TOBC table — Authorization Object Class Catalog

One row in TOBC represents one authorization object class, a grouping category used to organize authorization objects, the objects maintained in transaction SU21, by functional area, for example cross-application objects, basis objects, or module-specific groups like FI or HR. The class carries no runtime authorization logic; it exists only so objects can be filed under a heading in the SU21 object browser and in documentation. Custom object classes created for Z-authorization objects also land here. The table is small, changes rarely, and is populated once when SAP ships the standard object class catalog and again whenever a project defines a new class to hold custom authorization objects built for a Z-transaction or Z-report.

TOBC carries a client field but the object class catalog is effectively cross-client content shipped by SAP, so client restriction rarely filters anything meaningful in practice. The table itself is tiny, typically a few dozen rows in a standard system, so there is no performance concern in selecting from it directly and no need to restrict before running a full select. The only reason to query it at all is to resolve an OCLASS value seen in TOBJ or in the SU21 object list into something readable, or to check whether a custom class ID a developer wants to create already exists before assigning it.

To confirm which class a custom authorization object such as Z_MYOBJ has been filed under, select from TOBJ where OBJECT equals the object name and read the OCLASS value returned, then select TOBC, or better the text table for that OCLASS in the logon language, to get the readable class name shown in SU21. If TOBJ returns no row for the object name at all, the object was never created or was deleted, and the TOBC lookup is not where the problem lives.

TOBC exists unchanged in S/4HANA as a customizing table; it has not been replaced by a CDS compatibility view and does not appear on any list of deprecated authorization artifacts. The object class concept itself is untouched by the HANA migration, and SU21 still uses OCLASS to group objects exactly as it did in ECC. Object classes created in an ECC system, including custom ones built for Z-authorization objects, carry forward through a technical conversion to S/4HANA without any transformation step.

This is technical basis or security team territory, specifically whoever owns the custom authorization object catalog for Z-developments. Functional consultants and auditors almost never need to touch TOBC directly; a GRC access risk analysis or a role build works from TOBJ, AGR_1251, and the SU24 check tables, not from the object class grouping itself.

TOBJ holds the authorization objects themselves and carries the OCLASS foreign key back to TOBC; the corresponding text tables hold the language-dependent descriptions for objects and classes. SU21 is the transaction that maintains all of these together, letting a developer create a class, create an object, and file the object under the class in one screen. USOBT_C and USOBX_C reference authorization objects by name for SU24 check indicator maintenance, and AGR_1251 stores the field values a role actually grants for those same objects.