Authorizations in Production System

Hello,
The production system is up and running.
Now the functional consultants are asking access to Production to check the config.
But they are demanding SAP_ALL with only display access
Is there an easy way to do this?
If not, kindly help me as to how I should ask my Functional consultants to proceed.
Thanks.

Hello Gautam,
Best way which i did is started giving 03,04 & 08 activities in ZSAP_ALL for all modules,other than BC_A,BC_C & BC_Z classes basis related objects(On requirement u can enable them).But it may take couple of days and its worth as well. I can explain the reasons also, for ex.if ur higher officials wants u provide display access in FI module only for a consultant,then u can disable all other modules by leaving FI only(in new role).This works very well for me.
U can find some more information from the below link and in search forum:
[Re: DISPLAY ONLY AUTHORIZATION]
Rgds,
Gadde.

Similar Messages

OB52 Authorization in Production System?

Hi,
How can OB52 Transaction code will be open in Production System? Because every month we are doing this by moving the transport from Development to Production. We are not comfortable to do this.
Kindly suggest me some points how can OB52 will be in editable mode in Production System?
Thanks

Hi,
see also OSS note 1433051 - "Open and Close Posting Periods" as current setting

Unable to delete Role from User ID in SAP SOLMAN production system but able to from DEV with the same authorization, pls suggest

unable to delete Role from User ID in SAP SOLMAN production system but able to from DEV with the same authorization, pls suggest

Hi,
For SU01 role removal, you do not need S_USER_AGR with 02, and as you mentioned both authorizations available in production, if so trace should not show you the S_USER_AGR with 02 with RC=04.
I would recommend to do role comparison for the user performing the activity. and then check if you have the S_USER_AGR with 02 in user buffer SU56.
But ideally it should not ask you S_USER_AGR for 02 through SU01, so please take help of abaper to debug it.
Also put trace in non-prd to see if S_USER_AGR is getting checked with 02 for removal through SU01.
BR,
Mangesh

Authorization Querychange in productive system

Hi Experts,
in our productive system we want users to be able to change queries / create queries. System is set to query changeability, but if the query contains objects (variables, calc. key figures, etc), that were not created on the productive system (but transported from development system) the query can´t be changed.
Do you have an idea what we can do in order to make these queries changeable?
Thanks for your help!
Angelika

Angelika,
Go to Transport connection on RSA1 -> Select Object changeability ( you can find it on the top menu / it is a button on the screen ) - Double click on ELEM ( Query Elements ) it will change to chengeable original - then save the settings .
Now you can edit queries in production even if the object was transported..
Arun

Generate Export DataSource from InfoCube In Production System

Software component : BI release 7.0 SP 18
Dear Gurus,
we have a strange situation in our production system from a month till now.
We want to generate an export data source from an infocube to load data into another one but now when we try to generate in prod ( right click on infocube and select "Generate Export DataSource" ) we can't create anymore.
Following message appears :
no changes to repository and cross client customizing object allowed
and the generation is stopped.
We always did it in production system in the same way as in the other system and then transported the update rule or transformation, but now it seems that is no more possible.
No setting has been changhed in SCC4 and in object changeability. Maybe is an authorization problem or is due to any other setting?
Does anybody has a way to solve this problem?
<removed by moderator>!
Kind Regards
Stefano
Edited by: Siegfried Szameitat on Nov 24, 2008 4:18 PM

Hi Stefano,
If you want to generate an export datasource you ask your basis team to open the system so that you can do.
As per the Sap Best Practise you can do the export datasoorce in your development system and move it to the quality and after testing you transport to Production.
Generallly if you can look in to production authorizations you may have only some operation like to display only.SOme times basis may give authorizations like creation of DTP and Infopacks like that.
Regards

