topic Re: How to remove authorisation objects from composite role? in Application Development and Automation Discussions

How to remove authorisation objects from composite role?

Former Member — Sun, 25 Apr 2010 05:48:44 GMT

Hi,

We have user id BASIS having "SAP_ALL" and "SAP_NEW" composite profiles assigned.

We want to restrict user BASIS for cirtain transactions e.g. "Releasing Purchase Orders" i.e. ME28, ME29N, ME35L and "Releasing Purchase Requisitions" i.e. ME55.

As above profiles are not generated by ROLEs, we can not modify roles to restrict access to above transactions.

How can we delete the related authorisation objects from the composite profile?

With Best Regards,

Rajkumar

Re: How to remove authorisation objects from composite role?

arpan_paik — Sun, 25 Apr 2010 06:44:57 GMT

1st of all are you planning to modify SAP_ALL and SAP_NEW??? That should never be the case.

Now you want to provide some restricted access to BASIS so create a role with all the authorization that SAP_ALL and SAP_NEW have. To do so enter the role in change mode ''edit --> insert authorization(s) --> from profile

Edit S_TCODE and remove the desired transactions. Let say you want to remove ME29N so your range should be like

A* - ME29M

ME29O - Z*

And so on for other transaction as well

But I will also say a word on this as only removing transaction is not enough. You also need to restrict related object present in table TSTCA for those transaction to make sure that playing with Function Module or program is also taken care.

For example while remove ME29N from S_TCODE the also remove 02 activity from object M_BEST_EKO

Good Luck !!!!!!!!!!!!!!!

Arpan

Re: How to remove authorisation objects from composite role?

Former Member — Sun, 25 Apr 2010 07:40:09 GMT

SAP_NEW is easy. You simply delete the profile itself.

It is also well documemted how and why to do this, but hey... who reads the installation guides now-a-days anymore...