How To Fix GH117 - Caution: Authorization check changed during execution of report

SAP Error Message - Details

• Message type: E = Error

• Message class: GH - Help functions and tools in FI-SL

• Message number: 117

• Message text: Caution: Authorization check changed during execution of report

What causes this issue?

You have changed the type of data import (read all data or read data
upon each navigation step).

System Response

For drilldown reports in new General Ledger Accounting and FI-SL, if the
'Read All Data' indicator is activated (default setting), data is
selected and then only the data for which authorization exists is
displayed.
For drilldown reports in new General Ledger Accounting and FI-SL, if the
'Read upon Each Navigation Step' indicator is activated, an
authorization check is carried out directly on the selection screen when
the data is entered. Depending on the ledger scenario, the system then
checks whether the user has the corresponding authorization for ALL of
the data to be selected. If this is not the case, an error message is
displayed and the report cannot be executed.
Example:
The profit center scenario is active and no entry has been made for the
'Profit Center' selection option on the selection screen.
In this case, the system checks whether the user has authorization for
ALL profit centers. If this is not the case, the user must make an entry
in the selection option to restrict the profit centers to be selected to
those for which he or she has the corresponding authorization.
Caution: For run-time reasons, when the 'Read upon Each Navigation Step'
indicator is activated, the authorization for ALL cost elements (KSTAR =
'*') is always checked for the authorization objects 'K_PCA' (profit
centers) and 'K_CCA' (cost centers). Thus, when the 'Read upon Each
Navigation Step' indicator is activated, authorization must always exist
for ALL cost elements for both authorization objects mentioned.

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Remark: In EC-PCA, there is no change to the authorization check since
the check is always carried out directly on the selection screen.

How to fix this error?

Inform users about the changed authorization check if necessary.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message GH117 - Caution: Authorization check changed during execution of report ?

  The SAP error message GH117, which states "Caution: Authorization check changed during execution of report," typically indicates that there is a change in the authorization checks while a report is being executed. This can happen for various reasons, and understanding the cause and potential solutions is important for resolving the issue.
  Cause:
  
  
  Dynamic Authorization Checks: The report may have dynamic authorization checks that change based on the data being processed. For example, if the report accesses different objects or data sets that require different authorizations, this warning may be triggered.
  
  
  User Role Changes: If a user's roles or authorizations are modified while the report is running, it can lead to this message. This can happen if the user has been assigned new roles or if existing roles have been modified.
  
  
  Custom Code: If the report includes custom ABAP code that alters the authorization checks during execution, this can also lead to the GH117 message.
  
  
  Transaction Variants: If the report is executed in a transaction variant that has different authorization checks, it may cause this warning.
  
  
  Solution:
  
  
  Review Authorization Roles: Check the user's authorization roles and ensure that they have the necessary permissions to execute the report without triggering dynamic checks. You can use transaction SU53 to analyze authorization failures.
  
  
  Analyze the Report Logic: If you have access to the report's ABAP code, review it for any dynamic authorization checks or custom logic that may be causing the issue. Look for any AUTHORITY-CHECK statements that may be conditionally executed.
  
  
  Consistent User Roles: Ensure that user roles are not changed while the report is running. If possible, avoid making changes to user roles during critical report executions.
  
  
  Consult Documentation: Check the documentation for the specific report to see if there are known issues or specific requirements regarding authorizations.
  
  
  Contact SAP Support: If the issue persists and you cannot identify the cause, consider reaching out to SAP support for assistance. They may provide insights based on the specific report and system configuration.
  
  
  Related Information:
  
  Transaction SU53: This transaction can be used to analyze authorization issues. It shows the last failed authorization check and can help identify missing authorizations.
  Transaction PFCG: This transaction is used to manage roles and authorizations in SAP. You can use it to review and modify user roles.
  ABAP Debugging: If you have access to the ABAP code, you can use debugging tools to step through the report execution and observe where the authorization checks are changing.
  
  By following these steps, you should be able to identify the cause of the GH117 message and implement a solution to resolve it.