topic Re: SAP_ALL except STMS? in Application Development and Automation Discussions

SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 11:51:44 GMT

If it possible to create a role with SAP_ALL authorization except STMS authorization?

Re: SAP_ALL except STMS?

jurjen_heeck — Thu, 04 Dec 2008 11:57:23 GMT


> If it possible to create a role with SAP_ALL authorization except STMS authorization?

Sure, use the forum search and read our sticky thread first please.

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 16:09:27 GMT

Hi Amy,

Yes. Make sure you do NOT modify SAP_ALL.

Use PFCG to create a new role and use SAP_ALL as a template, then you can add and remove t-codes and objects such as STMS.

Thanks and hope this helps.

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 16:22:32 GMT

Which part of the STMS do you want to restrict?

The STMS is not just a "transaction". It is a "system" on it's own which has almost nothing at all to do with the transaction code.

Please tell us what you want to achieve, not about transaction codes.

Cheers,

Julius

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 16:24:56 GMT

> Yes. Make sure you do NOT modify SAP_ALL.

May I ask why you say that or which source you have this information from?

I have successfully modified SAP_ALL without any problems. Actually, no one noticed it nor complained at all.

You can always regenerate it again if you need to...

Cheers,

Julius

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 17:57:08 GMT

Yes, you would be able to restict the access STMS by giving SAP_ALL.

1. Enter PFCG

2. Give the role name and create the role

3. Do not enter any transactions in Menu

4. Save the Role

5. In Authorisation tab click Expert Mode and there will be a pop up of template.

6. Choose the template SAP_ALL and then click on Adopt Reference.

7. Click Yes for Insert all Authorisation

8. Message appears " Authorisations Added with complete Information"

9. Identify the objects associated with STMS

S_BTCH_ADM Background Processing: Background Administrator

S_BTCH_JOB Background Processing: Operations on Background Jobs

S_CTS_ADMI Administration Functions in Change and Transport System

S_DATASET Authorization for file access

S_DEVELOP ABAP Workbench

S_RFC Authorization Check for RFC Access

S_RZL_ADM CCMS: System Administration

S_TRANSPRT Transport Organizer

10. Before you generate the role disable the above authorisation objects except S_DATASET, S_RFC and S_RZL_ADM (if you are not using CCMS).

11. Generate the role and test it out. This works...

I have tested it successfully.

Thanks and Regards

Arun R

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 20:15:49 GMT


> S_BTCH_ADM	Background Processing: Background Administrator	
> S_BTCH_JOB	Background Processing: Operations on Background Jobs
> S_CTS_ADMI	Administration Functions in Change and Transport System
> S_DATASET	Authorization for file access
> S_DEVELOP	ABAP Workbench
> S_RFC	Authorization Check for RFC Access	
> S_RZL_ADM	CCMS: System Administration	
> S_TRANSPRT	Transport Organizer
> 
> 10. Before you generate the role disable the above authorisation objects except S_DATASET, S_RFC and S_RZL_ADM (if you are not using CCMS).
> 11. Generate the role and test it out. This works...
> 
> I have tested it successfully.
> 
> Thanks and Regards
> 
> Arun R

The downside of that approach is that the role will no longer be SAP_ALL without STMS...disabling those other objects will also remove access to a whole load of other functionality.

Re: SAP_ALL except STMS?

Former Member — Thu, 04 Dec 2008 21:35:09 GMT

That is his requirement. Yes, I agree disabling those other objects will also remove access to a whole load of other functionality.

We are disabling only the objects related to the STMS. He would face some problem when he executes the batch process and apart from that there will be no issues.

Thanks and Regards

Arun R

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 06:27:45 GMT


> We are disabling only the objects related to the STMS. He would face some problem when he executes the batch process and apart from that there will be no issues.
> 
> Thanks and Regards
> 
> Arun R

Hi Arun,

Inactivating S_DEVELOP will cause many, many more problems if you have a user requiring almost SAP_ALL access.

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 06:50:53 GMT

Yes, We should not deactivate S_DEVELOP.

I agree to this.

We can deactivate the following which will not have any impact on the other transactions:

S_BTCH_ADM Background Processing: Background Administrator

S_BTCH_JOB Background Processing: Operations on Background Jobs

S_CTS_ADMI Administration Functions in Change and Transport System

S_TRANSPRT Transport Organizer

Thanks and Regards

Arun R

Edited by: Arunachalam Ramanathan on Dec 5, 2008 7:51 AM

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 06:54:35 GMT

Thanks all.

I do what you suggest:

1. Create a new role

2. Choose templete from SAP_ALL

3. Inactive authorization:

S_CTS_ADMI

Then I got "You have no authorization...." when use T-code STMS.

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 06:58:15 GMT

You need to disable the authorisation object S_TRANSPRT also.

Please disable that also.

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 07:02:22 GMT

It depends on how you have setup your STMS, and also defined the QA steps. These will determine check checks are performed by the system (actually, in which system they are performed as well).

Cheers,

Julius

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 13:11:34 GMT

Hi,

Why dont you create a role with reference to SAP_ALL and remove STMS transaction from the S_TCODE object. Initially the value will be *.

Disabling the other object could create problem from performing other tasks.

Thanks and Regards,

Amit.

Re: SAP_ALL except STMS?

jurjen_heeck — Fri, 05 Dec 2008 13:22:22 GMT

> Why dont you create a role with reference to SAP_ALL and remove STMS transaction from the S_TCODE object.

Bwahahahaa! You've made my friday! I hope you protect your personal belongings with a bit more serious measures. OMG! ROTFLMAO!

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 13:30:49 GMT

Hi Julius,

I have always been advised by teachers and other sap authorizations consultants to not directly modify SAP_ALL. Rather to copy or create a new role using it as a template, since it's SAP delivered and a sensitive authorization.

You are 100% correct that it usually won't cause issues, and can be regenerated. I was mostly just mentioning it as a reference to best practices.

Thanks!

-Ben

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 14:09:53 GMT

Perhaps it is just folk-lore... like removing a tcode from SAP_ALL will be SAP_ALL minus a whole application component....

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 15:26:54 GMT


> I have always been advised by teachers and other sap authorizations consultants to not directly modify SAP_ALL.  Rather to copy or create a new role using it as a template, since it's SAP delivered and a sensitive authorization.

Hi Ben,

The more time I spend in security the more I realise that most people's idea of "best practice" is what they think/make up ( It's not a reference to this thread though )

Cheers

Alex

Re: SAP_ALL except STMS?

Former Member — Fri, 05 Dec 2008 15:47:46 GMT

Hi Amit

If we provide SAP_ALL, the value for the authorisation object would be * rather than transactions entered in.

Test it out by giving SAP_ALL and confirm what values are assigned for the authorisation object S_TCODE.

Thanks and Regards

Arun R

Re: SAP_ALL except STMS?

koehntopp — Fri, 05 Dec 2008 16:53:26 GMT

I have a hard time believing that removing STMS but leaving in several 10000 TCodes + Objects will do any good at all. What a crap idea....

I'm getting too old for this....

Frank.