SAP Authorizations THE "TOP SEVEN" - SAP Admin

Direkt zum Seiteninhalt
THE "TOP SEVEN"
Schedule PFUD transaction on a regular basis
Finally, you can extend your implementation of the BAdIs BADI_IDENTITY_SU01_CREATE and pre-enter additional fields of the transaction SU01. To do this, complete the appropriate SET_* methods of the IF_IDENTITY interface. For example, it is possible to assign parameters that should be maintained for all users, assign a company, or assign an SNC name.

If you still have problems with the performance of the evaluation, despite the regular archiving and indexing of the modification documents of your user and permission management, this is probably due to the amount of central change documents. In this case, you also need an archiving concept for other key change document data. SAPHinweis 1257133 describes the procedure for creating such a concept.
Know why which user has which SAP authorization
You can use authorization objects to restrict access to tables or their content through transactions, such as SE16 or SM30. The S_TABU_DIS authorization object allows you to grant access to tables associated with specific table permission groups. You can view, maintain, and assign table permission groups in transaction SE54 (see Tip 55, "Maintain table permission groups"). For example, if an administrator should have access to user management tables, check the permission status using the SE54 transaction. You will notice that all the user management tables are assigned to the SC table permission group.

Running the system trace for permissions gradually for each application server is tedious. We will show you how to record permission checks on multiple servers at the same time. If you want to use the System Trace for permissions in a system with multiple application servers, you should note that the Trace can only log and evaluate data per application server at any time. Therefore, if a permission error occurs, permission administrators must first check which application server the user is logged on to with the permission issue and then start the trace on that application server. We give you a guide to record permissions checks on certain application servers, but we also show you a way to use this feature centrally.

The possibility of assigning authorizations during the go-live can be additionally secured by using "Shortcut for SAP systems".

Some useful tips about SAP basis can be found on www.sap-corner.de.


It is important to ensure that all relevant components (tile component and target assignment component(s)) are always stored in the catalog.

To store all the information on the subject of SAP - and others - in a knowledge database, Scribble Papers is suitable.


These are known as critical authorizations.
Zurück zum Seiteninhalt