SUSR_USER_AUTH_FOR_OBJ_GET — Read a User's Authorization Values for an Object
Retrieves authorization values available to a user for a specified authorization object after evaluating the user's effective authorization data. It is useful for diagnostics and tools that need to understand permitted field ranges, but it should not replace AUTHORITY-CHECK at the point where protected business logic is executed.
Validated practitioner draft for SUSR_USER_AUTH_FOR_OBJ_GET: purpose, high-impact parameters, failure behavior, safe administrative use, S/4HANA position, and proof path. Exact target-release signatures are intentionally anchored to SE37 instead of guessed from a different SAP release.
Published 20 Sept 2026· 634 words
What it does
Retrieves authorization values available to a user for a specified authorization object after evaluating the user's effective authorization data. It is useful for diagnostics and tools that need to understand permitted field ranges, but it should not replace AUTHORITY-CHECK at the point where protected business logic is executed. Use this function only for the technical layer it owns. Application validation, authorization, persistence, monitoring, and recovery steps around the function remain the caller's responsibility unless the official function documentation explicitly assigns them to the module.
Important parameters
Only parameters that materially change behavior are described here. Exact DDIC types, optional flags, and release-specific additions must be confirmed in SE37 before production coding.
- User name and authorization-object name identify the query; returned values/ranges describe effective authorization data according to the interface.
- Keep identifiers such as job count, log handle, IDoc number, object/subobject, client, and logical system together; names alone are rarely unique enough for safe administration.
- When the function returns both a result and technical metadata, retain the metadata in logs so support can reproduce the call.
Exceptions
The safest caller distinguishes expected negative outcomes from technical failures. Do not hide configuration, authorization, lock, communication, or database errors behind a generic success path.
- Unknown user/object, generated-profile inconsistencies, stale user comparison/buffer assumptions, and using returned values instead of a runtime AUTHORITY-CHECK are the main risks.
- Check the active SE37 exception list and SY-SUBRC immediately after the call.
- A technically successful administration call still requires semantic validation: confirm the returned job, log, IDoc, receiver, authorization range, or interval is the one intended.
How to call it safely
Start with the exact technical key and the narrowest possible scope. Validate current status before destructive changes, execute the function, inspect its returned handles/IDs/tables, and then verify the effect in the standard monitor such as SLG1, SM37, WE02, SM12, PFCG/SU53, or number-range administration. Never use a low-level function to bypass an application error that should be corrected and reprocessed normally.
ECC vs S/4HANA
PFCG authorization concepts remain in S/4HANA. Fiori and cloud scenarios add service/catalog layers, but backend business authorization still requires proper runtime checks. Presence in classic S/4HANA does not by itself mean the function is a released ABAP Cloud API. New clean-core integrations should prefer released business APIs, events, CDS views, and managed administration services where SAP provides them.
Common pitfalls
- Using only a human-readable name and omitting the technical key such as client, job count, IDoc number, log number, or number-range subobject.
- Treating a framework-level success as proof that downstream application processing also succeeded.
- Changing technical status, configuration, or locks directly to make a monitor look green instead of correcting the underlying business failure.
- Running broad selection or destructive administration calls without a restrictive filter and an audit trail.
- Ignoring commit/update-task or asynchronous processing boundaries and checking the monitor before the relevant LUW or queue processing has completed.
Whose problem this is
Ownership depends on the framework: Basis owns background jobs, RFC, enqueue and system runtime; integration teams own ALE/IDoc partner/distribution configuration; Security owns authorization design; application developers own correct calls and exception handling; functional teams own the business data that ultimately succeeds or fails after the technical framework hands it off.
Related SAP objects
Reviewed pages this object connects to in the ERPClimb knowledge graph.
Source: ERPClimb — https://erpclimb.com/sap-function-modules/susr-user-auth-for-obj-getERPClimb is an independent platform and is not affiliated with SAP SE. Reference pages are written and reviewed by SAP consultants for learning and troubleshooting.