topic Re: role comparison in Application Development and Automation Discussions

role comparison

Former Member — Tue, 17 Jun 2008 15:53:42 GMT

Hi Security experts

The scenario is like this, there are two persons A and B, A has around 75 roles and B has around 20 roles, if I want B to have same setup like A, then B should also have 75 roles, Is there any comparison tool in SAP security perspective to compare what roles person B is missing and give those remaining 55 roles which person B is missing ? I think comparing Manually is tedious job.

Please advise

Regards

Renu

Re: role comparison

Former Member — Tue, 17 Jun 2008 16:33:50 GMT

Hi Renu

You should be able to do this using transaction code SUIM which has a comparison option towards the bottom. You can do comparisons between users, roles and other criteria.

Hope this helps

Nigel

Re: role comparison

Former Member — Tue, 17 Jun 2008 16:48:59 GMT

Renu,

You can use the table AGR_USERS, download the roles of user A and user B to an Excel file and then filter it. You would basically get the difference between the two. I'm not sure if this is an easier option. If you have a handful users, this should be manageable.

You can also specify all the usernames you need if you use SE16n.

Kunal

Re: role comparison

Former Member — Tue, 17 Jun 2008 19:02:55 GMT

Hi,

I guess this more of Excel work..

Above solution works..

A function in excel vlookup can help u out..

Regards,

Ajit

Re: role comparison

Former Member — Tue, 17 Jun 2008 20:53:25 GMT

Renka,

You can go the transaction SUIM and there is a node for comparision..expand the node and check what you wish to use.

But out of curiosity---> what are these 75 roles about !! I am about certian that the user is over authorized ....

Re: role comparison

Former Member — Tue, 17 Jun 2008 21:19:08 GMT

> goreg G wrote:

> But out of curiosity---> what are these 75 roles about !! I am about certian that the user is over authorized ....

That was my initial thought as well. An alternate option is to use composite roles to hide it.

Julius

Re: role comparison

Former Member — Tue, 17 Jun 2008 23:57:06 GMT

yeah.. too many roles.

However, if you still want to achieve this , you can make SAP to run a Vlookup too for you

Select the roles of user B in AGR_USERS, (in this case 20) then enter this set of roles in another session of AGR_USERS as a 'exclusion' of selection of single values, and enter user A

OLA! you get the roles that are assigned to A but not to B! that is 55

Cheers!

Abhishek

Re: role comparison

Former Member — Wed, 18 Jun 2008 10:03:40 GMT

Yes. There is also a nifty little green "import from file" and grey "paste" clipboard to go beyond the 8 line limit

Cheers,

Julius

Re: role comparison

Former Member — Wed, 18 Jun 2008 11:11:55 GMT


> Yes. There is also a nifty little green "import from file" and grey "paste" clipboard to go beyond the 8 line limit 
> 
> Cheers,
> Julius

I found that out after spending a day cutting & pasting into USR40 many years ago