| Table | Description |
| USR02 | Users Data (logon data) |
| USR04 | User master authorization (one row per user) |
| UST04 | User profiles (multiple rows per user) |
| USR10 | Authorisation profiles (i.e. &_SAP_ALL) |
| UST10C | Composit profiles (i.e. profile has sub profile) |
| USR11 | Text for authorisation profiles |
| USR12 | Authorisation values |
| USR13 | Short text for authorisation |
| USR40 | Tabl for illegal passwords |
| USGRP | User groups |
| USGRPT | Text table for USGRP |
| USH02 | Change history for logon data |
| USR01 | User Master (runtime data) |
| USER_ADDR | Address Data for users |
| AGR_1016 | Role and Profile |
| AGR_1016B | Role and Profile |
| AGR_1250 | Role and Authorization data |
| AGR_1251 | Role Object, Authorization, Field and Value |
| AGR_1252 | Organizational elements for authorizations |
| AGR_AGRS | Roles in Composite Roles |
| AGR_DEFINE | To See All Roles (Role definition) |
| AGR_HIER2 | Menu structure information - Customer vers |
| AGR_HIERT | Role menu texts |
| AGR_OBJ | Assignment of Menu Nodes to Role |
| AGR_PROF | Profile name for role |
| AGR_TCDTXT | Assignment of roles to Tcodes |
| AGR_TEXTS | File Structure for Hierarchical Menu - Cus |
| AGR_TIME | Time Stamp for Role: Including profile |
| AGR_USERS | Assignment of roles to users |
| USOBT | Relation transaction to authorization object (SAP) |
| USOBT_C | Relation Transaction to Auth. Object (Customer) |
| USOBX | Check table for table USOBT |
| USOBXFLAGS | Temporary table for storing USOBX/T* chang |
| USOBX_C | Check Table for Table USOBT_C |
| TSTCA | Transaction Code, Object, Field and Value |
Thursday, June 20, 2013
SAP Security Tables
SAP Reports
| SAP Security Report Name | Description | |
| RSUSR_SYSINFO_ROLE (YOU NEED TO LOG ON TO THE CENTRAL SYSTEM FOR THIS) | Report cross-systm information/role STANDARD SELECTION, User name, Receiving system, SELECT ROLE Role | |
| RSUSR_SYSINFO_PROFILE (YOU NEED TO LOG ON TO THE CENTRAL SYSTEM FOR THIS) | Report cross-systm information/profile STANDARD CRITERIA User Name, Receiving system, Profile | |
| RSUSRSUIM | Same as SUIM User Information System | |
| RSUSR402 | Download user data for CA manager from Secude | |
| RSUSR300 | Set External Security Name for all Users | |
| RSUSR200 | List of Users According to Logon Date and Password Change | |
| RSUSR102 | Change Documents for Authorizations | |
| RSUSR000 | Currently Active Users Tcodes SU04 and AL08 | |
| RSUSR002 | Users by Complex Selection Criteria (search by User, Group, User Group, Reference User, User ID Alias, Role, Profile Name, Tcode, SELECTION BY FIELD NAME, Field Name, SELECTION BY AUTHORIZATIONS Authorizatrion Object, Authorization, SELECTION BY VALUES, Authorization Object 1, AND Authorization Object 2, AND Authorization Object3, ADDITIONAL SELECTION CRITERIA, Account number, Start Menu, Output Device, Valid Until, Locked Users ONLY, Unlocked Users Only, CATT Check ID | |
| RSUSR002_ADDRESS | Select User According to Address, NAMES, First Name, Last Name, User, COMMUNICATION PATHS, Company, City, Buildings, Room, Extension, OTHER DATA, Department, Cost Center | |
| RSUSR003 | Check the Passwords of Users SAP* and DDIC in All Clients (SAP* DDIC SAPCPIC ) | |
| RSUSR004 | Restrict User Values to the following Simple Profiles and Auth Objs SELECTION CRITERIA Single Profiles, Authorization Objs | |
| RSUSR005 | List of Users with Critical Authorizations (SAME AS RSUSR009 but difference is here you can't chose) | |
| RSUSR006 | List of Users According to Logon Date and Password Change | |
| RSUSR007 | List Users Whose Address Data is Incomplete (here give the Required Address Data) | |
| RSUSR008 | Critical Combinations of Authorizations at Transaction Start (Can view either Critical Combinations or Users) | |
| RSUSR009 | List of User with Critical Authorizations SAME AS RSUSR005 but here you can (Check using either customer data of Check using SAP data) | |
