topic Re: Sap security in Application Development and Automation Discussions

Sap security

Former Member — Thu, 21 Dec 2006 17:39:36 GMT

Hi Gurus,

How to add transaction yda1 and Yda3 to the roles.

Z:DRM_QUOTE_LEAD .

Z:CS_LEAD

if posssible explain me in detail .

Re: Sap security

Former Member — Thu, 21 Dec 2006 18:22:02 GMT

Hi Khaiser,

Use Tcode PFCG and specify the role for which you want to add the tcode.

then go to MENU tab

choose TRANSACTION tab

a screen will appear then specify the tcode which you want add to that role and choose ASSIGN TRANSACTION tab then it takes you to the initial screen of pfcg choose AUTHORIZATION tab choose EXPERT MODE then it will display the authorizations for that particular tcode like authorization object and activity value etc select according to your scenarion then SAVE and GENERATE.

cheers,

Shyam.

Re: Sap security

Former Member — Thu, 21 Dec 2006 18:36:22 GMT

Hi,

To Add the T-code in new role (or which ever role you want to enter)

Go to PFCG type the role Z:xxxxxxx click on the change buttone (Pencil icon button)

You will be prompted with tabs ( description, menu, workflow, authorizations, user..)

Click on Menu Tab

You will find the Role menu tab

if you have multiple (folders) under role menu choos the Folder in which you want to add T-code "yda3"

Click on the Transaction button icon.

You will prompted with blank pop up with Transaction code and text

Just enter the T-Code in Transaction code block Ydar and click on Assign transactions (bottm left button)

You can see the T-Code ydar in the list of menu (or) in the folder which have choosen

Go to Authorization tab

Click on Expert mode for Profile Generation (Bottom and last button)

you will be prompted with pop up with three options

choose 3rd option --- Read old status and merge with new data

Again search for the objects and values which you have noted in

If you have same values then just generate the role (shift+F5) or click on menu Authorization you will have drop down in that you will have option of generate.

once generate go back (F3).

By this you will have the T-Code yda3 in the role.

Repeat the above steps to add another T-Code to another Role.

I hope this is clear.

Cheers

Soma

Re: Sap security

Former Member — Thu, 21 Dec 2006 19:24:19 GMT

Hi Soma,

Could u please explain how to check the object and its values in change authorisation data

Re: Sap security

Former Member — Thu, 21 Dec 2006 19:24:55 GMT

Hi Soma,

Could u please explain how to check the object and its values in change authorisation data

Re: Sap security

Former Member — Thu, 21 Dec 2006 19:50:55 GMT

Hi,

I have answerd the same to another question posted this could help you can take the following example.

1. To identify what objects are maintained

Go to T-Code SU24.

you will be prompted with screen

. Maintain check indicators for transaction codes

Define interval for tansaction code

Transaction code YDAR3

execute (click on clock icon)

next screen

click on check indicator (view)

You will be displayed with following details

U N C CM Check ID Object Object name

List out all the check/maintain objects

STEP 2.

Go to T-code PFCG enter the role Z:cs_dar_user

Click on (display role button)

You will be displayed with tabs (description, menu, workflow, authorizations, user....)

Click on Authorizations tab

Click on Display Authoirzation Data (button) whic is at bottm left

Next you will be displayed with list of objects and objects class

(If techinical names are off go to on the top menu (Utilities) click you will find option of techinical name on click on this)

once the techinical names are on

search for the objects which are found(listed) in the T-code SU24

(to Search for the object (ctrl+F) or click on binocolor icon)

Type each object and find the values (like Activity) make a note of it.

Click on the back button or (F3) come out of the role

STEP 3.

To Add the T-code in new role (or which ever role you want to enter)

Go to PFCG type the role Z:xxxxxxx click on the change buttone (Pencil icon button)

You will be prompted with tabs ( description, menu, workflow, authorizations, user..)

Click on Menu Tab

You will find the Role menu tab

if you have multiple (folders) under role menu choos the Folder in which you want to add T-code "ydar3"

Click on the Transaction button icon.

You will prompted with blank pop up with Transaction code and text

Just enter the T-Code in Transaction code block Ydar and click on Assign transactions (bottm left button)

You can see the T-Code ydar3 in the list of menu (or) in the folder which have choosen

Go to Authorization tab

Click on Expert mode for Profile Generation (Bottom and last button)

you will be prompted with pop up with three options

choose 3rd option --- Read old status and merge with new data

Again search for the objects and values which you have noted in

If you have same values then just generate the role (shift+F5) or click on menu Authorization you will have drop down in that you will have option of generate.

once generate go back (F3).

By this you will have the T-Code ydar in the role.

If you want to compare the two roles for its values go to SUIM then check for the two roles you can find differences if any.

If you find any difference then follow the PFCG steps and modify accordingly.

I hope this helps

Cheers

Soma