Assign authors roles to users without Administrator role

[AnnetteG]

Hi Team,
we have got SAP Enable Now cloud version with access via SSO. As we're thinking about shifting some tasks to a Shared Service Center, I was wondering if there is a role which could give users (Lerners) the author role which is needed. As we're working currently with 8 Workareas (and it will get more the more applications will start to work with SAP Companion) with own Author roles, we need a special role just to grant that. Is there already a special role for that or is there an easy way to enhance one of the already existing Standard Roles?

Br Annette

[DirkManuel]

Oh, I see what you're asking, now. Yes, that is controlled by the Role Permissions (defined on the Roles screen - see attached image).

Just give whoever you want to delegate permissions to Edit role permissions on the Role. Role Permissions were added a year or so back specifically for this purpose (you want to give people the ability to assign a role to users, but not be able to change that role's permissions (which is covered by the Administrate role permission)).

[AnnetteG]

Hi Dirk,

Great, thank you very much. That's what I was looking for.
Best regards
Annette

[DirkManuel]

Great! I'm glad that was it. Can you mark the question as answered tin case anyone comes looking for the same thing in the future? Thanks.

[AnnetteG]

Hi Dirk,
we tried that out several times, but simple authors , just added to the role permissions, are not allowed in the system to edit any role. So it doesn't work. What additional permissions are needed to make the role assignment possible?

[DirkManuel]

Maybe Users: Edit?

[Anton_Mavrin1]

Also, you can add one more parameter to the SAP Enable Now SSO setup, so the role information will be sent together with the user data from your SSO provider (Azure AD, Okta, Ping Federation, etc.)

In this case, the role management will be done in a single place (Identity Provider) like for the rest applications in your company, I believe.

Quite aligns with the ITSM policies. 😉

[DirkManuel]

I'm not sure what you are asking here. You want to give selected Learners the Author Role? Sure, you can do that. But you mention Workareas, so are you wanting to give users Author access to a specific Workarea? If so yes, you can do that - you just need to create a new Role (that can inherit permissions from the Author Role, and then give that new Role Workarea-level permissions ONLY on the required Workarea.

Over and above that, you can easily modify any of the pre-built Role permissions (but be careful doing this!) or create your own roles. You can find a list of all Permissions and their meanings here.

[AnnetteG]

Hi Dirk,
thank you very much for your quick answer. Sure I know that I, as an administrator of the system, can give all our author role to learners. But I want to delegate this activity to someone who shouldn't get the administrator role. There should be someone getting just the task to provide author roles. I will check the meanings of all permissions, and maybe I will find out the right mix.