| RSUSR010 | Transaction for User with Profile or Authorization (Transaction executable either by, User, with Role, Profile, Authorization | |
| RSUSR011 | Lists of transactions after selection by User, profile or obj SELECTION FOR User | |
| RSUSR012 | Search authorizations, profiles and users with specified object value (DISPLAY authorization objects, DISPLAY authorizations, DISPLAY profiles, DISPLAY users) | |
| RSUSR020 | Profiles by Complex Criteria SELECTION CRITERIA Profile, Profile test, ADDITIONAL CRITERIA FOR PROFILES, Composite Profile, Single Profile, Generated Profiles, SELECTION BY CONTAINED PROFILES Profile, SELECTION BY AUTHORIZATIONS, Authorization Object, Authorization, SELECTION BY VALUES, Auth obj, auth obj2, auth obj3, SELECTION BY ROLE | |
| RSUSR030 | Authorizations by Complex Selection Criteria SELECTION CRITERIA, Auth Object, Authorization, BY VALUES | |
| RSUSR040 | Authorization Objects by Complex Criteria, STANDARD SELECTIONS, Authorization object, ADDITIONAL CRITERIA Object class, Obj class text, Field | |
| RSUSR050 | COMPARISIONS, Compare Users, USER A ------ USER B--------, ROLES, PROFILES< AUTHORIZATIONS, Across Systems | |
| RSUSR070 | Roles by Complex Selection Criteria STANDARD SELECTION Role, Description, SELECTION BY USER Assignments | |
| RSUSR100 | Change Documents for Users | |
| RSUSR101 | Change Document for Profiles |
SAP User Guid
User
management
The
user concept is one of the basic parts of R/3 security.
One
of the first steps after the installation of R/3 and creating a client is to
create users in the new client.
Users
are client-dependent i.e. a user in one client may not be a user in another
client.
They
are valid only for the clients in which they are created or assigned.
The
users name and the user attributes comprise the User Master Record.
A
User Master Record consists of the following information:
User Name
Assigned Client
Password (which can be
changed)
Company Address
User Type
Start Menu
Logon Language
Personal Printer
Settings
Time Zone
Activity Group
Authorizations
Expiration Date
Default Parameter
settings
Some
of the information such Company Address, Start Menu, Logon language, Printer
settings etc is optional and need not be specified.
SAP
comes with certain super users SAP* and DDIC. These two users are available for
every client in the R/3 system. By default, they are made available to every
new client that is created.
SAP*
has all the authorization whereas DDIC is authorized to administer the R/3
repository.
They
are excluded from doing any development work in the R/3 system.
1
You
can create a user by following the path
Toolsà Administration àUser MaintenanceàUsers
Alternatively
you can use the transaction code SU01
Enter
the user name and click on the Create button on the application toolbar
By
default you will be in the Address element of the User Master Record. Enter the
Name,Address etc.
Click
on the Logon Data tab to enter the logon properties.
Here
you can specify
1.
The initial password for the user. The system will prompt the user to change
the password at first Logon.
2.
User Group: User groups give an indication of activity areas and
authorizations.
3. Validity period for the user
4.
User Type. It determines the type of tasks that a user can do.
There
are 5 types of users: Dialog, Communication, System, Service, and Reference
Click on the default tab and enter the
following details.
Enter
the start menu if your company have predefined menu for the users or leave it
blank.
Enter
Log on language as your wish. It will allow the user logon to their language.
Then
next give the details of your output device ie Spool device of the user site.
Normally spool devices will be uploaded by the basis team depending upon the
company policies.
Next
you can set the out put immediate option which enables to user print their
pages immediately rather than saving and print later.
