Background Jobs & Authorization Checks

Long-running or scheduled work runs in background (BTC) work processes without the dialog time limit.

31.1 Background processing

Long-running or scheduled work runs in background (BTC) work processes without the dialog time limit.

Define/schedule jobs (steps: ABAP program + variant, external command)

Monitor jobs (statuses: scheduled, released, ready, active, finished, canceled) Work process overview (local / global) Spool requests (job output) Programmatic scheduling:

In the program, sy-batch = abap_true tells you it runs in background — avoid popups and front-end file access.

Output goes to the spool (WRITE/ALV lists) and the job log (MESSAGE … TYPE 'S').

ABAP Cloud uses application jobs (job catalog entry + job template, class implementing IF_APJ_DT_EXEC_OBJECT and IF_APJ_RT_EXEC_OBJECT), scheduled in the Fiori app *Application Jobs*. For short asynchronous tasks there is also CL_ABAP_PARALLEL and bgPF (background processing framework).

DATA: lv_jobname  TYPE tbtcjob-jobname VALUE 'Z_ORDER_CLEANUP',
      lv_jobcount TYPE tbtcjob-jobcount.

CALL FUNCTION 'JOB_OPEN'
  EXPORTING  jobname  = lv_jobname
  IMPORTING  jobcount = lv_jobcount
  EXCEPTIONS OTHERS   = 1.

SUBMIT zorder_cleanup
  WITH p_days = 90
  VIA JOB lv_jobname NUMBER lv_jobcount
  AND RETURN.

CALL FUNCTION 'JOB_CLOSE'
  EXPORTING  jobcount  = lv_jobcount
             jobname   = lv_jobname
             strtimmed = abap_true          " start immediately
  EXCEPTIONS OTHERS    = 1.

31.2 Authorization concept

Access is controlled by authorization objects (SU21), each with up to 10 fields (e.g. S_CARRID has CARRID and ACTVT). Roles (PFCG) contain authorizations (field values) and are assigned to users (SU01). The standard field ACTVT uses codes like 01 create, 02 change, 03 display, 06 delete.

sy-subrc: 0 authorized, 4 not authorized, 12 no authorization for the object, 24 field mismatch, 40 invalid user ID.

ABAP doesn't check authorizations automatically for your own code (except for transaction start via S_TCODE and the AUTHORIZATION check in CALL TRANSACTION … WITH AUTHORITY-CHECK). You must call AUTHORITY-CHECK.

Create custom objects (Z…) in SU21 within an object class; link them to your transactions/apps (SU24 proposals).

Analyze missing authorizations with SU53 (last failed check) and STAUTHTRACE / ST01 traces.

In CDS/RAP, use CDS access control (DCL) with DEFINE ROLE and PFCG_AUTH conditions, plus authorization master ( instance, global ) in behavior definitions (§34).

AUTHORITY-CHECK OBJECT 'S_CARRID'
  ID 'CARRID' FIELD p_carr
  ID 'ACTVT'  FIELD '03'.
IF sy-subrc <> 0.
  MESSAGE e100(zflight) WITH p_carr.   " "No display authorization for carrier &1"
ENDIF.

" Field not checked:
AUTHORITY-CHECK OBJECT 'Z_ORDER'
  ID 'BUKRS' FIELD lv_bukrs
  ID 'ACTVT' DUMMY.

@EndUserText.label: 'Access control for sales orders'
@MappingRole: true
define role ZI_SALESORDER_DCL {
  grant select on ZI_SalesOrder
    where ( SalesOrganization ) = aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' );
}