topic Re: User comparison? in Application Development and Automation Discussions

User comparison?

Former Member — Fri, 21 Mar 2008 13:31:08 GMT

Hi all!!!

I am relatively new to SAP authorisation concept, ad i think i dont completely understand the idea of user comparison.

Am i correct:

- if i use SU01 to assign a role to a user there's no need to perform a user comparison

- if i assign user to a role i have to run user comparison. Before comparison,if you look into user master record the role is already there, but it is uncompared, and user dont have authorisations yet, though he can log on and see role menu.

What is the point of user comparison? what does it do apart from assigning profiles? if nothing, why is it so that user dont have roles authorisation immeadiately after assignin him to a role in pfcg?? What is the point? First i thought that it removes all profiles which are not connected to the assigned role..but i try to attach some profiles manually and did user comparison, wich didn't remove manually entered profiles...so..

Can anybody describe it using simple language?

Tanks!

Re: User comparison?

Former Member — Fri, 21 Mar 2008 16:00:56 GMT

Hi,

User comparison will play important role in security concept. Please go through with this url you can get most of the information about user comparison. I think this may be very help full to you.

http://help.sap.com/saphelp_nw04/helpdata/en/e4/15e48efd6c11d296430000e82de14a/frameset.htm

Regards,

Raju.

Re: User comparison?

Former Member — Fri, 21 Mar 2008 23:30:16 GMT

A user comparision pushes down the authorizations to all users. It is beneficial because if a user has a lot of authorization objects assigned to him/her when adding a new role it doesn't register. By doing PFUD or User Compare it pushed down the access and synchs up the authorizations. Another problem might be with you move a transport during the day, the authorization changes are not immediately acknowledged until you do a user compare.

I'd suggest setting up PFUD to run in the back ground every hour just to keep the authorizations in synch.

Regards,

Bree

Re: User comparison?

Former Member — Mon, 24 Mar 2008 16:22:06 GMT

Hi Stanislaw,


> - if i use SU01 to assign a role to a user there's no need to perform a user comparison

Yes, that is correct. When saved through SU01, SU10, a UMR reconcilation is done for the user(s).


> - if i assign user to a role i have to run user comparison. Before comparison,if you look into user master record the role is already there, but it is uncompared, and user dont have authorisations yet, though he can log on and see role menu.
>

Thats a very good observation. Even I didnt know that the role menu would be displayed. However, (technically) since its actually the profiles and not the assignment of roles that give authorization, a user or role compare is required. The assignment of profiles to users can be viewed in table UST04. SU01/SU10 updates the UMR to reflect the appropriate profile(s) of the role in UST04. PFCG does not do this, unless manually done. If not compared via PFCG, this compare is rectified on the next run of PFCG_TIME_DEPENDENCY.


> What is the point of user comparison? what does it do apart from assigning profiles? if nothing, why is it so that user dont have roles authorisation immeadiately after assignin him to a role in pfcg?? What is the point?

User Comparison updates the profiles in the UMR, table UST04 ...and maybe many others! . I hope you are clear on assigning through PFCG now


First i thought that it removes all profiles which are not connected to the assigned role..but i try to attach some profiles manually and did user comparison, wich didn't remove manually entered profiles...so..

Generated profiles should not be assigned via the profiles tab. It does not allow to do this, maybe on earlier versions, still does allow this. However, if you still do assign this, PFCG_TIME_DEPENDENCY will remove this assignment!

A standard SAP profile, or a manually created profile(through SU02) will not get affected.

Hope this clarifies

Abhishek

Re: User comparison?

Former Member — Tue, 25 Mar 2008 10:25:41 GMT

Hi,

the slite difference between user and usercomparison in PFCG.

You can assign one role to the user with the help of User tab in pfcg. the role can be assigned to the user but not activated for the user master record.

if you use usercompare then that role will be activated to the particular user master record. the role can't be activated through user only you have to perform user comparison inorder to activate that role to the user master record.

Experts please correct me if i am wrong.

Regards,

srini.

Re: User comparison?

former_member763658 — Mon, 30 Jan 2023 21:57:33 GMT

Good afternoon!

Is there a table that tells you how many users have a problem in "user comparison"?