Here
in the same screen we can set time zones, decimal notations, time format also..
Please
click on Parameter tab.
Enter
the parameter values if you provided by your functional teams.
Click
on the Roles tab.
Depending
upon the user request/ guidelines here roles can be assigned.
For
example…Accounts Payable/Security Admin.
Click
on floppy button to save your data.
Then userID will be saved.
User Mass Maintenance
You can use SU10 transaction to do the mass
maintenance.
Execute SU10 transaction.
If you wish to create mass userIDs then
enter userIDs in the column user and then click on create button.
Normally nobody will create userIDs using SU10 transaction
code instead of SU10 we can create userIDs using CATT script.
If you want to change userIDs then click on
pencil button then change mass users accordingly.
Please check check boxes against your
change fields…..
Monday, June 17, 2013
T-codes and Interview Questions
|
SAP Security
Interview Questions
|
A. Frequently used security T-codes
SU01
Create/ Change User SU01 Create/ Change User
PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User
SUIM Reports
ST01 Trace
SU53 Authorization analysis
PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User
SUIM Reports
ST01 Trace
SU53 Authorization analysis
R/3 Security Tcodes
End User
|
Q List few security Tables
R/3 Security Tables
R/3 Security Tables
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Q How to create users?
Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional. Click here for turotial on creating sap user id
Q What is the difference between USOBX_C and USOBT_C?
The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.
Q What authorization are required to create and maintain user
master records?
The following authorization objects are required to create and maintain user master records:
The following authorization objects are required to create and maintain user master records:
- S_USER_GRP: User Master Maintenance: Assign
user groups
- S_USER_PRO: User Master Maintenance: Assign
authorization profile
- S_USER_AUT: User Master Maintenance:
Create and maintain authorizations
1. Dialog users are used for
individual user. Check for expired/initial passwords Possible to change your
own password. Check for multiple dialog logon
2. A Service user - Only user
administrators can change the password. No check for expired/initial passwords.
Multiple logon permitted
3. System users are not capable of
interaction and are used to perform certain system activities, such as
background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System
user, a general, non-personally related, user. Additional authorizations can be
assigned within the system using a reference user. A reference user for additional
rights can be assigned for every user in the Roles
tab.
- Derived roles refer to roles that already
exist. The derived roles inherit the menu structure and the functions
included (transactions, reports, Web links, and so on) from the role
referenced. A role can only inherit menus and functions if no transaction
codes have been assigned to it before.
- The higher-level role passes on its
authorizations to the derived role as default values which can be changed
afterwards. Organizational level definitions are not passed on. They must
be created anew in the inheriting role. User assignments are not passed on
either.
- Derived roles are an elegant way of maintaining
roles that do not differ in their functionality (identical menus and
identical transactions) but have different characteristics with regard to
the organizational level. Follow
this link for more info
Q What is a composite role?
- A composite role is a container which can
collect several different roles. For reasons of clarity, it does not make
sense and is therefore not allowed to add composite roles to composite
roles. Composite roles are also called roles.
- Composite roles do not contain authorization
data. If you want to change the authorizations (that are represented by a
composite role), you must maintain the data for each role of the composite
role.
- Creating composite roles makes sense if some of
your employees need authorizations from several roles. Instead of adding
each user separately to each role required, you can set up a composite
role and assign the users to that group.
- The users assigned to a composite role are
automatically assigned to the corresponding (elementary) roles during
comparison.
o
The menu tree of a composite role is, in the simplest case, a
combination of the menus of the roles contained. When you create a new
composite role, the initial menu tree is empty at first. You can set up the
menu tree by choosing Read menu to
add the menus of all roles included. This merging may lead to certain menu
items being listed more than once. For example, a transaction or path contained
in role 1 and role 2
would appear twice.
o
If the set of roles contained in a composite role changes, the
menu tree is also affected. In such a case, you can completely rebuild the menu
tree or process only the changes. If you choose the latter option, the Profile
Generator removes all items from the menu which are not contained in any of the
roles referenced.
o
It is possible (and often necessary) to change the menu of a
composite role at any time. You adjust these menus in the same way as the menus
for roles (see above).
