial)
??? Authorization Object: F_BKPF_BUK (Accounting Document: Company Code)
??? Authorization Object: F_BKPF_BLA (Accounting Document: Posting Key)
??? Authorization Object: F_SKA1_BUK (G/L Account Master: Company Code)

Object Class: HR (Human Resources)  
??? Authorization Object: P_ORGIN (HR: Master Data)
??? Authorization Object: P_ORGXX (HR: Organizational Assignment)
??? Authorization Object: P_PERNR (HR: Personnel Number)

Conclusion

SAP Authorization Objects define specific user privileges through configurable fields, while Object Classes provide logical groupings of these objects for better organization and management of security permissions within the SAP system.