topic Re: Profile without basis permissions in Application Development and Automation Discussions

Profile without basis permissions

Former Member — Thu, 01 May 2008 20:00:23 GMT

Hi all,

How can i create a profile for many users without basis transactions (ej. sm04, sm50, db02, etc) this users now have SAP_ALL, SAP_NEW profiles.

please ¡¡¡

Re: Profile without basis permissions

Former Member — Thu, 01 May 2008 20:23:09 GMT

You can't.

SAP_ALL means EVERYTHING

Give me one good reason why a user should have access to 20000+ transactions

Create the user based on the transactions which they need. Do not start with SAP_ALL or you will remove functions in one place & they will just perform them somewhere else

Re: Profile without basis permissions

Former Member — Thu, 01 May 2008 21:02:29 GMT

Hi Alex,

i know what is SAP_ALL, i want to quit that profile for all users that have it, until the other consultants define fine the permissions for all users i want to quit basis transactions.

thanks alex.

Re: Profile without basis permissions

Former Member — Thu, 01 May 2008 21:30:28 GMT

Hi Francisco,

It's not that easy really, but one place to start is to create a role based on SAP_ALL and go through and remove most of the S_* objects or at least only give the display options for them. The role will likely still have a lot of holes, but it's a start.

Removing only the transactions will do nothing as the underlying access will remain and there are many ways to get to each function.

Good luck!

Re: Profile without basis permissions

Former Member — Fri, 02 May 2008 10:17:23 GMT

One way that I would suggest is to make a list of non BASIS profiles which you want to use (which have currently been assigned to users from function modules other than BASIS).

Goto pfcg

Give the new role name (which you want to create) and role description.

Goto Authorization tab->change Authorization data

Goto edit -> Insert Authotrizations-> From Profiles.

Give the profile names one by one which you have selected to use.

Update the org level values and othe open field values and generate the role.

Re: Profile without basis permissions

Former Member — Fri, 02 May 2008 17:58:38 GMT

Hi Francisco...

No wonder I saw many Sec. consultants in similar situations...I saw this issue discussing in one my SAP BI Security class...

I was in similar situation like you are two months back...on my brand new SCM system.....

As BA or partners were not ready to define me standard roles/tcodes I had to give SAP_ALL to them...after spending a week of sleepless nights......I customized a role from SAP_ALL, I restricted almost like more than 300 critical basis/security/db config by defining ranges in S_TCODE...I tested it can be satisfied.....

I think you can take try by defining ranges in S_TCODE....if you may want to try the ranges......give ur email id...I will email you the ranges and the tcodes restricted.....

I would promise, you will have good sleep.....however you need to insist BA or partner consultants to define roles on Quality/Test box and Production....because my role will give elevated access...

If you may want to try let me know.....

Thanks

Re: Profile without basis permissions

Former Member — Fri, 02 May 2008 22:44:44 GMT

Hi Anil,

You really will help me with your role......i want to try it .......if you like to share it with me.......... email id = daniel.uvm from GMAIL

thanks to all for your help

Re: Profile without basis permissions

Former Member — Sat, 03 May 2008 14:14:06 GMT

Anil,

If you have restricted by S_TCODE ranges then your role will not provide any useful restriction. Unless you restrict by object values you might as well save yourself the time and give them SAP_ALL.

Re: Profile without basis permissions

Former Member — Sat, 03 May 2008 17:10:49 GMT

Thats right!

Restriction by S_TCODE always leaves some back-door entries of accessing the critical t-codes.

Re: Profile without basis permissions

Former Member — Sat, 03 May 2008 17:11:38 GMT

Duplicate post

Edited by: Hemant Raj on May 3, 2008 7:12 PM

Re: Profile without basis permissions

Former Member — Mon, 05 May 2008 15:36:01 GMT

Good Morning All - As per Alex note, just forgot to tell you that apart from ranges in S_tcode I also disabled some of the critical S_* objects just to be in saferside.

Thanks!

Re: Profile without basis permissions

Former Member — Thu, 08 May 2008 19:26:20 GMT

Hi all,

thanks all for your help, i will try this solution.

thanks ....

Re: Profile without basis permissions

Former Member — Fri, 09 May 2008 04:09:31 GMT

hi Anil ,

Can you help me with your role......i want to try it .......if you like to share it with me.......... email id = manjula.matha from GMAIL

Re: Profile without basis permissions

Former Member — Tue, 13 May 2008 03:22:11 GMT

Please look at O* tcodes also.

Harinder

Re: Profile without basis permissions

Former Member — Tue, 13 May 2008 04:38:13 GMT

Hi Kumar,

can u post those t-code in this thread...

tahnk you...