{"id":10847,"date":"2025-07-16T11:20:16","date_gmt":"2025-07-16T09:20:16","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=10847"},"modified":"2025-07-17T12:59:04","modified_gmt":"2025-07-17T10:59:04","slug":"table-maintenance-generator-routines-and-custom-restrictions","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/table-maintenance-generator-routines-and-custom-restrictions\/","title":{"rendered":"SAP\u00ae Table Maintenance Generator: Routines and Custom Restrictions"},"content":{"rendered":"

Controlling access to tables in SAP\u00ae has always been a challenge. The standard way SAP\u00ae<\/strong> provides to restrict access to tables is through table groups or specific tables<\/strong> (using the S_TABU_DIS or S_TABU_NAM authorization objects and the traditional table view and modification transactions). Authorization objects<\/strong> are the basic unit for controlling user permissions in an SAP\u00ae system; in this case, the mentioned objects control access to the entire table, but not based on its content.<\/p>\n

Among best practices, it is most accepted to create a parameter transaction with the specific table and avoid broad access that could compromise other unwanted tables. These parameter transactions<\/em> are nothing more than transactions that are based on another transaction but applying specific parameters.<\/strong> Thus, it is possible to create a new transaction that uses the SM30 (table modification) as its base but directly loads the table indicated in the parameter, instead of allowing the user to select the one they want.<\/p>\n

However, it is also possible to implement authorization checks that examine the internal information of the table, opening up the possibility of implementing more specific restrictions. In this article, we will see how to implement these restrictions using the Events of the Table Maintenance Generator<\/em> (TMG).<\/p>\n\n

What are the Table Maintenance Generator Events?<\/strong><\/h2>\n

The Table Maintenance Generator is an SAP\u00ae<\/strong> tool that allows for the necessary configuration to modify a table (specifically, generate the table maintenance program), directly from a standard interface. It can be accessed from the S<\/strong>E11 \u2013 ABAP Dictionary Maintenance or SE54 \u2013 Generate table view transactions.<\/strong><\/em><\/p>\n

 <\/p>\n

\"\"
Image 1 – Accessing the TMG through SE11<\/figcaption><\/figure>\n

 <\/p>\n

\"\"
Image 2 – Accessing the TMG through SE54<\/figcaption><\/figure>\n

 <\/p>\n

With this tool, it is possible to introduce and modify entries in the table, establish the Authorization Group, modify the interface, and even the programs associated with the maintenance of this table; in this case, we will focus on the Events.<\/p>\n

 <\/p>\n

\"\"
Image 3 – TMG Events<\/figcaption><\/figure>\n

 <\/p>\n

The TMG Events allow us to associate a new FORM routine<\/strong> with a specific event that can occur during the maintenance of a table. This routine will effectively be a new ABAP program that will execute at the time indicated by the event.<\/strong> Therefore, it is possible to include in this ABAP code any behavior desired. SAP\u00ae provides a wide variety of events, several examples of which can be seen in the image above.<\/p>\n

How to implement a custom restriction?<\/strong><\/h2>\n

Using the Events discussed earlier, our goal is to implement a custom restriction in the modification of a custom<\/em> table, ensuring that only users authorized for a particular organizational value can modify the rows corresponding to that organizational value.<\/p>\n

We start by creating and configuring a custom table using the SE11<\/strong> transaction. Our table is enabled for modification and consists of 4 fields:<\/p>\n