topic Re: HR Auth Question in Application Development and Automation Discussions https://community.sap.com/t5/application-development-and-automation-discussions/hr-auth-question/m-p/4233144#M1010794 <HTML><HEAD></HEAD><BODY><P>There is no performance penalty for maintaining ranges.</P><P></P><P>For audit and maintenance purposes however, I advise you to put each allowed infotype into the role separately. Basically SAP authorization design is about <U>giving people what they need</U> and not about giving people everything and then <U>taking away what they shouldn't have</U>.</P><P>Initially it's more work but it will pay back during audits, maintenance and upgrades.</P><P></P><P>An example in this case would be introducing a new infotype which almost no-one is allowed to see or manipulate. </P><P>With ranges this introduction of an infotype will force you to review all your roles and amend the ranges. With named infotypes a non-existent one is not in your roles yet so it'll be safe from the beginning .....</P><P></P><P>Jurjen</P></BODY></HTML> Mon, 11 Aug 2008 11:17:55 GMT jurjen_heeck 2008-08-11T11:17:55Z HR Auth Question https://community.sap.com/t5/application-development-and-automation-discussions/hr-auth-question/m-p/4233143#M1010793 <HTML><HEAD></HEAD><BODY><P>I want to build a role which have display authorisation to all infotype except some 3 -4 infotype .Is there any other way then maintaining ranges skiiping the 4 infotypes .Will there be any performance issue if i maintain ranges .</P></BODY></HTML> Mon, 11 Aug 2008 11:02:39 GMT https://community.sap.com/t5/application-development-and-automation-discussions/hr-auth-question/m-p/4233143#M1010793 Former Member 2008-08-11T11:02:39Z Re: HR Auth Question https://community.sap.com/t5/application-development-and-automation-discussions/hr-auth-question/m-p/4233144#M1010794 <HTML><HEAD></HEAD><BODY><P>There is no performance penalty for maintaining ranges.</P><P></P><P>For audit and maintenance purposes however, I advise you to put each allowed infotype into the role separately. Basically SAP authorization design is about <U>giving people what they need</U> and not about giving people everything and then <U>taking away what they shouldn't have</U>.</P><P>Initially it's more work but it will pay back during audits, maintenance and upgrades.</P><P></P><P>An example in this case would be introducing a new infotype which almost no-one is allowed to see or manipulate. </P><P>With ranges this introduction of an infotype will force you to review all your roles and amend the ranges. With named infotypes a non-existent one is not in your roles yet so it'll be safe from the beginning .....</P><P></P><P>Jurjen</P></BODY></HTML> Mon, 11 Aug 2008 11:17:55 GMT https://community.sap.com/t5/application-development-and-automation-discussions/hr-auth-question/m-p/4233144#M1010794 jurjen_heeck 2008-08-11T11:17:55Z