how to create a role using profile SAP_ALL

[Former Member]

I want to create a role which has the same authorizations as SAP_ALL except several tcodes.Because SAP_ALL is not a role ,I can't do it by the way of copying role. how should I do?

[Former Member]

I want to create a role which has the same authorizations as SAP_ALL except several tcodes.Because SAP_ALL is not a role ,I can't do it by the way of copying role. how should I do?

[Former Member]

You can go into profile generator - PFCG - create a role

calling it ZSAP_ALL or whatever name you want. Go into

the authorization tab and go to edit / insert authorization from profile.

Regards,

JC

[Former Member]

Here is how you do this

Go to PFCG and enter a name for the SAP_ALL like role - Choose Create and go to the auth tab. Choose change auth data then select do not select template. The choose from the menu Edit - Insert authorizations - full authorizations. This will bring in all auths and tcodes. You can then inactivate or change as you like.

This will give an SAP_ALL like role.

Thanks,

Mary

[christian_wippermann]

Hi,

may I say first say that I strongly discurage you from doing so. Please see older threads regarding this. You have NO control over this role and you will not be able to succeed taking away some transactions.

Anyway, here you go. Go to PFCG, create a role, go to Authorizations tab, go to "Change Authorization Data", and then select "Edit" -> "Insert Authorizations" -> "From Profile" from the screen menu.

But then: You take away SU01 -> I use transaction OIBB (or any other transaction with parameter /NSU01 in table TSTCP). You want to take SE16N from me -> I use program RK_SE16N through transaction SA38. You take away SA38. I find other ways.

You need to know what your users need - not what they do not need.

Cheers,

Christian

[Former Member]

We use this only for the Basis team in our dev environment and what we do is allow the S_TCODE but remove all the security auths.

[Former Member]

You can either select the template SAP_ALL or insert authorizations from edit tab. you will get

S_TCODE= ALL TRANSACTIONS. so if you want to remove transactions you have to change the S_TCODE and maintain lot other objects.

[Former Member]

tks everybody!

I create a role from profile SAP_ALL and delete the authorization beginning with s_user,now su01 and pfcg can't be used.

[Wolfgang_Janzen]

Hopefully you do not believe that this is sufficient ...

If you've left the S_DEVELOP authorizations users that are assigned to that role still can perform any action - simply because they can develop own coding or modify existing coding ... (respectively: using the debugger to bypass AUTHORITY-CHECKs).

Please keep in mind: the role concept is driven by the business scenario perspective (e.g. role "purchaser", "HR staff", "user administrator", etc.). All the technical details are derived ("hidden" as detail). Your approach is performing the opposite: using a technical vehicle and wrapping a role around it.

Furthermore: you have chosen a very special "authorization profile" (SAP_ALL). In real life there is no employee that is entitled to do "everything". Even the CIO is not entitled to perform any action (e.g. he should not be authorized to perform just any technical operation - e.g. database reorganization). Just because it is not his "role" (in the company).

=> there is no "SAP_ALL" role in real life

[Former Member]

It would depend to a large extent on who the role is destined for to make a risk assessment of such a role.

For a developer in a development system, the role could possibly be "fit-to-purpose" given the constraints.

For an administrator in a non-production client in the production system is would be common (to find).

For a workflow ID in a production system, the situation would be more critical (even although there are SAP notes which recommend this practice) and would depend on many other things.

Adding it as a general role for all users would be a disaster in the making.

[Former Member]

tks your advice ,Wolfgang Janzen

the developing consultant ask me the authorization of sap_all except SCC*(SCCL,SCC4...).I think since they have the developer key,I can't prohibit them from intentionally destroying.Am I right?

In your opinion,which authorizations should a developer have?

Message was edited by: begue long