cancel
Showing results for 
Search instead for 
Did you mean: 

Security: Migration steps

Former Member
0 Kudos

Hi,

I have already a 5 dimensional "old" role based authorization concept in place and I am planning to migrate to Analysis Authorization Concept, I have to freeze my old roles during the migration in the Development System.

If there are change requestes popping up, is there still the chance to change the old roles during the migration? (Running both concepts in parallel in D?)

regards

O.

Message was edited by: Oliver Huss

Accepted Solutions (1)

Accepted Solutions (1)

former_member192700
Active Contributor
0 Kudos

Hi Oliver,

if you migrate your old concept, you have the option to create completely new profiles. Since you can repeat the migration at any time, you can still change your old profiles in your old system.

A repeated migration could then again create new profiles, and hence adjust the user profile.

I will double-check whether my proposal is a feasible proceeding.

Cheers

SAP NetWeaver BI Organisation

klaus_werner
Active Participant
0 Kudos

Andreas, I guess you forwarded it to me to confirm? So that's what I do, your answer is correct.

Both concepts can be maintained in parallel and repeatedly migrated.

However, Oliver, they can't be used in parallel, you have to switch depending on what you want to use or test at a time.

Regards, Klaus

Former Member
0 Kudos

Hi Klaus and Andreas,

thanks for the answers.

We have the following sitiuation:

- around 10 old projects based on the old concept ( to be migrated via the migration program in the switched system)

- 4 new projects (should be created via based on the new concept)

- parallel support from old roles (in the swithced system)

is this possible?

thanks in advance

Oliver

klaus_werner
Active Participant
0 Kudos

HI Oliver,

parallel support from old roles:

1. old authorizations do NOT count at all once the system is on the new concept (global switch), they'd have to be migrated whenever there is a change.

2. Migration is maybe not 100% perfect, i.e. some rework may have to be done. If you migrate several times, you have to rework several times.

3. Old roles can still be used enhanced (manually) with new authorizations using S_RS_AUTH. The new authorizations must be created in the new authorization framework (transaction RSECADMIN).

My recommendation: Migrate once and then make adjustments in the new authorizations. Especially if the migration doesn't fulfill your requirements 100% you probably generate more work trying to stay with the old concept.

REgards, Klaus

Former Member
0 Kudos

Hi Klaus,

finally based on your recommendation:

Migration once done via creation of new profiles or by extending existing ones?

What should be done if the new authoriyations (e.g. RSR_00006904) has to be maintained again (adding a Company Code for example)?

cheers

Oliver

klaus_werner
Active Participant
0 Kudos

Hi Oliver,

extending existing ones doesn't make much sense when using roles. Rather create new ones and if you want to use the old roles include authorization from new profiles in the roles. If you have to maintain them, just maintain them (add company code) or is there an issue with adjusting them (doesn't the system allow you to do so)?

Regards, Klaus

Former Member
0 Kudos

Thanks again Klaus.

To make it clear:

Old concept:

Reporting auth. object ABC:

Company Code: A1, B1

Sales Office: 1, 2, 3

After my migration (generate new profile) the Profile RSR_00006904 (Migration Reporting Auth. from Profile BCCADEAB02)

Step 1:

Create manually S_RS_AUTH in Single Role and add RSR_00006904.

Now the User should be able to report propperly.

From my understanding the upgraded system is now just checking S_RS_AUTH and not the the old report auth. obj ABC.

If the customer wants now to add a Company Code, what has to be changed now? The old object?

thanks in advance

Oliver

klaus_werner
Active Participant
0 Kudos

You have to change the new authorization RSR* or whatever the name is in transaction RSECADMIN.

Regards, Klaus

Former Member
0 Kudos

thanks again Klaus, I am unfortunately not able to give you points?

I will simulate this solution, now.

Last question:

Which SP should be installed ?

SP7 or SP8 ?

cheers

Oliver

Message was edited by: Oliver Huss

klaus_werner
Active Participant
0 Kudos

Definitely 8 for last auths updates. Regards, Klaus

Answers (1)

Answers (1)

Former Member
0 Kudos

there is a chance to change the old roles .But both concepts in parallel won't work.