ABAP Reports and SAP Query

Question

Hi Experts,
I have question regarding ABAP Reports, SAP Query, and Transaction with variant.  How are we securing one the above reports that we assign them through pfcg.  We can secure custom program by custom transaction or define the auth group in S_PROGRAM auth object but in this case we have to assign SA38 in production. is that correct?
Please help me understand difference between the ABAP reports and SAP query. Is the ABAP reports same as Program or they are different.
Thanks in advance
Faisal
Edited by: Faisal on Jun 30, 2009 11:06 PM

Answer 1

Hi,
1) End user security (role matrix coordinate with process team)
This role Matrix design is most important where we can put restrictions and use SoD.
2) Secure Table (by auth group)
Table TDDAT and use of transaction se54 for security tables to right auth Groups. Secure s_tabu_dis, s_tabu_cli.
3) Secure program (as you said ABAP reports are referred to Program)
Use of table TPGP and program RSCSAUTH for assignment of groups to Program. SA38 Running of SA38 requires a minimum SUBMIT in user Action. A user having SA38 is dangerous as he/she is now enabled to run any report. Hence protection in Auth Group is needed. Verify each and every program is having authority check statement and Auth Group or not before assigning sa38. As you mentioned its best to avoid SA38 and create CUSTOM TXN for each report.
(We should also SECURE S_DEVELOP in Production properly along with ur points. Please Note).
4) Secure some batch jobs roles for batch job
Secure by s_btch* objects and less access to se36.
5) Create support roles for cutover activity during Go-live
That is always needed. Go ahead.
6) Emergency roles & IT roles for support
This is very much needed as a role of Mitigation and Fire Fighting for Temporary access. Ensure to enable ur audit parameters in RZ10 (rsau* sm20,RSLG* for sm21). Give emergency access but enable audit via sm19 and get audit reports from sm20 and sm21 immediately after the use of emergency access.
There are also other auth objects we need to be care ful which is a long list and hope every body ensures that (s_cts,a_admi,s_trans, tables ssm_cust, prgn,t000) etc and a host of others. Besh wishes. Let us know if any issue.
Regards
Aveek.