topic Re: Post-installation security activities in Application Development and Automation Discussions

Post-installation security activities

Former Member — Fri, 01 Aug 2008 15:04:00 GMT

Hello,

We have recently installed ERP 6.0 SR3 on DB2. As part of the post-installation activities, we don't see any activities which are relevant to SAP security and roles. We are not sure whether we suppose to do any type of Security and Roles related activities.

I would appreciate anybody can share their experience

Best Regards,

Kris

Re: Post-installation security activities

jurjen_heeck — Fri, 01 Aug 2008 15:44:22 GMT

If this is a clean install and not an upgrade, designing and implementing security is a huge task laying ahead of you.

As far as post-installation is concerned, the steps in transaction SU25 are the first to come to mind. (Initial setup of PFCG)

Re: Post-installation security activities

Former Member — Fri, 01 Aug 2008 16:00:57 GMT

Hello Jurjen,

Yes, Its a fresh install. Do you mean I must run the SU25 before building the Roles and authorizations first time?

Thanks,

Kris

Re: Post-installation security activities

Former Member — Fri, 01 Aug 2008 16:13:40 GMT

Yes, please setup Profile generator using SU25.

Step1. in SU25 should suffice as this fills your default USOBT tables.

Re: Post-installation security activities

Former Member — Fri, 01 Aug 2008 16:54:13 GMT

Hello Kiran,

Do I have to run SU25 as DDIC in client 000? Since I have two clients 100 and 200.

Thanks,

Kris

Re: Post-installation security activities

Former Member — Fri, 01 Aug 2008 17:17:06 GMT

> Do I have to run SU25 as DDIC in client 000? Since I have two clients 100 and 200.

quote}

Hi Kris,

SU25 values are client independent, you can run them any where with any ID which has permissions to that.

Regards,

Zaheer

Re: Post-installation security activities

Former Member — Fri, 01 Aug 2008 17:27:06 GMT

From my experience Step 2A in SU25 is run by DDIC during the upgrade

Regards,

Kiran Kandepalli

Re: Post-installation security activities

Former Member — Tue, 05 Aug 2008 13:37:47 GMT

> I would appreciate anybody can share their experience

I would recommend using DDIC for as little as possible, so that you only need to assign authorizations to the user during upgrades.

In particular, I would recommend against scheduling DDIC into any jobsteps or running any transactions which automatically schedule things, or create things, as all you will ever see is DDIC all over the place and you will have a tough time trying to get it back again.

This should be one of the first post-installation activities.

Cheers,

Julius