Any ideas on restricting userID Role Assigment within the SAP Security Team

Hello,
I have gotten a request to look into restriction of assignment of roles to oneself within the company SAP Security Team. Thoughts I have come up with so far involve the use of UserID User Groups, Role Assignment Ranges, and forcing all role assignements for all userIDs through GRC-AC CUP for QA and Prod. Has anyone come up with a workable solution that is outside of these suggestions that they have put into practice?
Thanks in advance for your help!
John

Hi John,
There can be a manual control in place and individual should not assign role/s to himself / herself.
Otherwise, security team members can be assigned to a specific group (let say Security) and they shouldn't have access to authorization S_USER_GRP with ACTVT 22 & CLASS - Security.There should be a dedicated power user to assign the role/s to the security team members and this can be auditted (SM20 log for manual super user / FireFighter log for FireFighter user).
Thanks
Prasanna

Similar Messages

  • Any ideas on how to fix ipad after the new iOS 7 update? My battery will not charge, my ipad is hot to the touch, the iTunes Store won't open, and my messages on Facebook aren't showing up when I chat and pintrest won't pin to my boards.

    Any ideas on how to fix ipad after the new iOS 7 update? My battery will not charge, my ipad is hot to the touch, the iTunes Store won't open, and my messages on Facebook aren't showing up when I chat and pintrest won't pin to my boards.

    If you have all your music on the cmputer then i would connect up my phone uncheck the Sync Music option and apply.
    This should take all the music off your phone .Then you can resync the music back on to it.
    If this doesn't work maybe a restore to factory settings and start from scratch is the way to go

  • I'm getting a 9041 error when trying to convert files to AAC -- any ideas on how to fix it?  the files files in iTunes show up as Apple Lossless but i can't put them on my iPod

    i'm getting a 9041 error when trying to convert files to AAC -- any ideas on how to fix it?  the files files in iTunes show up as Apple Lossless but i can't put them on my iPod

    "I have been able to convert to AAC by first converting to AIFF  and then to AAC. This is a pan though."
    this worked for me.
    thanks.

  • In Indesign CS6 I export an artboard to  TIFF with the sdk's funtion SnapshotUtilsEx- ExportImageToTIFF(iStream) and, the resulting file is one pixel too large in the X, leaving a transparent strip on one edge. Any idea if there is a bug in the sdk?

    In Indesign CS6 I export an artboard to  TIFF with the sdk's funtion SnapshotUtilsEx->ExportImageToTIFF(iStream) and, the resulting file is one pixel too large in the X, leaving a transparent strip on one edge. Any idea if there is a bug in the sdk?

    An easy example to prove this bug of Indesing CS6:  I create a psd with Photoshop CS6, with width 505 pixels, height 317 pixels and a resolution of 300 pixels per inch. This psd is placed on a page in InDesign CS6. Then I try to export it as a tiff with the functions:
    fSnapshotUtilsEx->Draw(flags,fullResolutionGraphics,greekBelowPtSize,enableAntiAliasing,tr ansparencyQuality,abortCheck,pVPAttrMap,bDrawNonPrintingObjects);
    and
    SnapshotUtilsEx-> ExportImageToTIFF (iStream)
    The resulting tiff has a width of 506 pixels (one pixel more in width). It will happen the same if we start with a width of 507 pixels, etc.
    This error does not occur with Indesign CS5, nor Indesing CC.

  • The iBooks page on my iPad2 has locked. I cannot move on the page. I can close the page, and everything else is working fine. Does any one have any ideas for unlocking, resetting, or somehow getting the iBooks page to work? Thank you.

    The iBooks page on my iPad2 has locked. I cannot move on the page. I can close the page, and everything else is working fine. THis happened in the middle of a download. Does any one have any ideas for unlocking, resetting, or somehow getting the iBooks page to work? Thank you.

    Just re-set the App -
    Open the App
    Hold down the power button until the slider appears
    Hold down the home button (Don't use the slider) Until the App Closes
    You might lose your place, but shouldnt be too hard to find it again...

  • HELP!  I had iPhoto on my mac, for some reason it was not responding down loaded a new version but can't find my photos. any ideas please.  I thought once on the mac always on the mac.

    HELP!  I had iPhoto on my mac, for some reason it was not responding or damaged.   down loaded a new version but can't find my photos. any ideas please.  I thought once on the mac always on the mac.