A.
Q. What are the different tabs in PFCG?
A.
If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a daily.
Q. Can we convert Authorization field to Org, field
A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATE
Use SE38 or SA38 to run the above report.
- Organizational level fields should only be
created before you start setting up your system. If you create
organizational level fields later, you might have to do an impact
analysis. The authentication data may have to be postprocessed in roles.
- The fields "Activity",
"ACTVT" and "Transaction code", "TCD" cannot
be converted into an organizational level field.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.
Q. How many profiles can be assigned to any user master record.
A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This table contains both information on the change status of a user and also the list of the profile names that were assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since the first two characters are intended for the change flag, 3748 characters remain for the list of the profile names per user. Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312 profiles per user.
Q. Can you add a composite role to another composite role?
A. No
Q. How to reset SAP* password from oracle database.
A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;
Where mandt is the client.
Now you can login to the client using sap* and password pass
Q. What is difference between role and profile.
A. A role act as container that collect transaction and generates the associated profile. The profile generator (PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should be done using PFCG.
Q. What is user buffer?
A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
A user would fail an authorization check if:
- The authorization object does not exist in the
user buffer
- The values checked by the application are not
assigned to the authorization object in the user buffer
- The user buffer contains too many entries and
has overflowed. The number of entries in the user buffer can be controlled
using the system profile parameter auth/number_in_userbuffer.
A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
You can also get this information directly from table, if you have access to SE16 or SE16N. Execute SE16N
Table AGR_1251
Object S_TCODE
VALUE (low) SU01
Q. How to find out all the users who got SU01 ?
A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table AGR_AGRS
Composite roles You can put multiple composite roles using the more button
Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table AGR_DEFINE
Use either agr_name field or Parent_agr field.
Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table AGR_1252
Role Type in the role here and hit execute.
You can always download all the information to spreadsheet also using .
Q. How do I restrict access to files through AL11?
A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization for S_DATASET as mentioned below
Activity 33
Physical file name /tmp/*
Program Name with Search Help *
Q. How can I add one role to many users?
A. SU10. If you have less than 16 users then you can paste the userids.
If you have more than 16 users – Click on Authorization data and click on next to users and upload from clipboard
.Hit the change button and go to the role tab and add the roles to be assigned and hit save.
Q. What are the Best practices for locking expired users?
A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.
Q. How can be the password rules enforced ?
A. Password rules can be enforced using profile parameter. Learn more about the profile parameter:
Profile Parameters for
Logon
|
|
To make
the parameters globally effective in an SAP System (system profile
parameters), set them in the default system profile DEFAULT.PFL. However, to
make them instance-specific, you must set them in the profiles of each
application server in your SAP System. To display the documentation for one of the parameters, choose Tools >> CCMS>> Configuration >> Profile Maintenance (transaction RZ10), specify the parameter name and choose Display. Password Checks
|
Q. How to remove duplicate roles with different start and end date from user master?
A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 865841 for more info.
Q. How come the users have authorization in PFCG, but user still complains with no authorization?
A. Make sure the user master is compared. May be the there is a user buffer overflow
Also check the profile- Follow the instruction below.
SUIM > User by complex criteria.
Put the userid of user who is having issue.
Execute
Double click on the user id and expand the tree. Select the profile in question and see if the authorization is correct or not. If not do the role reorg in PFCG and see if that helps.
Q. How can I have a display all roles.
A. Copy sap_all and open the role and change the activity to 03 and 08
Q. How can I find out all actvt in sap?
A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the valid activities for each authorization object can be found in table TACTZ (transaction SE16).
Q. How to find all the users who got access to change and create users?
A. You can find all users who have access to create or change users using SUIM
Execute Transaction SUIM
Go to - Users by Complex Selection Criteria >>Users by Complex Selection Criteria or you could run report RSUSR002 using SA38 or SE38
Fill in the screen as shown below, and execute the query. There are couple of other authorization ( S_USER_AGR, S_USER_GRP and S_USER_PRO) you might want to check as well.
