topic Re: sap all in Application Development and Automation Discussions

sap all

Former Member — Thu, 13 Dec 2007 15:25:02 GMT

Hi,

How can I restrict specific two to three transactions to a user who is having

sap all profile?

Thanks,

Venkat

Re: sap all

Former Member — Thu, 13 Dec 2007 15:30:33 GMT

You can't.

The whole idea of SAP_ALL is that users have access to everything (almost)

Create them a role via PFCG that gives them access to only what they need. Test the role, fix any problems and then assign to the users, not forgetting to remove SAP_ALL

After that look at all the users with SAP_ALL and ask yourself exactly which users need the ability to completely trash your system.

Message was edited by:

Alex Ayers

Re: sap all

Former Member — Thu, 13 Dec 2007 15:46:47 GMT

Alex has already given the answer in his question.

Ther is NO reason anyone should have SAP_ALL in any system as the access is far to dangerous.

If someone does not agree i woudl like to hear argumenst that really stick. unitl now no one has been able to give a GOOD reason.

Re: sap all

Former Member — Thu, 13 Dec 2007 19:17:59 GMT

You can create a Role from SAP ALL as Modified SAP ALL, form this role remove the transactions you want to restrict and assign to users.

It’s not recommended to assign SAP_ALL to users.

Thanks,

Sachin

Re: sap all

Former Member — Thu, 13 Dec 2007 22:11:11 GMT

Depending on which transactions you are trying to restrict, your attempt will be more or less futile to only remove (or lock) a transaction.

There are some transactions which react more strictly to removing the transaction code (see function module AUTHORITY_CHECK_TCODE), and again there are others which can quite easily be submitted as reports, for example.

If the user still has full (*) access to all SAP_ALL objects except a range around a few tcodes, they will bypass your security attempts if they want to.

Kind regards,

Julius

Re: sap all

Former Member — Fri, 21 Dec 2007 11:19:01 GMT

copy SAP_ALL using SU02 -> utilities ->copy.

and modify as required to the copied role and assign.

Re: sap all

Former Member — Fri, 21 Dec 2007 19:58:26 GMT

Hello n k...

> copy SAP_ALL using SU02 -> utilities ->copy.

> and modify as required to the copied role and assign.

If you are looking for a new year's resolution, try [SAP note 442935|https://service.sap.com/sap/support/notes/442935] for ideas.

Cheers,

Julius

Re: sap all

Former Member — Fri, 21 Dec 2007 21:42:39 GMT

The only requirement is when we open an OSSid else there is no need for SAP_ALL why does a basis guy need to create an asset AS01- tcode ? so SAP _ALL is a big NO NO !