Implementing Work Order Update BAdI for TECO/UNTECO Authorization Control in SAP PM

Implementing Work Order Update BAdI for TECO/UNTECO Authorization Control in SAP PM

A Comprehensive Technical Guide

Introduction

In SAP Plant Maintenance (PM), controlling who can revoke Technical Completion (UNTECO) status on work orders is a critical business requirement. While SAP provides standard authorization objects for many operations, there is no out-of-the-box authorization check specifically for UNTECO operations. This blog post demonstrates how to implement a custom authorization control using the Work Order Update BAdI (WORKORDER_UPDATE) combined with a custom authorization table and user interface.

Business Scenario

Organizations often need to restrict the ability to revoke TECO status because:

• Once a work order is technically completed, it indicates all work is done and the order should remain closed

• Unrestricted UNTECO can lead to data integrity issues and audit trail problems

• Only specific users (supervisors, planners) should be able to reopen technically completed orders

• Compliance requirements may mandate strict control over order status changes

Solution Overview

The solution consists of three main components:

1. Custom Authorization Table (ZUNTECO_AUTH): Stores the list of users authorized to perform UNTECO operations

2. BAdI Implementation (WORKORDER_UPDATE): Intercepts work order updates and validates UNTECO authorization

3. Custom Authorization Screen: User-friendly interface to add and remove authorized users

Step-by-Step Implementation Guide

Step 1: Create the Authorization Table

First, we need to create a custom table to store authorized users.

• Navigate to transaction SE11 (ABAP Dictionary)

• Create a new table named ZUNTECO_AUTH

• Define the table structure with the following fields:

Field Name

Data Element

Description

MANDT

MANDT

Client (Key Field)

UNAME

XUBNAME

User Name (Key Field)

Note: Set UNAME as a key field. This ensures each user can only be added once to the authorization table.

Step 2: Find and Implement the BAdI

The WORKORDER_UPDATE BAdI is triggered whenever a work order is updated. We’ll use its methods to intercept UNTECO operations.

2.1: Locate the BAdI Definition

• Go to transaction SE18 (BAdI Builder)

• Enter WORKORDER_UPDATE and display the BAdI definition

• Review the available methods: INITIALIZE and AT_SAVE

2.2: Create BAdI Implementation

• Go to transaction SE19 (BAdI Implementation)

• Create a new implementation (e.g., Z_UNTECO_CHECK)

• Enter WORKORDER_UPDATE as the Enhancement Spot Name

• Create an implementing class (e.g., ZCL_IM_UNTECO_CHECK)

Step 3: Implement the Authorization Logic

We need to implement two methods: INITIALIZE (for early detection) and AT_SAVE (for final validation).

3.1: Implement the INITIALIZE Method

The INITIALIZE method is called early in the process, allowing us to detect UNTECO attempts in the status buffer.

METHOD if_ex_workorder_update~initialize.

DATA: lv_objnr TYPE j_objnr,

lv_user TYPE xubname,

lt_status TYPE STANDARD TABLE OF jest,

ls_status TYPE jest.

“ 1. Construct Object Number

DATA(lv_aufnr_padded) = |{ is_caufvdb-aufnr ALPHA = IN }|.

lv_objnr = ‘OR’ && lv_aufnr_padded.

“ 2. Read statuses from the system buffer

CALL FUNCTION ‘STATUS_READ’

EXPORTING

objnr = lv_objnr

only_active = ‘ ‘

TABLES

status = lt_status.

“ 3. Look for TECO (I0045) in the buffer

READ TABLE lt_status INTO ls_status WITH KEY stat = ‘I0045’.

“ 4. If status exists and is marked inactive, user clicked UNTECO

IF sy-subrc = 0 AND ls_status-inact = ‘X’.

“ 5. Check authorization table

SELECT SINGLE uname

FROM zunteco_auth

INTO @lv_user

WHERE uname = @sy-uname.