On the other hand you could just give the user SU01D, which is display user master.
Q. What is SAP?
A. SAP is the name of the company founded in 1972 under the German name (Systems, Applications, and Products in Data Processing) is the leading ERP (Enterprise Resource Planning) software package.
Q. Explain the concept of “Business Content” in SAP Business Information Warehouse?
A. Business Content is a pre-configured set of role and task-relevant information models based on consistent Metadata in the SAP Business Information Warehouse. Business Content provides selected roles within a company with the information they need to carry out their tasks. These information models essentially contain roles, workbooks, queries, InfoSources, InfoCubes, key figures, characteristics, update rules and extractors for SAP R/3, mySAP.com Business Applications and other selected applications.
Q. What is IDES?
A. International Demonstration and Education System. A sample application provided for faster learning and implementation.
Q. What is SAP R/3?
A. A third generation set of highly integrated software modules that performs common business function based on multinational leading practice. Takes care of any enterprise however diverse in operation, spread over the world. In R/3 system all the three servers like presentation, application server and database server are located at different system.
Q. What are presentation, application and database servers in SAP R/3?
A. The application layer of an R/3 System is made up of the application servers and the message server. Application programs in an R/3 System are run on application servers. The application servers communicate with the presentation components, the database, and also with each other, using the message server. All the data are stored in a centralized server. This server is called database server.
Q. What should be the approach for writing a BDC program?
A. Convert the legacy system data to a flat file and convert flat file into internal table. Transfer the flat file into sap system called “sap data transfer”. Call transaction(Write the program explicitly) or create sessions (sessions are created and processed ,if success data will transfer).
Q. What are the major benefits of reporting with BW over R/3?
Q. Would it be sufficient just to Web-enable R/3 Reports?
A. Performance — Heavy reporting along with regular OLTP transactions can produce a lot of load both on the R/3 and the database (cpu, memory, disks, etc). Just take a look at the load put on your system during a month end, quarter end, or year-end — now imagine that occurring even more frequently. Data analysis — BW uses a Data Warehouse and OLAP concepts for storing and analyzing data, where R/3 was designed for transaction processing. With a lot of work you can get the same analysis out of R/3 but most likely would be easier from a BW.
Q. What is the difference between OLAP and Data Mining?
A. OLAP - On line Analytical processing is a reporting tool configured to understand your database schema, composition facts and dimensions. By simple point-n-clicking, a user can run any number of canned or user-designed reports without having to know anything of SQL or the schema. Because of that prior configuration, the OLAP engine “builds” and executes the appropriate SQL. Mining is to build the application to specifically look at detailed analyses, often algorithmic; even more often misappropriate called “reporting.
Q. What is “Extended Star Schema” and how did it emerge?
A. The Star Schema consists of the Dimension Tables and the Fact Table. The Master Data related tables are kept in separate tables, which has reference to the characteristics in the dimension table(s). These separate tables for master data is termed as the Extended Star Schema.
Q. Define
A. Meta Data: Data that describes the structure of data or MetaObjects is called Metadata. In other words data about data is known as Meta Data. Master Data: Master data is data that remains unchanged over a long period of time. It contains information that is always needed in the same way. Characteristics can bear master data in BW. With master data you are dealing with attributes, texts or hierarchies. Transaction data: Data relating to the day-to-day transactions is the Transaction data.
Q. What is Bex?
A. Bex stands for Business Explorer. Bex enables end user to locate reports, view reports, analyze information and can execute queries. The queries in workbook can be saved to there respective roles in the Bex browser. Bex has the following components: Bex Browser, Bex analyzer, Bex Map, Bex Web.
Q. What are variables?
A. Variables are parameters of a query that are set in the parameter query definition and are not filled with values until the queries are inserted into workbooks. There are different types of variables which are used in different application: Characteristics variables, Hierarchies and hierarchy node, Texts, Formulas, Processing types, User entry/Default type, Replacement Path.
Q. What is AWB?. What is its purpose?
A. AWB stands for Administrator WorkBench. AWB is a tool for controlling, monitoring and maintaining all the processes connected with data staging and processing in the business information warehousing.
