FNM4SAP error "Invoke failure 'NOT_AUTHORIZED" when using the role /LICMAN/SATELLITE_READONLY

[#1]

Summary

In FlexNet Manager for SAP Applications, releases 2015 R2 SP5 or earlier, customers may see the the error "Invoke failure 'NOT_AUTHORIZED" when reading tables such as T000, USR41_MLD or USR02 from SAP Inventory Agent log.

Symptoms

In FlexNet Manager for SAP Applications, releases 2015 R2 SP5 or earlier, customers may see the the error "Invoke failure 'NOT_AUTHORIZED" when reading tables such as T000, USR41_MLD or USR02 from SAP Inventory Agent log.

Cause

The FNMS role /LICMAN/SATELLITE_READONLY only gives access of authorization object S_TABU_DIS to a few maintenance areas( SA, SC, SCUS, SS and &NC&) , but the maintenance area of table T000 or USR41_MLD is not listed in above in some SAP systems.

FlexNet Manager For SAP Application, releases 2016 R1 and later do not experience this issue.

Resolution

Option 1

Flexera does offer a role transport called /licman/satellite which grants necessary table access regardless of authorization group assignments. Customer can choose to import this role transport in addition to /licman/satellite_readonly and assign both to the RFC user account used by the inventory agent.

Option 2

manually modify their SAP systems by following steps below:

1. Run transaction SE16 and display the table TDDAT and check the table name which you have the authorization issue with. You can find which authorization group (table column CCLASS) this table is assigned to.
2. Run transaction PFCG and edit the role /licman/satellite_readonly. You should add the missing authorization group to the authorization object S_TABU_DIS.
3. Generate the role to activate the change.