IF sy-subrc <> 0.

MESSAGE ‘You are not authorized to revoke TECO.’ TYPE ‘E’.

ENDIF.

ENDIF.

ENDMETHOD.

Key Points:

• Object Number Construction: Work orders use ‘OR’ prefix + order number

• STATUS_READ: Reads the status buffer to detect status changes

• I0045: This is the SAP status code for TECO (Technical Completion)

• INACT = ‘X’: Indicates the status is being revoked (UNTECO operation)

3.2: Implement the AT_SAVE Method

The AT_SAVE method provides a second layer of validation right before the database commit.

METHOD if_ex_workorder_update~at_save.

DATA: lv_count TYPE i,

lv_objnr TYPE j_objnr,

lv_aufnr_padded TYPE aufnr.

“ 1. Check if this is a PM order (type 40)

IF is_header_dialog-autyp = ‘40’.

“ 2. Build the Object Number

lv_aufnr_padded = |{ is_header_dialog-aufnr ALPHA = IN }|.

lv_objnr = |OR{ lv_aufnr_padded }|.

“ 3. Check if TECO is currently active in database

SELECT COUNT(*)

FROM jest

WHERE objnr = @lv_objnr

AND stat = ‘I0045’

AND inact = ‘ ‘

INTO @lv_count.

IF sy-subrc = 0.

“ 4. Check the status buffer for revocation

CALL FUNCTION ‘STATUS_CHECK’

EXPORTING

objnr = lv_objnr

status = ‘I0045’

EXCEPTIONS

status_not_active = 1

OTHERS = 2.

“ 5. If subrc = 1, user is attempting UNTECO

IF sy-subrc = 1.

“ 6. Authorization Check

SELECT COUNT(*)

FROM zunteco_auth

WHERE uname = @sy-uname

INTO @lv_count.

IF lv_count = 0.

“ 7. Raise error to prevent commit

MESSAGE e000(o0) WITH

‘Not authorized to revoke TECO for order’

is_header_dialog-aufnr.

ENDIF.

ENDIF.

ENDIF.

ENDIF.

ENDMETHOD.

Key Points:

• JEST Table: Standard SAP table storing all object statuses

• STATUS_CHECK: Returns exception 1 when status is being revoked

• MESSAGE E000: Error message prevents the save operation

Step 4: Create Custom Authorization Maintenance Screen

To make it easy to manage authorized users, we’ll create a custom screen with add/delete functionality.

4.1: Create the Program

• Go to transaction SE38 (ABAP Editor)

• Create a new program (e.g., Z_UNTECO_AUTH_MAINT)

4.2: Design the Screen

• Within SE38, go to Environment → Screen Painter (or use SE51)

• Create a new screen (e.g., screen number 0100)

• Add the following elements:

Element Type

Name

Purpose

Input Field

P_USER

Enter username to add

Push Button

ADD_USER

Add user to authorization table

Push Button

DELETE_USER

Delete selected user

Push Button

REFRESH_LIST

Refresh the user list display

Push Button

DELETE_SEL

Delete selected users (bulk)

Table Control

TC_USERS

Display authorized users

Step 5: Testing the Solution

5.1: Add Authorized User

4. Run the authorization maintenance program (e.g., Z_UNTECO_AUTH_MAINT)

5. Enter a username in the input field

6. Click ‘Add User’ button

7. Verify the user appears in the list

5.2: Test UNTECO with Authorized User

8. Login with an authorized user

9. Go to IW32 (Change Work Order)

10. Open a TECO’d work order

11. Click the UNTECO button (Revoke Technical Completion)

12. Expected Result: UNTECO should succeed without error

5.3: Test UNTECO with Unauthorized User

13. Login with a user NOT in the authorization table

14. Go to IW32 and open a TECO’d work order

15. Attempt to click UNTECO

16. Expected Result: Error message ‘You are not authorized to revoke TECO’

Technical Deep Dive

Understanding SAP Status Management

SAP uses a sophisticated status management system for objects like work orders:

• Status Table (JEST): Stores all object statuses with OBJNR (object number) as key

• Status Codes: I0045 = TECO, I0046 = CLSD (Closed), etc.