    Sorry but we need details to help
    What version of the OS do you have? What has changed since iPhtoo worked?
    What exactly is the problem - you say "it was not responding" - You downloaded a new version (what version)" -you can't find yoru photos" none of which is helpful
    look in your applications folder - is there an Iphoto application there? If so get info and report the version
    Look in the picures folder - is there an iPhoto library there? If so exactly (including exact error messages) happens if you double click on it?
    what else can you tell us that might help us assist you?
    LN

  • HT204406 Itunes Match won't upload. I get error stating there was an error in the itunes store, please try again. I have tried again everyday for the last month and am still unable to use.  Any ideas on why Match can't complete the 1st step of the process

    Itunes Match won't upload. I get error stating there was an error in the itunes store, please try again. I have tried again everyday for the last month and am still unable to use.  Any ideas on why Match can't complete the 1st step of the process (Gathering information about your Itunes library)?

    JohnCullison wrote:
    For the last few weeks, the iTunes store has been displayed with empty graphic rectangles (with a blue box containing a white question mark centered in the rectangles), bits of text, and some buttons. The page extends quite a ways, including what I assume would be all the links to all the music...
    If all you are trying to do is buy music, you can easily buy MP3s at any online music download store (e.g. amazon.com) and add them to your iTunes library.

  • My daughter created a movie using iMovie, which she has worked on for a month, when trying to save it on a jump drive she was asked to "finalize" the movie...now there is no record of it at all. Any ideas how I could try and retrieve the file?

    My daughter created a movie using iMovie 11, which she has worked on for a month. When trying to save it on a jump drive she was asked to "finalize" the movie, and while this was running (quoted 13 hours!) she received an error message. Now there is no record of it at all, I have looked in trash etc. Any ideas how I could try and retrieve the file?

    The file cannot be reloaded in iMovie using File > Open Recent  ??
    There is no trace of the file in a Spotlight search?
    The project files are not under <user>/Movies/iMovie Projects ??
    Finalizing creates small, medium and large version of the finished video. It does take a long time, but it should not destroy your project files.
    Oh, and you really MUST have a backup of your files. You can expect to lose files if you have no other copies of them.

  • HT3207 My Energy Saver section of system preferences does not show the option to choose between energy saver or higher performance. I'd like to maximize my performance... any idea how to do that or why the option isn't hsowing up?

    My Energy Saver section of system preferences does not show the option to choose between energy saver or higher performance. I'd like to maximize my performance... any idea how to do that or why the option isn't showing up?

    Mac video card performance

  • I plugged in iPhone 5 charger to my MacBook Pro and it immediately shut down and I can't get it restarted. Any ideas how to do this without removing the battery?

    I plugged in iPhone 5 charger to my MacBook Pro and it immediately shut down and I can't get it restarted. Any ideas how to do this without removing the battery?

    If you have your MBP charger, try a SMC reset:
    http://support.apple.com/en-us/HT201295
    If no success, make an appointment at an Apple store genius bar.
    Ciao.

  • HT1725 Hi, I'm pretty new to itunes. I bought a song and it downloaded, but will only play the first 3 seconds? Any idea how I get it to play the rest of the tune?

    Hi, I'm pretty new to itunes. I bought a song and it downloaded, but will only play the first 3 seconds? Any idea how I get it to play the rest of the tune?

    I'd report the problem to the iTunes Store.
    Log in to the Store. Click on "Account" in your Quick Links. When you're in your Account information screen, go down to Purchase History and click "See all".
    Find the item that is not playing properly. If you can't see "Report a Problem" next to the entry, click the "Report a problem" button. Now click the "Report a Problem" link next to the item.
    (Not entirely sure what happens after you click that link, but fingers crossed it should be relatively straightforward.)

  • SAP Roles and Access for SAP Implementation team members

    Hi,
    Is it correct practice to give SAP_ALL role access for all SAP Implementation team members in Dev and QA?
    If not, what is the correct practice?
    Kindly let me know

    Madhu,
    It is NOT correct practice to give anyone SAP_ALL in any of the systems; not DEV, not QAS, and certainly not PRD. However, many implementation teams (and particularly consultants from SIs) insist that they cannot possibly do their jobs without it. This is completely incorrect as there are specific roles for them to use for that purpose. The only circumstance where it could be justified is if you require a special "firefighter" role - and even then, I would still be a bit doubtful.
    You should also consider that once you have given someone SAP_ALL, they will fight tooth and nail to keep it. It also means that they probably are not testing the user roles correctly. Most of those that insist they need it simply do not understand the security issues and probably don't care.
    Just think; if they have access to do soemthing that they shouldn't and then cause a big problem, are they the ones that will have to fix it or are they going to expect you to do it? If they expect you to clear up after them, then you have the right to insist on restricting their access to cause issues in the first place.
    But I know just how demanding they can be....
    Best of luck
    Tony