Q. What is the significance of ODS in BIW?
A. An ODS Object serves to store consolidated and debugged transaction data on a document level (atomic level). It describes a consolidated dataset from one or more InfoSources. This dataset can be analyzed with a BEx Query or InfoSet Query. The data of an ODS Object can be updated with a delta update into InfoCubes and/or other ODS Objects in the same system or across systems. In contrast to multi-dimensional data storage with InfoCubes, the data in ODS Objects is stored in transparent, flat database tables.
Q. What is Extractor?
A. Extractors is a data retrieval mechanisms in the SAP source system. Which can fill the extract structure of a data source with the data from the SAP source system datasets. The extractor may be able to supply data to more fields than exist in the extract structure.
Q. How do I change the name of master / parent role keeping the name of derived/child role same? I would like to keep the name of derived /child role same and also the profile associated with the child roles.
A. First copy the master role using PFCG to a role with new name you wish to have. Then you have to generate the role. Now open each derived role and delete the menu. Once the menus are removed it will let you put new inheritance. You can put the name of the new master role you created. This will help you keep the same derived role name and also the same profile name. Once the new roles are done you can transport it. The transport automatically includes the Parent roles.
What is the difference between C (Check) and U (Unmaintained)?
A. Background:
When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.
In USOBX_C there are 4 Check Indicators.
· CM (Check/Maintain)
- An authority check is carried out against this object.
- The PG creates an authorization for this object and field values are displayed for changing.
- Default values for this authorization can be maintained.
· C (Check)
- An authority check is carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
· N (No check)
- The authority check against this object is disabled.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
·U (Unmaintained)
- No check indicator is set.
- An authority check is always carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization..
Q. What does user compare do?
A. Comparing the user master: This is basically updating profile information into user master record. So that users are allowed to execute the transactions contained in the menu tree of their roles, their user master record must contain the profile for the corresponding roles.
You can start the user compare process from within the Profile Generator (User tab and User compare pushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered into the user master record. Never enter generated profiles directly into the user master record (using transaction SU01, for example)! During the automatic user compare process (with report pfcg_time_dependency, for example), generated profiles are removed from the user masters if they do not belong to the roles that are assigned to the user.
If you assign roles to users for a limited period of time only, you must perform a comparison at the beginning and at the end of the validity period. You are recommended to schedule the background job pfcg_time_dependency in such cases
Q. Can wildcards be used in authorizations?
A. Authorization values may contain wildcards; however, the system ignores everything after the wildcard. Therefore, A*B is the same as A*.
Q. What does the PFCG_TIME_DEPENDENCY clean up?
A. The 'PFCG_TIME_DEPENDENCY' background report only cleans up the profiles (that is, it does not clean up the roles in the system). Alternatively, you may use transaction 'PFUD'.
Q. What happens to change documents when they are transported to the production system?
A. Change documents cannot be displayed in transaction 'SUIM' after they are transported to the production system because we do not have the 'befor input' method for the transport. This means that if changes are made, the 'USR10' table is filled with the current values and writes the old values to the 'USH10' table beforehand. The difference between both tables is then calculated and the value for the change documents is determined as a result. However, this does not work when change documents are transported to the production system. The 'USR10' table is automatically filled with the current values for the transport and there is no option for filling the 'USH10' table in advance (for the history) because we do not have a 'befor input' method to fill the 'USH10' table in advance for the transport.
Q. What is the difference between the table buffer and the user buffer?
A. The table buffers are in the shared memory. Buffering the tables increases performance when accessing the data records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a buffer from which the data of a user master record is loaded when the user logs on. The user buffer has different setting options with regard to the 'auth/new_buffering' parameter.
Q. What does the Profile Generator do?
A. The Profile Generator creates roles. It is important that suitable user roles, and not profiles, are entered manually in transaction 'SU01'. The system should enter the profiles for this user automatically.
