Standard Roles

[Former Member]

Hi all Security Gurus,

I have been given a task to assign few roles to users of various modules.

As i am new into this USER SECURITY i have no clue as to what is the best way to assign roles...

So i have decided to assign the SAP STANDARD ROLES to the following users with full rights to their specific MODULES..

Users are

FICO

SD

MM

PP and

PM

So i request all the SECURITY FORUM members to help me find the ROLES, so that i can assign them.

Or is there any better way to get this task done, IF YES then plz do help me with the same...

As the requirement is really urgent, i request anyone to react and help me with the same...

Also seeking your help in the near future at all times...

Reward points for sure..

Thanks a Million in Advance

Hari Haran.V

[Former Member]

Hi all Security Gurus,

I have been given a task to assign few roles to users of various modules.

As i am new into this USER SECURITY i have no clue as to what is the best way to assign roles...

So i have decided to assign the SAP STANDARD ROLES to the following users with full rights to their specific MODULES..

Users are

FICO

SD

MM

PP and

PM

So i request all the SECURITY FORUM members to help me find the ROLES, so that i can assign them.

Or is there any better way to get this task done, IF YES then plz do help me with the same...

As the requirement is really urgent, i request anyone to react and help me with the same...

Also seeking your help in the near future at all times...

Reward points for sure..

Thanks a Million in Advance

Hari Haran.V

[Former Member]

Hi,

SAP Roles are recommended to be templates for your organizations own role setup. You should copy the SAP role and name your own role into your own customer namespace (Z* etc).

You can then alter the authorizations to suit the need of your organization.

Hope this helps.

You can easily find the standard roles to copy by using PFCG and search for SAP*.

Regards

Ashley

[Former Member]

Hi Ashley,

Thanks for your information, i seriously learnt a point from your information..

But can you atleast help me find only the Roles(Standard Roles) that have full authorization for the following modules

FICO

SD

MM

PP and

PM/QM

This is only becoz i must give them full authority to their specific modules.

And after i know what Roles are those i will copy them into a new Z role.

I request you to guide me on this as this has to be completed max by today....

Waiting to hear more from you at the earliest,

Thanks in advance

Reward points for sure...

Hari Haran.V

[Former Member]

Hi hunky,

You can use tcode SUIM to view all SAP standar roles.

1- Execute SUIM

2- Go to Roles --> Role by Complex Selection Criteria

3- Complete the field with: SAP*

The next screen will show all standar roles, and you´ll see all those roles for the modules that are you looking for.

For example: SAP_HR, SAP_FI, SAP_MM*, and so on.

I hope helps you.

Regadrs, Leandro

[Former Member]

Hi

You can do one thing to find all the FI roles in the roles tab of user maintainace (su01) try entering sap_fi_* and hit F4 and all the sap FI role templates will be displayed and then you select whatever roles you want. You can do the same for SD, MM eg. SAP_SD* , Sap_MM, sap_pm, sap_qm*. Hope you got the point.

Regards,

Naveen

Award points for the helpful answers.............

[Former Member]

HI Naveen and Others,

I appreciate all your responces, but the fact is that i am still not able to find the suitable role for my purpose...

I am looking for ROLES that have full authorization pertaining to that MODULE...

for example: SAP_FI_ADMIN...

let us assume that is a standard role that has full auth over the FICO module...

similary i want it for SD, MM, QM, PM and PP

hope i am clear with my requirement.

Reward points for sure

waiting to hear from all the gurus

Thanks in advance.

Hari Haran.V

[Former Member]

Hi,

Unfortunately sap dosent provide any admin roles for different modules as far as I know atleast. But you can create one by importing all the profiles of the sap roles. I know itz gonna be a tedious work but that is the only work around I can see.

Regards,

Naveen

[Former Member]

Hi Naveen and others,

I have worked around a way for this process

by creating a new project thru SPRO_ADMIN and then calling this to the new role...

this worked out to be the best way for my problem....

BUT now, i have a question

I want to copy these roles to a different client on the same machine, can u help me with this....

Also can u help me copy few users that i have created to other clients...

And when i copy users will the roles and profiles assigned also be copied...

Plz throw some light on this....

Reward points for sure

Thanks in Advance

Hari Haran.V

[Former Member]

Hello,

Give SAP_ALL to functional consultants, technical consultans.

Note: In these remove/restrict Basis-Administration, Basis - Central Functions.

We can do the mass transport of the roles from one server to another using PFCG.

Users transport also, we can do . But it is not suggestable.

Manually create users in the other server !!

Note:Points always encourage me to reply !!

Message was edited by:

MSR

[Former Member]

Hari,

If you want to copy roles from one client to other you can directly download the role from pfcg (Role -> Download) and then upload to the new client (Role -> Upload). Or the other way around can be create a transport and then download the transport into the new client.

And for users you can goto SCC8 transaction and specify the profile name as User Master record "I guess" or what ever that is related to User Master record. then it creates a couple of transports. All you need to do is download those transports into your new client. If I am not clear you may search for documentation on SCC8.

Regards,

Naveen

[Former Member]

HI naveen,

I guess this a good option rather than creating the Transport requests...

It was a useful answer to me and i wish i keep getting this kind of help from you...

Thank you very much

Points awarded.

And Naveen can you plz tell me what is the exact use of SUIM tx code.

Regards

Hari Haran.V

[Former Member]

Hari,

SUIM has some standard reports that are supplied by SAP. the most we use is the change documents (to see whether any admin has changed a particular USERID.) option in SUIM. But most of the time SUIM results are not 100% reliable... Hope this helps...

Naveen

[Former Member]

Hello,

SUIM is the most useful and powerful tx.

If you know how to use it ie. diffirent combinations , you can get maximum use of it...!!

Check this...

/people/kristoffer.engh2/blog/2007/06/25/the-power-of-suim

And

http://help.sap.com/search/highlightContent.jsp

I hope this will help you.

Note: Points always encourage me to reply !!

[Former Member]

Hello,

I had also the problem to creating an ADMIN role as you want to do. Unfortunately there is no standard role for this from SAP. At least I created by myself a new role in PFCG and activated all transactions of this module by coping the whole node out of the SAP menu into the role menu. Do this:

1. Create a new role

2. choose the register "menu"

3. select your module over "Copy menus" "From SAP menu"

4. prove if you have unrequested transactions in the nodes (e.g. SE16 or SU01)

5. Adjust all objects over register "Authorization".

Hope this helps.

Regards

Chris

[Former Member]

Thanks to everyone for helping me...

i had some valued inputs which will help me in the future.

Regards

Hari Haran.V