• INACT Field: When ‘X’, indicates the status is inactive/revoked

• Object Number Format: For work orders: ‘OR’ + 12-digit padded order number

Why Two BAdI Methods?

The implementation uses both INITIALIZE and AT_SAVE methods for defense in depth:

Aspect

INITIALIZE Method

AT_SAVE Method

Timing

Called early in the process

Called just before save

Detection

Checks status buffer (STATUS_READ)

Checks DB + buffer (STATUS_CHECK)

Advantage

Immediate feedback to user

Final validation, prevents commit

This dual-layer approach ensures that unauthorized UNTECO attempts are caught both early (for better UX) and late (as a security failsafe).

Best Practices and Recommendations

1. Transport Management

• Create a transport request for all objects (table, BAdI, screen)

• Test thoroughly in Development and Quality systems before Production

• Document the transport request with business justification

2. Authorization Strategy

• Start with a small group of authorized users (supervisors, planners)

• Regularly review the authorization table to remove inactive users

• Consider creating a role/profile for managing the authorization screen

3. Error Message Customization

Consider creating a custom message class for better error messages:

• Use transaction SE91 to create message class Z_UNTECO

• Create message 001: ‘Not authorized to revoke TECO for order &’

• Update BAdI code to use: MESSAGE e001(z_unteco) WITH is_header_dialog-aufnr

4. Audit Trail

Consider enhancing the solution with audit logging:

• Add a log table to track all UNTECO attempts (both successful and failed)

• Record: Order number, User ID, Timestamp, Status (Success/Denied)

• Create a report to view the audit log

5. Performance Considerations

• The authorization check uses a SELECT SINGLE which is efficient

• Consider buffering the ZUNTECO_AUTH table if performance is critical

• Monitor BAdI execution time in production using ST12 or SAT

Troubleshooting Guide

Issue 1: BAdI Not Triggering

Symptoms: Unauthorized users can perform UNTECO without error

Solutions:

• Verify BAdI implementation is active (SE19)

• Check that the implementation is not filtered out

• Set a breakpoint in the BAdI method and test to see if it’s called

Issue 2: Error Message Not Displaying

Symptoms: UNTECO succeeds even though user is not authorized

Solutions:

• Verify message type is ‘E’ (error), not ‘I’ or ‘W’

• Check that MESSAGE statement syntax is correct

• Ensure AT_SAVE is being called (add debugging)

Issue 3: Table Control Not Displaying Users

Symptoms: Custom screen shows empty list even after adding users

Solutions:

• Check PBO (Process Before Output) logic is refreshing the table control

• Verify SELECT statement is pulling data correctly from ZUNTECO_AUTH

• Use SE16 to verify data exists in the table

Conclusion

This solution provides a robust and flexible way to control UNTECO authorization in SAP PM. By combining the WORKORDER_UPDATE BAdI with a custom authorization table and user-friendly maintenance screen, organizations can enforce strict control over who can revoke technical completion status on work orders.

The implementation is:

• Secure: Uses dual validation (INITIALIZE and AT_SAVE)

• Flexible: Easy to add/remove authorized users via custom screen

• Maintainable: Clean code with clear comments

• Performant: Efficient database queries with minimal overhead

By following this guide, SAP PM administrators can implement UNTECO authorization control in their systems, improving data integrity and meeting compliance requirements.

Additional Resources

• SAP Note 2234192: BAdI for Work Order Update

• Transaction Codes: SE11 (Data Dictionary), SE18 (BAdI Definition), SE19 (BAdI Implementation), SE51 (Screen Painter)

• SAP PM Documentation: Status Management

• Enhancement Framework Documentation

— — End of Document — -