Solved: Re: Authorisation Roles - reg

Former Member · ‎2007 Aug 06

Hi all,

Kindly tell me something about the authorisation roles assigned to specific users. its T.Codes and its implications in an upgrade.

Regards

Shanoj

Former Member · ‎2007 Aug 06

" Mass Maintenance of Users Profiles

Goto transaction code SU10

Select your SAP User by Address data or Authorization data.

With the users you want to change selected, click :-

User -> Change -> Profiles

Filled in the Profiles and click save.

" How can I create multiple User Id at Random

We usually created Id though SU01, it only one by one.

Can I create multiple user id having same profile at once.

Yes you can, use tcode SCAT. First, make sure your client setting (SCC4) is enabled with ' X eCATT and CATT allowed'. Just in case your Production disabled this.

- Then, you need to create a simulation (test case) of creating new user id by calling tcode

SU01 later.

- Test case must start with Z, example ZCREATE_NEW_USER. Create this case, put title and

choose component as BC (basis components).

- Save and choose Local if you dont want to transport it or choose a dev. class (example ZDEV)

if you want to transport it later.

- Go back and click Change button. Then key -in Object as example SU01, and choose Record

button on top. When it prompts to enter Transaction code, key in SU01 (if for roles,

key-in PFCG) and begin recording. As usual in SU01 create 1 user id, dept field, password,

roles, group and so on.

- Make sure you press Enter on each field because we want to capture the value/object and

SCAT is a bit stupid if you become familiar later....but still useful...indeed.

- You will see a clock on the bottom which means the recording process is on going.

Once done, click Back button and press End button to end the recording.

Note - I noticed you said the profiles are all the same. Then this is much easier...no need to enter the roles/profiles, just duplicate this ID and change the name, dept and password only.

Okay..first stage has finished. Then double click the Object to begin inserting parameters. Then you will see an object for each fields that you run from SU01. Choose the right field example user id (BNAME) and choose button 'Insert Import Parameter (F6)' and you may click Next Screen to 'watch' what have been recorded and proceed to choose several other objects like password field (PASSWORD1, PASSWORD2), roles field (AGR_NAME), group field etc. If you happen to choose the wrong object, then you can reset back (Edit -> Reset Parameterization). You may see so many junk fields captured and this is because SCAT records every steps/dialogs.

Once done, choose Back and save this case. Then you need to click 'Goto -> Variant -> Export' and save it. After that use Ms Excel to open it and begin inserting all other user ids. Save and close. Remember to close this file because SCAT will use it.

Then last one, get back to SCAT and click button execute, processing mode chose Background, choose external file 'the one you created with Excel' and execute. At this moment don't use tcode SU01 bcoz you may interrupt the simulation. Wait for the logs. If you see reds then error was

happening.

Hoping this will help you. I have done (Sap 4.6C) this to create thousands of user ids and also thousands of roles/profiles (pfcg). I heard with Sap 4.7, the SCAT has so many extra features.....

Correct me if i'm wrong elsewhere.....just shared my experience.

"Function and Role of User Types

In "USER MAINTENANCE- SU01" --> in the "logon tab" there are 5 different "user type"


"1. dialog 
"2. system 
"3. communication 
"4. service 
"5. reference

Kindly mention the function and role of all the above mentioned user types specifically and hows is one user type different from another.

' These are as follows:-

'1. Dialogue:-

For this kind of users:-

GUI login is possible.

Initial password and expiration of passowrd are checked.

Multi GUI logins are checked.

Usage:- These are used for GUI logins.

'2. System

For this kind of users:-

GUI login is not possible.

Initial password and expiration of passowrd are not checked.

Usage:- These are used for internal use in system like background jobs.

'3. Communication

For this kind of users:-

GUI login is not possible.

Users are allowed to change password through some software in middle tier.

Usage:- These are used for login to system through external systems like web application

'4. Service

For this kind of users:-

GUI login is possible.

Initial password and expiration of passowrd are not checked.

Multiple logins are allowed.

Users are not allowed to change the password. Only admin can change the password

Usage:- These are used for anonymous users. This type of users should be given minimum authorization.

'5. Reference

For this kind of users:-

GUI login is not ible.

Initial password and expiration of passowrd are not checked.

Usage:- These are special kind of users which are used to give authorization to other users.

reward points if it is usefull....

Girish

Former Member · ‎2007 Aug 06

Hi,

1. There are no SAP-roles for customizing (update or display).

2. You can create a customizing role in PFCG:

in the menu tab utilities/customizing auth; you can use a project IMG (maintainable in SPRO) to restrict the authorizations for example to FI or CO.

As the roles can get pretty big it is quite a lot of work to check the generated authorizations and to limit them if necessary (e.g. only display) and to delete authorizations which certain users (e.g. consultants) do not need. This is especially important if they have other roles which in combination may allow "unwanted access" to certain things.

What is basically necessary for customizing display is SM30, S_TABU_DIS for the relevant authorization groups (activity 03) plus if you want to read the tables out of the IMG the relevant S_TCODE-authorizations. Additionally many transactions require various other authorization objects (which are generated out of SU24 - which is not "100% accurate" as SAP states).

=== We use version 3.1. but there is no posting in any web site suitable for creating IMG All display only profile for Ver 3.1

Can any one please share there knowledge.

