Derived Roles

[Former Member]

I created a group of derived roles and also a new Orgainizational unit. I am finding that the value of imparting role is overwriting the value from the individual role.

Isn't any value that is in the Orgainizational unit supposed to stay with each individual role and not be overwritten?

[Former Member]

Dear Brian,

Deriving Roles and Copying Authorizations:

http://help.sap.com/saphelp_nw70/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm
There are two possible reasons for deriving a role from an existing role:
· The role menus are identical but the authorizations for the menu actions are different in the derived role.
· The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role.

Prerequisite
Roles derived from another cannot have any additional menu entries.

Deriving a Role from Another Role
1. Create a role.
2. Enter a role description text.
3. Enter the name of the role from which all transactions including the menu structure are to be copied in the Derive from role field in the Description tab page.
4. Save your entries to create a role whose menu was derived from another role.

If additional transaction codes are added to the menu of the original role, they are copied into the derived role.

Copying the Authorizations of the Original Role to the Derived Role
1. Change the original role from which the authorizations are to be derived, in the role maintenance. Choose the Authorizations tab and the Change authorization data button.
2. Choose Authorizations -> Adjust Derived -> Generate Derived Roles.

The authorization data is copied to the derived roles.

The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).

Additional Information
To delete the inheritance relationship between two roles, choose the Delete inheritance relationship pushbutton in the Description tab.

You can display an overview of the inheritance of roles by choosing Role -> Where-used list. You can go to another role by double-click.

You cannot derive functions from the delivered user roles in your own roles.

Authorization Checks when Adjusting Derived Roles:

http://help.sap.com/saphelp_nw70/helpdata/en/2b/84653f1b76b11ae10000000a114084/frameset.htm
You are maintaining the authorization data for a role in the Profile Generator (transaction PFCG, by choosing Change Role on the Authorizations tab page), and want to transfer this data to the derived roles (Authorizations -> Adjust Derived -> Save Derived Roles).

The authorization checks performed here correspond to those that would be performed if you adjusted the derived roles manually. The following checks are performed, in the order in which they are listed:

1. Changing a Role

The user requires change authorization for all derived roles (S_USER_AGR, activity 02). To avoid inconsistencies between the derived roles, the process is terminated, if the authorization check fails for at least one role. A list of all roles for which change authorization has not been assigned is displayed first.

2. Saving the Profile names

The system automatically generates profile names for roles to which no profile name has yet been assigned (starting with "T-"). The system then checks whether the role administrator is authorized to save the name (S_USER_PRO, activity 01). The program also only continues in this case, if all checks are successfully performed, because roles with no profile names cannot be correctly saved. The profile and role names for all failed checks are displayed.

3. Removing the Authorizations from the Derived Roles

During the adjustment of derived roles, their authorization data is completely removed and replaced by the data of the original role. Since the authorizations of the derived roles can be maintained individually, the system must check whether the administrator has the required authorizations for S_USER_VAL to be permitted to remove them. If the derived roles also contain manual authorizations for the object S_TCODE, the corresponding rights for S_USER_TCD are also required. If the checks are not successful for all derived roles, the process is terminated after displaying the missing authorizations.

4. Copying the Authorizations from the Original Role

The administrator’s authorizations for S_USER_VAL and S_USER_TCD are also checked here. Note that full authorization is required in the field AUTH_VALUE of S_USER_VAL for authorization fields that contain ranges of values (see also SAP Note 495282). If the derived role also contains manual authorizations for the object S_TCODE, the corresponding rights for S_USER_TCD are also required. These conditions also apply for point 3. In the case of missing authorizations, a list is again displayed before the process terminates with an error message.

5. Generating the Profiles

If you have chosen the function Generate Derived Roles, you also require the authorization S_USER_AGR with activity 64 for the original role and the derived roles. For structural reasons, it is not possible to adjust derived roles if you do not have authorization to generate the profile of the original role, since this action is performed before the adjustment process. If this is the case, the system displays system message 425 (class S#). Derived roles for which the profiles cannot be generated due to missing authorization are displayed in a list at the end of the adjustment process. The profiles of all other roles are generated. Termination is not required, since the authorization data of the derived roles cannot become inconsistent. After confirming the list, the system displays message 680 (S#) to complete the process. If all profiles have been generated, the system displays the message "Action performed successfully".

You can also use a background job to adjust derived roles. To do this, schedule a variant of the report SUPRN_REGENERATE_DEPENDENT, in the selection screen of which you enter the name of the original role in the field TOP_AGR. To also generate the profile, select the field GEN with an "X", otherwise leave it empty. If authorization checks fail during the run, these are recorded in the job log.

You can adjust the data for all derived roles in a single work step. If there are multiple derived roles for an original role and you want to adjust the authorization data for all derived roles to the data of the original role, we recommend that you use one of the functions listed under 3 or 4, instead of adjusting the roles individually with Transfer Data.

Hope this will help.

Regards,

Naveen.

