Preventing or Logging List Downloads

There are two types of list downloads in SAP Systems:

·         Standard list download

This category is accessed either over the menu option System à List à Save à Local file or other implementations of the function module LIST_DOWNLOAD.

·         Application-specific implementations for downloading

Often applications implement their own download methods (for example, an Excel download) that they can protect with their own authorization objects. These implementations use the function modules DOWNLOAD or WS_DOWNLOAD.

Although you cannot prevent a user from saving data from a displayed list to a file (for example, creating a screen shot and saving it in a separate file), you do have the following options to hinder a user from downloading large SAP System lists:

·         Customer exit SGRPDL00 (as of Release 3.1I)

As of Release 3.1I, you can use the customer exit SGRPDL00 to prevent or log list downloads. For example, you can explicitly program restrictions such as users or user groups in the customer exit or use an authorization object. You can also implement a trace function if you wish.

The customer exit SGRPDL00 applies to both the standard list download option as well as application-specific implementations.

·         Authorization object S_GUI (as of Release 4.0)

As of Release 4.0, you can use the authorization object S_GUI to prevent a user from downloading lists.

Using the S_GUI authorization object applies as follows:

·         It applies only to the standard list download function and not to application-specific implementations.

·         It also does not consider what type of list the user downloads; if the user is allowed to download lists, then he or she can download all lists.

For more information, see SAP Note 28777.