SAP Authorizations Lack of know-how - SAP Admin

Direkt zum Seiteninhalt
Lack of know-how
Ensuring secure administration
Always make sure you use the latest version of the Note Assistant. To do this, look for SAP hints about the BC-UPG-NA component in the system recommendations. We also recommend that you perform the security patch process as part of a release or support package upgrade to avoid additional testing by security advisories already released at the time of the upgrade.

As part of the SAP Access Control solution, the Business Role Management component serves the central role management. In addition to other useful functions, it also offers the automation of mass maintenance of role withdrawals. To do this, you must first place the organisational matrix in the customising (transaction SPRO), i.e. you enter the values or value ranges in the Organisation Level Mapping details area for the different organisation fields. At this point, however, you do not specify which reference roles should be derived for these organisational values.
Concept for in-house developments
If you have defined the roles to the extent that the essential processes are depicted, then you will technically check which organisational features they contain (organisational levels, but also cost centres, organisational units, etc.). You then compare the technical result with the result from the consideration of the structure organisation and the business role description. A likely result is that you do not have to use all technical organisational features for differentiation. A possible result is that you want to add fields such as the cost centre to the organisation level.

The RESPAREA field has a maintenance dialogue that allows you to enter areas of responsibility. The care dialogue is called as a building block and provides different tabs for input depending on the authorization object. Now, if you declare the RESPAREA field to be the organisation level, you must first set the display of the tabs for input in customising. To do this, you must add an entry to the KBEROBJ table that is independent of the client by using the SE16 transaction. In this entry, leave the first OBJECT field blank. The CURRENTOBJ field must be maintained because it defines the tab that will be displayed when the maintenance is called, i.e. the Default tab. If this field is blank, no startup image can be found and errors occur. The following fields determine the contents of the various tabs and should therefore also be maintained so that you can use RESPAREA as an organisational level. These are the OBJECT1 to OBJECT7 fields for the first to the seventh tab. In these seven fields, you define what values you can enter on the tabs.

Assigning a role for a limited period of time is done in seconds with "Shortcut for SAP systems" and allows you to quickly continue your go-live.

Understanding the structure and functioning of the system is especially important for IT administration. It is not for nothing that "SAP Basis Administrator" is a separate professional field. On the page www.sap-corner.de you will find useful information on this topic.


The better these values are maintained, the less effort is required to maintain the PFCG roles (see figure next page).

The freeware Scribble Papers is a "note box" in which all kinds of data can be stored. It takes in typed texts as well as graphics and entire documents. The data is then organised in folders and pages.


The authorizations represent instances of the generic authorization objects and are defined according to the employee's activities and responsibilities.
Zurück zum Seiteninhalt