topic Re: SAP_ALL usage in Application Development and Automation Discussions

SAP_ALL usage

Former Member — Mon, 22 Jun 2009 18:27:20 GMT

Hello ,

I want to know the main usage of SAP_ALL profile for RFC communications

(other than Basis work).

Can it be used for all RFC/ALE ids in production systems ?

Can SAP_ALL be a firefighter profile for dialog users (emergency

access) ?

Can SAP_ALL be given to Batch ids ?

Thanks in advance,

Re: SAP_ALL usage

sdipanjan — Mon, 22 Jun 2009 18:30:45 GMT

> I want to know the main usage of SAP_ALL profile for RFC communications

> (other than Basis work).

No.. not needed.

> Can it be used for all RFC/ALE ids in production systems ?

No.. not needed.

> Can SAP_ALL be a firefighter profile for dialog users (emergency

> access) ?

Yes.. current audit scenario also tells not to use SAP_ALL for emergency users too..

> Can SAP_ALL be given to Batch ids ?

No.. not needed.

Re: SAP_ALL usage

Former Member — Mon, 22 Jun 2009 19:40:44 GMT

Theoretically you can, but Dipanjan's answer is much more secure...

I think a License by Authority model would not sell very well, but would also be much more secure and authorizations would be more realistic for some of the user classes you have mentioned.

Cheers,

Julius

Re: SAP_ALL usage

Former Member — Tue, 23 Jun 2009 13:11:55 GMT

Hi ,

I production system no user should have SAP_ALL profile except the OSS ids. If no specific role was created within the system for some particular access, SAP_ALL can be provided with limited validity.. but for audit issue, Security log(SM20 log) should be taken for that time period.

Also I would prefer to run ST01 trace against the user id to know the what authorizations are required to do the specific job.. Then proper role should be created as per requirement to avoid assignment of SAP_ALL profile. This new role can be used for emergency access.

Also for interface users also, assignment of SAP_ALL should be avoide.. Here also you should take trace against the interface user. In that case, you need to run the trace in both the systems where they are working.

But please note that running of trace may slow down the system performance.. So try to run trace when system load is minimum and try to run it only for the time when the user id is used.

Regards,

Sandip.

Re: SAP_ALL usage

Former Member — Sun, 19 Jul 2009 20:43:22 GMT

This message was moderated.