Administration & Troubleshooting

SU53 and STAUTHTRACE

SU53 and STAUTHTRACE are the SAP transactions for analyzing authorization failures: SU53 displays failed authorization checks for a user, and STAUTHTRACE records every authorization check during a reproduction. SU53 and STAUTHTRACE together show which authorization object, field and value an SAP Fiori app or its OData service was denied, so the PFCG role can be fixed precisely.

Quick facts

Type: Authorization analysis transactions
Layer: Content, navigation & access
SU53: Failed authorization checks; across server instances since ABAP platform 1809
STAUTHTRACE: System trace limited to authorization checks, filterable by user
Public Edition counterpart: Display Authorization Trace app (F4106)
Who uses it: Security and basis teams, SAP Fiori support, role administrators
Applies to: SAP S/4HANA on-premise and Private Edition, SAP ERP (ECC)

Layer: Content, navigation & accessWhere it sits ▾

Layer: Content, navigation & access

Open the architecture map →

What do SU53 and STAUTHTRACE do?

Both answer "which authorization is missing?", at different depths:

SU53 shows failed authorization checks with the object, fields and values that were checked, next to the values in the user's buffer. Since ABAP platform 1809, SU53 lists failed checks in a table across all server instances and includes access filtering by CDS access controls.
STAUTHTRACE records every authorization check, successful or failed, while you reproduce a problem. It works like the system trace in ST01, but evaluates only authorization checks, and shows the program call point of each check.

SU53 gives the quick answer for one failure; STAUTHTRACE gives the complete picture when several checks interact.

Why are SAP Fiori authorization errors harder to analyze?

In SAP GUI, the failed check happens in your session, and SU53 sits next to it. An SAP Fiori app fails inside OData requests that run as HTTP calls, possibly on another application server and, in a hub deployment, in a different system:

The start authorization (S_SERVICE) is checked on the front-end server.
Business authorizations, such as purchasing organization, are checked in the back end where the service runs, for the same user through a trusted RFC connection.
CDS access controls do not raise an error; they filter rows, so the app shows an empty list instead of a message.

Analyze SU53 and STAUTHTRACE in the system where the check actually ran, and treat an empty list as a possible authorization symptom.

How do you use SU53 and STAUTHTRACE step by step?

A buyer at Alder Manufacturing opens a purchase order app and sees no orders for Bright Freight:

Reproduce the problem and note the time and the failing OData request from the browser developer tools.
Have the buyer run SU53 right after the error in the system that processes the request, and look for failed or filtered checks.
If SU53 is inconclusive, start STAUTHTRACE, enter the buyer under Trace Only for User and activate the trace.
Let the buyer repeat the action, then deactivate the trace.
Evaluate with Filter Duplicate Entries, and filter for failed checks.
Add the missing value to the buyer's PFCG role, regenerate the profile and retest.

Requests can reach any application server, so use the System-Wide Trace option to trace on all servers if the trace stays empty. This sequence turns SU53 and STAUTHTRACE results into one targeted role change.

SU56: displays the user's authorization buffer, including values the failed checks compared against.
PFCG: fixes the role; SU24 maintains the default values that roles inherit, which STAUTHTRACE results help to complete.
/IWFND/ERROR_LOG: shows whether the OData request failed with an authorization error at all.
/UI2/FLIA: rules out navigation problems before you look for authorizations.
Display Authorization Trace (F4106): in SAP S/4HANA Cloud Public Edition, enables a trace for a business user and shows successful, failed and filtered checks, plus the business roles that would grant access.

SU53 and STAUTHTRACE locate the missing value; PFCG or the business role administration closes the gap.

SU53 vs. STAUTHTRACE vs. Display Authorization Trace: what is the difference?

	SU53	STAUTHTRACE	Display Authorization Trace (F4106)
Shows	Failed checks	All checks during a trace	Successful, failed and filtered checks for a business user
Preparation	None; run after the error	Activate before reproducing	Activate the trace in the app first
Best for	Quick answer to one denial	Several checks, empty lists, role design	Authorization analysis in Public Edition
Available in	On-premise, Private Edition, SAP ERP	On-premise, Private Edition, SAP ERP	SAP S/4HANA Cloud Public Edition

FAQ

Why does SU53 show nothing after an SAP Fiori app error?

The failed check may have happened in another system, such as the back end in a hub deployment, or the data was filtered by a CDS access control rather than denied. Run SU53 in the system that processed the OData request, or record the reproduction with STAUTHTRACE.

Can an empty SAP Fiori list be an authorization problem?

Yes. CDS access controls restrict data by filtering rows instead of raising an error, so a user without the right values sees an empty list. SU53 in ABAP platform 1809 and later reports such access filtering, and STAUTHTRACE records the underlying checks.

Do I need a special authorization to use STAUTHTRACE?

Yes. Running system traces is an administrative function that requires administrator authorizations, so STAUTHTRACE belongs in security or basis roles, not end-user roles. Traces also record user activity and should be switched off after analysis.

What replaces SU53 in SAP S/4HANA Cloud Public Edition?

The Display Authorization Trace app (F4106). An administrator activates a trace for a business user, the user repeats the action, and the app shows each check as successful, failed or filtered, together with the business roles that grant the missing access.

Sources

Applies to: SAP S/4HANA on-premise · SAP S/4HANA Cloud Private Edition · SAP ERP (ECC)
Last reviewed: 2026-11-08

PFCG and SAP Fiori Roles Business Role