Authorization errors
Authorization errors stop users performing actions they need. This page covers diagnosing and fixing missing authorizations.
Design roles for least privilege with the right org-level values, regenerate profiles after changes, and use SU24 defaults to reduce missing-authorization issues.
- A user gets "You are not authorized" (or a transaction/action is blocked) despite needing access.
- Immediately after the failure, run SU53 (for that user) to see the failed authorization check, the authorization object and the…
- Missing authorization object/value in the user’s roles.
- Watch out: Guessing instead of reading the log/dump.
Symptom
A user gets "You are not authorized" (or a transaction/action is blocked) despite needing access.
Start here: read the evidence
Immediately after the failure, run SU53 (for that user) to see the failed authorization check, the authorization object and the values that were missing. For complex cases, use an authorization trace (STAUTHTRACE / ST01).
Likely causes, in order
- Missing authorization object/value in the user’s roles.
- Role not assigned (or user comparison not run).
- Org-level restriction (e.g. wrong company code/plant).
- Profile not generated after a role change.
How to fix it
- Run SU53 to identify the missing object/values.
- Add the needed authorization to the appropriate role (PFCG).
- Regenerate the profile and update the user assignment.
- Have the user retry and confirm.
Preventing recurrence
Design roles for least privilege with the right org-level values, regenerate profiles after changes, and use SU24 defaults to reduce missing-authorization issues. Test roles with representative users before rollout.
Common pitfalls
- Guessing instead of reading the log/dump.
- Fixing the symptom, not the root cause.
- Changing several things at once.