[Former Member]

Hello Brian,

The benefit of the derived roles is that all changes made in the parent role are "copied" in the derived role, except the organizational values(use the copy function). So if functions(jobs) are global wide the same and only differ in the organizational values it is a quick way to maintain your authorizations. If you add a new transaction in the parent role which also require an organizational value, you have to update all the derived roles. If you change something else and generate the parent role and the derived roles (button on top) this change will be in all the derived roles and the organizational values are not changed. If you want an organizational value the same for parent and derived roles than make a hand change it will not be influenced again by the organizational value. If you need the organizational value then insert the object again by hand and it will act beside the one you have changed by hand. Do not make differences in the standard authorizations of objects between the parent role and derived roles then the benefit of quick maintenance is gone.

There is a simple but good book called "authorizations made easy".

Bye

Jan van Roest

[Former Member]

Dear Brian,

Deriving Roles and Copying Authorizations:

http://help.sap.com/saphelp_nw70/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm
There are two possible reasons for deriving a role from an existing role:
· The role menus are identical but the authorizations for the menu actions are different in the derived role.
· The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role.

Prerequisite
Roles derived from another cannot have any additional menu entries.

Deriving a Role from Another Role
1. Create a role.
2. Enter a role description text.
3. Enter the name of the role from which all transactions including the menu structure are to be copied in the Derive from role field in the Description tab page.
4. Save your entries to create a role whose menu was derived from another role.

If additional transaction codes are added to the menu of the original role, they are copied into the derived role.

Copying the Authorizations of the Original Role to the Derived Role
1. Change the original role from which the authorizations are to be derived, in the role maintenance. Choose the Authorizations tab and the Change authorization data button.
2. Choose Authorizations -> Adjust Derived -> Generate Derived Roles.

The authorization data is copied to the derived roles.

The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).

Additional Information
To delete the inheritance relationship between two roles, choose the Delete inheritance relationship pushbutton in the Description tab.

You can display an overview of the inheritance of roles by choosing Role -> Where-used list. You can go to another role by double-click.

You cannot derive functions from the delivered user roles in your own roles.

Authorization Checks when Adjusting Derived Roles:

http://help.sap.com/saphelp_nw70/helpdata/en/2b/84653f1b76b11ae10000000a114084/frameset.htm
You are maintaining the authorization data for a role in the Profile Generator (transaction PFCG, by choosing Change Role on the Authorizations tab page), and want to transfer this data to the derived roles (Authorizations -> Adjust Derived -> Save Derived Roles).

The authorization checks performed here correspond to those that would be performed if you adjusted the derived roles manually. The following checks are performed, in the order in which they are listed:

1. Changing a Role

The user requires change authorization for all derived roles (S_USER_AGR, activity 02). To avoid inconsistencies between the derived roles, the process is terminated, if the authorization check fails for at least one role. A list of all roles for which change authorization has not been assigned is displayed first.

2. Saving the Profile names

The system automatically generates profile names for roles to which no profile name has yet been assigned (starting with "T-"). The system then checks whether the role administrator is authorized to save the name (S_USER_PRO, activity 01). The program also only continues in this case, if all checks are successfully performed, because roles with no profile names cannot be correctly saved. The profile and role names for all failed checks are displayed.

3. Removing the Authorizations from the Derived Roles

During the adjustment of derived roles, their authorization data is completely removed and replaced by the data of the original role. Since the authorizations of the derived roles can be maintained individually, the system must check whether the administrator has the required authorizations for S_USER_VAL to be permitted to remove them. If the derived roles also contain manual authorizations for the object S_TCODE, the corresponding rights for S_USER_TCD are also required. If the checks are not successful for all derived roles, the process is terminated after displaying the missing authorizations.

4. Copying the Authorizations from the Original Role

The administrator’s authorizations for S_USER_VAL and S_USER_TCD are also checked here. Note that full authorization is required in the field AUTH_VALUE of S_USER_VAL for authorization fields that contain ranges of values (see also SAP Note 495282). If the derived role also contains manual authorizations for the object S_TCODE, the corresponding rights for S_USER_TCD are also required. These conditions also apply for point 3. In the case of missing authorizations, a list is again displayed before the process terminates with an error message.

5. Generating the Profiles

If you have chosen the function Generate Derived Roles, you also require the authorization S_USER_AGR with activity 64 for the original role and the derived roles. For structural reasons, it is not possible to adjust derived roles if you do not have authorization to generate the profile of the original role, since this action is performed before the adjustment process. If this is the case, the system displays system message 425 (class S#). Derived roles for which the profiles cannot be generated due to missing authorization are displayed in a list at the end of the adjustment process. The profiles of all other roles are generated. Termination is not required, since the authorization data of the derived roles cannot become inconsistent. After confirming the list, the system displays message 680 (S#) to complete the process. If all profiles have been generated, the system displays the message "Action performed successfully".

You can also use a background job to adjust derived roles. To do this, schedule a variant of the report SUPRN_REGENERATE_DEPENDENT, in the selection screen of which you enter the name of the original role in the field TOP_AGR. To also generate the profile, select the field GEN with an "X", otherwise leave it empty. If authorization checks fail during the run, these are recorded in the job log.

You can adjust the data for all derived roles in a single work step. If there are multiple derived roles for an original role and you want to adjust the authorization data for all derived roles to the data of the original role, we recommend that you use one of the functions listed under 3 or 4, instead of adjusting the roles individually with Transfer Data.

Hope this will help.

Regards,

Naveen.