SAP CRM Authorizations:ISSUES with ST01 Authorization Tracing in SAP CRM

Print Friendly

In this article I will give you a great tip that might save you a real headache and especially a lot of wasted hours when solving an authorization issue in SAP CRM. This article is related to the usage of the authorization object UIU_COMP that is used in SAP CRM to give access to Work Centers, Navigation Links, Direct Create links and other Views in SAP CRM.

1. Scenario:

At your customer you have created your own Work Centers and/or navigation links. The functional and/or technical consultant has done all configuration and coding and on your development system the new functionality seems to work fine. The functional SAP CRM consultant has tested the functionality (he has broad authorization access in the SAP CRM system e.g. no restrictions on authorization object UIU_COMP as it contains * for all authorization fields).

In this example a new navigation link has been added, called “Upload Broadcast distribution List

Custom Navigation link in SAP CRM

Now that the unit and integration testing has taken place he will probably ask the authorization team to include access to the new navigation link in the existing PFCG authorization roles. As such, the authorization administrator will probably perform an ST01 authorization trace to find out the relevant authorization values, especially related to the object UIU_COMP.

The trace log showed following result (the test was of course performed with a user that actually WAS able to use the new functionality –so probably tracing was done for the functional SAP CRM consultant at that point in time).

The authorization administrator now logically added the relevant values for this authorization object UIU_COMP in the existing or new PFCG authorization role, but during UAT testing (user acceptance testing) the key-user testing the new functionality still does NOT see the new functionality (navigation link). What’s happening?

2. Definition of the Inbound Plugs

Inbound/outbound plug definitions are defined in customizing using the following path:

SPRO >> Customer relationship Management >> UI Framework >> Technical Role Definition >>Define Work Area Component Repository

Inbound & Outbound plug definition in SAP CRM

I select the relevant Component name:

SAP CRM Component Name - Inbound Plug

For this component I now check the inbound plug definitions:

SAP CRM Component & Window Name

Here I can see that the inbound plug is defined as “Display” instead of “DISP”.

Now there’s your problem. For the authorization field INBOUND PLUG (COMP_PLUG) ST01 tracing does not always show the correct value in your trace. Personally I have seen that in most cases the value shown for the field COMP_PLUG the system already shows capital letters. .e.g. DISPLAY vs Display. Already in that case you would have an issue when entering DISPLAY as a value in your PFCG authorization role. In this scenario it’s even worse: the trace log shows me the value DISP instead of “Display”.

So to solve this particular issue I should set the following:

SAP CRM PFCG role - UIU_COMP - Inbound Plug

My 2nd tip: make sure that all SAP CRM consultants ALWAYS define the inbound plugs in CAPITAL letters. This already saves you a lot of trouble!

3. Quick Way to find back all defined inbound plugs in your system

In table CRMC_UI_COMP_IP you will be able to find back the exact “inbound plug” definition as it has been set in customizing.

If you know the component name you can easily find back the relevant entry in this table.

In a previous post I already explained how you can find back the component & View name.

In this case my component name is: ZCST_BROADCAST


Executing this selection shows me the relevant entrie(s).


If you do an export of the complete table into MS Excel I guess you can do a cross-check on which Inbound Plug definitions are not maintained properly and adjust customizing in that case!
Please note that if you perform this action in customizing you clearly also need to change your impacted PFCG Authorization roles.

I hope you found this article useful!

Davy Pelssers

The SAP University Team

Davy has been working as an SAP Consultant since 2000 and started working in the SAP IS-U Module , but as of 2002 he has mainly worked as functional SAP CRM consultant and SAP Authorizations consultant.
More about

2 thoughts on “SAP CRM Authorizations:ISSUES with ST01 Authorization Tracing in SAP CRM

Comment author said

By umesh on 6 March 2013 at 11:54

Hi davy could you pls help how authorization is work with status management in status profile, while we creating status profile we have to mention authorization code and transations- pls explain


Comment author said

By Junead on 12 June 2013 at 22:48

Excellent Blogs , I had reviewed most of them.. Thanks for sharing with us.. Appreciated your efforts.



Leave a Reply