Q. How many authorizations fit into a profile?
A. A maximum of 150 authorization fit into a profile. If the number of authorizations exceed this marker, the Profile Generator will automatically create more profiles for the role. A profile name consists of twelve (12) characters and the first ten (10) may be changed when generated for the first time.
Q. What authorization objects are needed for PFCG?
A. Authorization object for Transport and PFCG
SAP Transport Authorization
To release Task
S_TRANSPRT
ACTVT=43, 03, 75
TTYPE=TASK
Other type:CLCP Client Transports
CUST Customizing Requests
DTRA Workbench Requests
MOVE Relocation transports
PATC Preliminary Corrections and Deliveries
PIEC Piece lists
TASK Tasks
TRAN Transport of copies
S_DATASET
PROGRAM=SAPLSTRF, SAPLSLOG
ACTVT=34
FILENAME=*
To release Customizing Requests
S_TRANSPRT
TTYPE=CUST
ACTVT=43, 03, 75
S_DATASET
PROGRAM=SAPLSCTS_RELEASE, SAPLSLOG, SAPLSTRF
ACTVT=33, 34
FILENAME=*
S_RFC
FC_TYPE=FUGR
RFC_NAME=STPA
ACTVT=16;
Authorization object needed for PFCG access
S_USER_AGR
ACT_GROUP= * (You can restrict by role, if proper naming convention is used)
ACTVT=01, 02, 03, 64 other fields below
01 Create or Generate
02 Change
03 Display
06 Delete
08 Display change documents
21 Transport
22 Enter, Include, Assign
36 Extended maintenance
59 Distribute
64 Generate
68 Model
78 Assign
79 Assign Role to Composite Role
DL Download
UL Upload
S_USER_GRP
CLASS=
ACTVT=22; 03
Other activity
01 Create or Generate
02 Change
03 Display
05 Lock
06 Delete
08 Display change documents
22 Enter, Include, Assign
24 Archive
68 Model
78 Assign
S_USER_TCD
TCD= * (Transaction in role)
S_USER_PRO
PROFILE= *
ACTVT=01, 06
Other activity
01 Create or Generate
02 Change
03 Display
06 Delete
07 Activate, generate
08 Display change documents
22 Enter, Include, Assign
24 Archive
S_TCODE
TCD=PFCG;
Dialog user 'A'
Individual system access (personalized)
- Logon with SAPGUI is possible. The user is
therefore interaction-capable with the SAPGUI.
- Expired or initial passwords are checked.
- Users have the option of changing their own
passwords.
- Multiple logon is checked.
Usage: For individual human users (also Internet users)
System user 'B'
System-dependent and system-internal operations
System-dependent and system-internal operations
- Logon with SAPGUI is not possible. The user is
therefore not interaction-capable with the SAPGUI.
- The passwords are not subject to to the
password change requirement, that is, they cannot be initial or expired.
- Only an administrator user can change the
password.
- Multiple logon is permitted.
Usage: Internal RFC, background processing, external RFC (for example, ALE, workflow, TMS, CUA)
Communication user 'C'
Individual system access (personalized)
Individual system access (personalized)
- Logon with SAPGUI is not possible. The user is
therefore not interaction-capable with the SAPGUI.
- Expired or initial passwords are checked but
the conversion of the password change requirement that applies in
principle to all users depends on the caller (interactive/not
interactive). (*)
- Users have the option of changing their own
passwords.
Usage: external RFC (individual human users)
Service user 'S'
Shared system access (anonymous)
Shared system access (anonymous)
- Logon with SAPGUI is possible. The user is
therefore interaction-capable with the SAPGUI.
- The passwords are not subject to the password
change requirement, that is, they cannot be initial or expired.
- Only a user administrator can change the
password.
- Multiple logon is permitted.
Usage: Anonymous system access (for example, public Web services)
Reference user 'L'
Authorization enhancement
Authorization enhancement
- No logon possible.
- Reference users are used for authorization
assignment to other users.
