topic Re: PFCG role creation in Application Development and Automation Discussions

PFCG role creation

Former Member — Sat, 15 Jan 2011 15:41:23 GMT

Security Guys,

My requirement is creation of role for an ABAPER who should run all the Z reports but not exactly the report RSDU_EXEC_SQL_PROGRAM ( meaning no SAP Standadrd reports ). Is there a way to achieve this ?

Thanks / Arunkumar P

Re: PFCG role creation

Former Member — Sat, 15 Jan 2011 20:14:28 GMT

If they cannot execute RSDBRUNT then none of their Z-programs are going anywhere either.

What is wrong with RSDU_SQL_EXEC?

Bit of a silly answer actually...

Cheers,

Julius

Re: PFCG role creation

mvoros — Sun, 16 Jan 2011 00:12:37 GMT

Hi,

that role should be for production only environment or development as well? If it's for development then I assume that ABAPER can write a custom programs so there is no chance to prevent this user from running RSDU_EXEC_SQL_PROGRAM. If it's for production environment then all those custom reports should have transaction codes assigned to them. In that case you can create a role for all of them plus some read only debugging authorization.

Cheers

Re: PFCG role creation

Former Member — Sun, 16 Jan 2011 09:43:27 GMT

Thanks Martin. As you said, each reports assigned to the codes in the PRD system seems to be a better solution. Will try and let you know for any issues.

@ Julius, The idea here is to protect the ABAPers not to run some of the standard SAP programs in PRD environment.

Thanks / Arunkumar P