topic Re: Manage admin users in Application Development and Automation Discussions

Manage admin users

Former Member — Wed, 20 Aug 2008 15:14:42 GMT

Hi,

1. What authorizations a user needs in order to reset password of the standard users "SAP*, DDIC, J2EE_Admin, etc....."?

2.How can I add RFC authorization only for a user to be able to open an RFC connection (for testing I used to give the user SAP_ALL and he could do that.. but I'm looking for something specific... for example: rfc logon only.)

tx.

Re: Manage admin users

Former Member — Wed, 20 Aug 2008 16:04:25 GMT

> 1. What authorizations a user needs in order to reset password of the standard users "SAP*, DDIC, J2EE_Admin, etc....."?

Based on your other question here, you will be looking for object S_RFC activity 16 rfc_name SU_USER rfc_type FUGR. This is the entry point to start the reset request, and from release 7.10 you can tweak it even further to the function module name using rfc_type FUNC.

To complete the reset successfully, you will be looking for object S_USER_GRP activity 05 name of user group <whatever the group name is they can reset passwords for>. This will let you successfully complete the reset.

> 2.How can I add RFC authorization only for a user to be able to open an RFC connection (for testing I used to give the user SAP_ALL and he could do that.. but I'm looking for something specific... for example: rfc logon only.)

You can do that in transaction PFCG on the menu tab of the role by adding the RFC using the "Authorization Default" - this will also pull in the "use case" authorizations from SU24 in the authorizations tab.

So, now what to put in the SU24 for object S_RFC of that RFC to open the connection (because it will be greyed out in PFCG)? See SAP note 460089 for your options.

Cheers,

Julius

Re: Manage admin users

Former Member — Thu, 21 Aug 2008 11:25:32 GMT

where can I find all these SAP notes (SAP note 460089 for example)?

(This is the first time I'm interacting with SAP)

Re: Manage admin users

jurjen_heeck — Thu, 21 Aug 2008 11:27:32 GMT

> where can I find all these SAP notes (SAP note 460089 for example)?

> (This is the first time I'm interacting with SAP)

https://service.sap.com/notes

You will need an "oss account" for this.

Re: Manage admin users

Former Member — Thu, 21 Aug 2008 12:47:17 GMT

tx man,

but how can I get the oss account?

I'm not sap customer or partner...

Re: Manage admin users

jurjen_heeck — Thu, 21 Aug 2008 12:56:01 GMT

> I'm not sap customer or partner..

In that case the company whose system you're working on should be able to provide you with one (at least for the period you're there.)

Re: Manage admin users

Former Member — Thu, 21 Aug 2008 12:58:10 GMT

> I'm not sap customer or partner...

Then why are you developing this?

(just joking

I think it is an excellent thing that you are building a secure role with minimum authorizations to deliver together with your Java application! Some vendors / solutions don't do that or deliver a "goliath".

The relevant part of that note (while making some assumptions about your system / application) say that you will need function groups SYST and SYSU together with SU_USER for the rfc_name.

Perhaps ask one of your customers who are testing the app and role to check all other aspects of the note with you, as well as anyway tracing the call (transaction ST01) to verify what it exactly needs when the reset is called.

Cheers,

Julius