Usage: Internet users with identical authorizations
Remarks:
(*) With all
non-interactive system accesses (that is, not using the SAPGUI), the password
change rule (which exists for all users except for system and service users
when passwords are initial or have expired) is not enforced by the system if
there is no interaction option. However, provided that you can execute a
password update dialog with the user (=> middleware, such as SAP ITS, for
example,), RFC client programs should recognize the need to change a password
and initiate the subsequent password change by calling special function modules
(=> see note 145715) or RFC-API functions (as of 4.6C).The user interaction (including handling error and exceptional situations) is provided here with the middleware (= RFC client).
SAP Security – SUIM
You can find
all users who have access to create or change users using SUIM Execute Transaction SUIM
Go to - Users by Complex Selection Criteria >>Users by Complex Selection Criteria or you could run report RSUSR002 using SA38 or SE38
Fill in the screen as shown below, and execute the query. There are couple of other authorization ( S_USER_AGR, S_USER_GRP and S_USER_PRO) you might want to check as well.
On the other hand you could just give the user SU01D, which is display user master.
Administrator Workbench 
Purpose
The Administrator Workbench for SAP BW (transaction RSA1), abbreviated as
AWB is the main tool for tasks in the data warehousing process. It provides
data modeling functions as well as functions for control, monitoring and
maintenance of all processes in SAP BW having to do with data procurement, data
retention, and data processing.
Functions
Function
areas of AWB
|
Function area
|
You can find documentation
under
|
|
Modeling
|
|
|
Monitoring
|
|
|
Reporting Agent
|
|
|
Transport connection
|
|
|
Documents
|
|
|
Business Content
|
|
|
Translation
|
|
|
Metadata Repository
|
Structure of the
Administrator Workbench
The following graphic shows the structure of the Administrator Workbench:
Navigation window with function areas of the AWB
When you call the Administrator Workbench, a navigation window appears on
the left of the screen. You can open the individual function areas of the
Administrator Workbench with the application toolbar in the navigation window.
Then the functions and views available in these areas are displayed in the
navigation window.
Functions or views of the individual function areas
With one click you can call up the functions and views on the right-hand
area of the screen. Pushbuttons that refer to certain functions or views are
displayed on the right-hand area of the screen.
Application toolbar
The application toolbar of the Administrator Workbench includes a
pushbutton for hiding and showing the navigation menu, pushbuttons for
frequently used functions, and pushbuttons that are relevant in the context of
the individual areas.
Menu bar
The possible function calls with the menu bar of the Administrator
Workbench are independent of the function areas.
For some function areas, you can make various Settings in the Administrator Workbench.
Status bar
The status bar shows information, warnings and error messages.
Settings in the Administrator
Workbench Use
Initial View
Here you can select the object tree that is to start the Administrator Workbench Modeling.
Changing Variants
The variants provide a display filter for the InfoPackages and InfoPackage groups. You can change the variants for the Scheduler here.
Selecting Display Options
Here you define the objects that you want to display in the object trees of the Administrator Workbench.
Display Selections for PSA Tree
You can set the requests that you want to display in the PSA tree of the Administrator Workbench.
Displaying Generated ODS Objects
Here you can set which generated ODS Objects you want to hide/show.
Setting Up Drag & Drop Behavior
In the InfoProvider, InfoSource and InfoObject trees, you can move objects to beneath the root nodes, application components and InfoAreas using drag and drop. To move an object, select it with the left mouse button and drag it, keeping the mouse button down, to the object under which you want it positioned. This function makes it easier to manage the objects in BW.
On the first tree level, you can move InfoAreas or application components in the InfoProvider and InfoObject trees. By choosing Settings à Set Drag & Drop Behavior, you can determine in the Administrator Workbench whether you want these objects to be positioned at the same level or under one another. You can move only InfoAreas and application components to the same level.
In the InfoSource tree, you can place InfoSources between application components. You can move InfoObject catalogs in the InfoObject tree, and move InfoProviders between InfoAreas in the InfoProvider tree.
Objects under InfoAreas and application components are sorted in alphabetical order. It is no longer possible to move objects on this level.
You cannot move any objects in the PSA tree because it has the same structure as the InfoSource tree. Neither can you move objects in the source system tree because its structure is based on the InfoSource tree.
Subscribe to:
Posts (Atom)