  • Interacrive forms within the SAP GUI

    Hello
    I want to work with interactive forms within the SAP GUI, with ABAP.
    I've managed to display a generated PDF in an ABAP screen, with CL_GUI_HTML_VIEWER, using the method LOAD_DATA. The problem now is getting the filled data out of the form. Is there any standard way of doing it? (getting the data without saving the file)
    I've thought of some ways, such as getting the filled file somehow as a binary file, or handling the document's Submit button, but I haven't managed to get any of them to work.
    Is there any way to make it work, or use the different PDF classes to do it..
    Thanks

    Hello
    I want to work with interactive forms within the SAP GUI, with ABAP.
    I've managed to display a generated PDF in an ABAP screen, with CL_GUI_HTML_VIEWER, using the method LOAD_DATA. The problem now is getting the filled data out of the form. Is there any standard way of doing it? (getting the data without saving the file)
    I've thought of some ways, such as getting the filled file somehow as a binary file, or handling the document's Submit button, but I haven't managed to get any of them to work.
    Is there any way to make it work, or use the different PDF classes to do it..
    Thanks

  • Workflows within the SAP environment

    Hello,
    for my diploma i'm evaluating the different workflow technologies within the sap environment. Therefor i set up a list with the different technologies and want to know if i'm missing something.
    1) ALE
    2) MDM Workflow
    3) Business Workflow aka Adhoc Workflow
        (CRM Workflow, SCM Workflow are synonym to the Business Workflow)
    4) SAP Webflow aka SAP Workflow
        (kind of a successor of Business Workflow)
    5) Guided Procedures
    6) Business Process Engine aka ccBPM
    Are these the most used Workflows within the SAP environment or is something missing?
    And what is the difference between <i>SAP Business Workflow</i> and <i>SAP Webflow</i>? Some source say these two are nearly the same, except the "web-capability" of Webflow...
    btw: Sorry for posting this question in the Coffee Corner but its a farreaching area and i dont know which other forum it would fit better...
    thx for replys
    Matthias

    Matthias -
    Please be assured that there was no irony or sarcasm intended - if you can complete the evaluation task that you have set for yourself, it will not only be a wonderful achievement but also something that I'm sure many here would want to read and comment on.
    The one thing to keep in mind - perhaps the most important thing - is that technological alternatives are never pursued rationally.  Rather, they are generally pursued for the worst of reasons - someone's opinion of where "the market" is going at any given point in time.
    So unless you can get an SAP "insider" to explain to you why SAP's workflow alternatives developed the way they did, you will not really have a complete picture.
    Of course, it's also true that sometimes good things can happen for the worst of reasons, so perhaps the "inside" history of workflow at SAP is irrelevant.
    The reason I'm going on about this is because I still don't think "the powers that be" at Walldorf have realized yet that the way to get pre-NW clients to NW200nx (NWDS, WDA, WDJ, GP, VC) is to get them to use regular old workflow first.
    There is <i><b>nothing</b></i> in NWDS, WDA, WDJ, GP, and VC that can't be done in a pre-NW environment using a combination of user exits, BAdI's, BAPI's, and workflows.
    And if SAP customers were to start using these older techniques to implement "integrated" and "process-driven" applications, then they would get into a "state-of-mind" that would make them much more confident of their ability to handle NW techniques, and much more aware of the benefits resuling therefrom.
    As the old saying goes -
    <i><b>you've got to take folks from what they know to what they don't</b></i>
    i.e. you can't simply "shock and awe" customers into what you want them to start using.
    Sorry to go on like this, but all these matters are tied up in the project you are about to undertake ...
    Regards
    djh

  • Is there any way to make work item invisible in the SAP inbox?

    Is there any way to make work item invisible in the SAP inbox?
    If yes , How?
    How can we delete a work item without using SAPLSINWP program?Is it possible???

    Thanks suresh, But I was a looking for a solution where as soon as the work item is created should be made invisible in the SAP inbox, is there any way for this or any other alternative?

Maybe you are looking for