role comparison

[Former Member]

Hi Security experts

The scenario is like this, there are two persons A and B, A has around 75 roles and B has around 20 roles, if I want B to have same setup like A, then B should also have 75 roles, Is there any comparison tool in SAP security perspective to compare what roles person B is missing and give those remaining 55 roles which person B is missing ? I think comparing Manually is tedious job.

Please advise

Regards

Renu

[Former Member]

Hi Security experts

The scenario is like this, there are two persons A and B, A has around 75 roles and B has around 20 roles, if I want B to have same setup like A, then B should also have 75 roles, Is there any comparison tool in SAP security perspective to compare what roles person B is missing and give those remaining 55 roles which person B is missing ? I think comparing Manually is tedious job.

Please advise

Regards

Renu

[Former Member]

Hi Renu

You should be able to do this using transaction code SUIM which has a comparison option towards the bottom. You can do comparisons between users, roles and other criteria.

Hope this helps

Nigel

[Former Member]

Renu,

You can use the table AGR_USERS, download the roles of user A and user B to an Excel file and then filter it. You would basically get the difference between the two. I'm not sure if this is an easier option. If you have a handful users, this should be manageable.

You can also specify all the usernames you need if you use SE16n.

Kunal

[Former Member]

Hi,

I guess this more of Excel work..

Above solution works..

A function in excel vlookup can help u out..

Regards,

Ajit

[Former Member]

Renka,

You can go the transaction SUIM and there is a node for comparision..expand the node and check what you wish to use.

But out of curiosity---> what are these 75 roles about !! I am about certian that the user is over authorized ....

[Former Member]

> goreg G wrote:

> But out of curiosity---> what are these 75 roles about !! I am about certian that the user is over authorized ....

That was my initial thought as well. An alternate option is to use composite roles to hide it.

Julius

[Former Member]

yeah.. too many roles.

However, if you still want to achieve this , you can make SAP to run a Vlookup too for you

Select the roles of user B in AGR_USERS, (in this case 20) then enter this set of roles in another session of AGR_USERS as a 'exclusion' of selection of single values, and enter user A

OLA! you get the roles that are assigned to A but not to B! that is 55

Cheers!

Abhishek

[Former Member]

Yes. There is also a nifty little green "import from file" and grey "paste" clipboard to go beyond the 8 line limit

Cheers,

Julius

[Former Member]

>

> Yes. There is also a nifty little green "import from file" and grey "paste" clipboard to go beyond the 8 line limit 
> 
> Cheers,
> Julius

I found that out after spending a day cutting & pasting into USR40 many years ago