=== The 3.1 version I beleive is a different structure than the higher versions so I am not sure the CUST_ACTOBJ table exists. You will have to debut the IMG to find the source where the tcodes are housed. There are MANY transactions associated with the IMG and S_TABU_DIS is only a part.

Version 3.i is VERY difficult to use to get SU24 to load the role so you can make a display IMG.

It would be simplet to copy SAP_ALL and change the activities to '03'.

=== But even in SAP_ALL the customizing for IMG (S_IMG_ACTV) object value is only having Change or nothing..!! There is no option to display... their are few more objects like this. If I dont have any value selected, the profile is not be effective. Nothing can be done. Any more suggestions..

=== And S_IMG_ACTV means very little. You can configure with or without it and since configuration is tcode driven and accessable anywhere in the system. You have to give S_IMG_ACTV '02', it means little

=== I beleive you need S_IMG_GENE to actually change the config. We have two roles (4.6C) ... one for display only and one for changing.

=== Create f.ex a role "CUSTOMIZING" and run the following ABAP.

It will bring to your role all SPRO tarnsactions. Then go through the auth objects and change them display only. This way you'll have a display only role.

REPORT ZTCODES .

tables: cus_actobj, agr_tcodes.

data: ica like cus_actobj occurs 1000 with header line,

iagrtc like agr_tcodes occurs 4000 with header line.

select * from cus_actobj into table ica.

sort ica by tcode.

delete adjacent duplicates from ica comparing tcode.

iagrtc-agr_name = 'CUSTOMIZING'.

iagrtc-TYPE = 'TR'.

iagrtc-direct = 'X'.

loop at ica.

iagrtc-tcode = ica-tcode.

append iagrtc.

endloop.

modify agr_tcodes from table iagrtc.

Note, there is another table cus_acth as well that you load into your internal table and you need to add a sort tcodes and delete adjacent duplicated. then load to your role.

Look at the below link

http://help.sap.com/saphelp_nw04s/helpdata/en/c1/db3fa6fd3111d5997a00508b6b8b11/content.htm

Regards

Sudheer

Former Member · ‎2007 Aug 06

Hi

Welcome to SDN forum

In general different users will be given different authorizations based on their role in the orgn.

We create ROLES and assign the Authorization and TCODES for that role, so only that user can have access to those T Codes.

USe SUIM and SU21 T codes for this.

Much of the data in an R/3 system has to be protected so that unauthorized users cannot access it. Therefore the appropriate authorization is required before a user can carry out certain actions in the system. When you log on to the R/3 system, the system checks in the user master record to see which transactions you are authorized to use. An authorization check is implemented for every sensitive transaction.

If you wish to protect a transaction that you have programmed yourself, then you must implement an authorization check.

This means you have to allocate an authorization object in the definition of the transaction.

For example:

program an AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT <authorization object>

ID <authority field 1> FIELD <field value 1>.

ID <authority field 2> FIELD <field value 2>.

...

ID <authority-field n> FIELD <field value n>.

The OBJECT parameter specifies the authorization object.

The ID parameter specifies an authorization field (in the authorization object).

The FIELD parameter specifies a value for the authorization field.

The authorization object and its fields have to be suitable for the transaction. In most cases you will be able to use the existing authorization objects to protect your data. But new developments may require that you define new authorization objects and fields.

http://help.sap.com/saphelp_nw04s/helpdata/en/52/67167f439b11d1896f0000e8322d00/content.htm

To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.

Authorization : An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values.

You program the authorization check using the ABAP statement AUTHORITY-CHECK.

AUTHORITY-CHECK OBJECT 'S_TRVL_BKS'

ID 'ACTVT' FIELD '02'

ID 'CUSTTYPE' FIELD 'B'.

IF SY-SUBRC <> 0.

MESSAGE E...

ENDIF.

'S_TRVL_BKS' is a auth. object

ID 'ACTVT' FIELD '02' in place 2 you can put 1,2, 3 for change create or display.

The AUTHORITY-CHECK checks whether a user has the appropriate authorization to execute a particular activity.

This Authorization concept is somewhat linked with BASIS people.

As a developer you may not have access to access to SU21 Transaction where you have to define, authorizations, Objects and for nthat object you assign fields and values. Another Tcode is PFCG where you can assign these authrization objects and TCodes for a profile and that profile in turn attached to a particular user.

Take the help of the basis Guy and create and use.

Sy-SUBRC values

4 User has no authorization in the SAP System for

such an action. If necessary, change the user

master record.

8 Too many parameters (fields, values). Maximum

allowed is 10.

12 Specified object not maintained in the user

master record.

16 No profile entered in the user master record.

24 The field names of the check call do not match

those of an authorization. Either the

authorization or the call is incorrect.

28 Incorrect structure for user master record.

32 Incorrect structure for user master record.

36 Incorrect structure for user master record.

<b>Reward points for useful Answers</b>

Regards

Anji

Former Member · ‎2007 Aug 06

" Mass Maintenance of Users Profiles

Goto transaction code SU10

Select your SAP User by Address data or Authorization data.

With the users you want to change selected, click :-

User -> Change -> Profiles

Filled in the Profiles and click save.

" How can I create multiple User Id at Random