topic Re: Delete Auth Object From SAP_ALL in Application Development and Automation Discussions

Delete Auth Object From SAP_ALL

Former Member — Mon, 22 Feb 2010 11:45:41 GMT

Hi all,

I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?

Regards,

Re: Delete Auth Object From SAP_ALL

SuhaSaha — Mon, 22 Feb 2010 11:55:49 GMT


> I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?

Hello,

If you can add auth. objects to the profile, then you should be able to change it as well. May be i am incorrect

BR,

Suhas

Re: Delete Auth Object From SAP_ALL

Former Member — Mon, 22 Feb 2010 12:22:33 GMT

Before someone suggest you to delete it from SE38 or some Z function module or even worse that to delete from AGR_1250,AGR_1251,AGR_1252,AGR_1253 ,TOBC tables

Iu2019m requesting the modes to reside this Thread into Security. Because Iu2019m certainly convinced there would be further work needed after deleting the Authorization from SAP_ALL. Btw Did you tried with SU02/SU21?

Cheers

Re: Delete Auth Object From SAP_ALL

Former Member — Mon, 22 Feb 2010 12:26:31 GMT

Hi,

If you want to change the assignment of SAP_ALL to the user, you can open the user in SU01 and remove the authorizations from the profiles tab. Also SAP_ALL is a profile not a role so you cannot change it through PFCG.

Thanks,

Anju

Re: Delete Auth Object From SAP_ALL

Former Member — Mon, 22 Feb 2010 12:46:20 GMT

Moved to the security forum...

You can optionally exclude non-SAP authorization objects from SAP_ALL and then regenerate it. There are a few valid reasons for considering this, and some standard objects are automatically excluded from it as well.

The solution is in table PRGN_CUST if you press F4 in the ID-field.

But ideally you should be building a role for that which they do need, and not excluding that they should not have.

Cheers,

Julius

Re: Delete Auth Object From SAP_ALL

jurjen_heeck — Mon, 22 Feb 2010 12:50:23 GMT

> I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?

I suspect you are talking about a custom (Z*) object. There is a customizing switch which decides wether custom objects should be included in SAP_ALL or not. Search SAP service marketplace for either SSM_CUST or PRGN_CUST in combination with SAP_ALL. Change the setting and regenerate SAP_ALL.

Looking for ways to remove it manually are futile as any regeneration of SAP_ALL will undo this without prior notice. This regenerating can be the result of someone hitting the appropriate button in SU21 or through incoming transports etc.

Re: Delete Auth Object From SAP_ALL

Former Member — Tue, 23 Mar 2010 06:12:12 GMT

Thanks,