Real-Time False SU53 Examples in SAP Security

 

1. SU53 Shows Missing S_TCODE but Transaction Exists in Role

Scenario

User tries to run VA01.

Error appears:

You are not authorized to use transaction VA01

User runs SU53 → shows missing object:

S_TCODE
TCD = VA01

Security team checks role in PFCG → VA01 already exists.

Real issue

Role was modified but user comparison was not executed.

Fix

Run user comparison in PFCG or execute PFUD.

---

2. SU53 Shows Missing S_TABU_DIS but Table Access Is Not Required

Scenario

User runs ME23N (Display Purchase Order).

Error occurs while opening item details.

SU53 shows:

S_TABU_DIS
ACTVT = 03
DICBERCLS = MM

Security team starts adding table access.

Real issue

Purchase order document is locked by another user.

SAP still performs a table authorization check after the lock failure, and SU53 records that.

Fix

Check lock using SM12.

---

3. SU53 Shows Authorization Failure but Issue Is Missing FI Configuration

Scenario

User posts invoice in FB60.

Error occurs.

SU53 shows:

F_BKPF_BUK
BUKRS = 1000
ACTVT = 01

Security team checks role and finds correct authorization.

Real issue

Company code not assigned to controlling area.

System error triggered earlier, but SU53 captured a later authorization check.

Fix

Functional team fixes configuration in SPRO.

---

4. SU53 Shows Missing S_USER_AGR in SU01

Scenario

User tries to assign roles in SU01.

Error appears.

SU53 shows:

S_USER_AGR
ACTVT = 02
AGR_NAME = *

Security team thinks role assignment authorization missing.

Real issue

User is restricted by user group assignment.

Actual missing authorization:

S_USER_GRP
CLASS = BASIS

But SU53 captured a later authorization check.

Fix

Add correct S_USER_GRP access.

---

5. SU53 Shows Missing Authorization in Custom Z Transaction

Scenario

User runs ZFI_REPORT.

Error appears.

SU53 shows:

S_PROGRAM
P_ACTION = SUBMIT
PROGRAM = ZFI_REPORT

Security team adds program execution authorization.

Error still continues.

Real issue

Custom program checks authorization incorrectly using ABAP:

AUTHORITY-CHECK OBJECT 'Z_AUTH'

But the role never uses that object.

Fix

Developer must correct the AUTHORITY-CHECK logic.

---

6. SU53 Shows Missing Authorization but Issue Is Role Transport

Scenario

User cannot execute SUIM.

SU53 shows:

S_TCODE
TCD = SUIM

Security checks role and confirms SUIM exists.

Real issue

Role transport from QA to production did not include generated profile.

Fix

Regenerate role in PFCG and transport again.

---

7. SU53 Shows S_TABU_DIS but Issue Is Authorization Group

Scenario

User tries to maintain table SM30 → V_T001.

Error appears.

SU53 shows:

S_TABU_DIS
DICBERCLS = SC
ACTVT = 02

Security gives access.

Still error occurs.

Real issue

Table uses table-specific authorization object S_TABU_NAM instead.

Fix

Maintain table access for correct object.

---

Key Lesson for SAP Security Consultants

SU53 only shows the last authorization check executed by the system.

Therefore, always verify:

• Functional errors

• Lock entries

• Custom program logic

• Role transport issues

• Table authorization objects

When SU53 is unclear, run authorization trace using ST01 to identify the real cause.