Hierarchy loading Error in Production system

Hi All,
I am loading Hierarchy file, the file is there in application server(AL11), in external tab i gave same path. but when i try to load it is showing below Error message.
Invalid entry, hierarchy 0XMK4PVWO05BM4GP5KVEFQ9L4 does not exist.
Diagnosis
Hierarchy 0XMK4PVWO05BM4GP5KVEFQ9L4 does not exist.
Procedure
If the underlying InfoObject supports hierarchies create the hierarchy and try again.
If hierarchies are not supported, select another InfoSource or change the definition of the InfoObject.
That means Hierarchy file problem (OR) In Info package I selected Hierarchy selection problem?
Kidnly help on this issue.
Cheers,
Srikanth.
Edited by: srikanth on Apr 21, 2009 11:49 AM

Is this only happening in your production system? Have you tried loading the hierarchy file to your development or acceptance system?
I've seen this error occur when the authorizations are not set up for loading hierarchies (i.e. maybe they can only be loaded via process chains under the remote ID used for process chains, and not using your own ID). That's why I was suggesting you try to load the same file to your dev and acc systems and see if you get the same error. Sometimes this error is thrown for other reasons and does not really have to do with the file being loaded or the hierarchy missing.
Also, if you're loading from the App Server, double-check that you have the Application Server radio button selected on the tab where you select the file path.
Good luck!

Creation of new Plant in productive system

Dear All,
I have to create 3 new plants. the system is already productive from the last one year.
can anybody guide what will be the effects if i create new plants and send the transport to the production system.
what need to be looked for side effects if any?
pl give your valuable suggestions.
Thanks and regards
Ajay

If you create new plants - there is no adverse effect but you have to make sure that the plant you create is copying by the existing.
other things if you have any custom reports based on the plant then the new plant should be included, authorization needs to be consider if any basd on the plant,
etc

ADHOC Query in Production System

Can I create a ADHOC query in Production system?Coz I can able to do that.
Thanks
Sriram

This is the practice:
1. The project team will build all the reports defined in the project plan, test and transport to production. These queries usually will be set not to be changed.
2. SUper users will be granted authorization to create their own queries, modify their own queries and delete their own queries. For this the auth object S_RS_COMP1 is used.
3. All the other users will be granted to access reports.
Ravi Thothadri

Modify Query in Production System !

Hello SDN s,
How ya all ?
We want to Modify a Query by inserting one more InfoObject in the Production System. When we try to Drag & Drop the InfoObject from the Dimension to the Free Characteristics it showed blocked symbol and hence we are unable to modify the Query.
We do have to Query in the Development but cannot use that for Transport as it holds another Query Structure which is used by another Production System.
Could anyone suggest us how to modify the Query ?
Will there be any authorization to maintain for the user ?
Best Regards....
Sankar Kumar
+91 98403 47141

Hello Murali,
Could u list down what are all the Authorizations we have to maintain and where it has to be maintained, in SU01 or some other Transaction ?
Hello Srini,
I got this doubt earlier and checked the entire content, the object is not there.
Hello Edwin Harpino(A.H.P),
I will try this and come back with the result !

TWO Changes In Production System

Hi , there are two changes in Production system,
one is there is a report i have to do some modification in PROD,for this have to do in DEV,QA,PROD Respectively , here whether i have to use old request to new one , is this is the right practice or not,
second in transfer rules there is a conversion routine , i have to do some modification , How can i do like once again DEV,QA,PROD
Hope u understand the problem
With Regards
MAHI

Hi,
Normally we dont have any authorization for changing the objects directly in production.
You need to make the required changes in Dev and then move to Quality and then to Production. Hence you need to create a new requrest for all the changes you made in Dev and move to Quality and then to Production.
Hope this helps.
Regards,
K.Manikandan.

Index value maintenance directly in a Production system

Hi,
Is it possible to control the access to T-code: REAJINDX ( Index value maintenance) by Authorization Management (Profile Generator/Role management) in a closed system (Production) for configuration?
Authorization Object: S_TABU_NAM
Activity: 02
Table: V_REAJINDXCLASS
The requirement is the Index value maintenance directly in a Production system (closed system for the configuration) through the Authorizacion Management.
Thanks and best regards,
Fernando

Hi Franz,
First, thanks for your quick response. I haven´t got to solve the problem with these notes. I would like to explain in further detail the issue and the current system configuration.
The configuration for the Client (T000) is the following:
Client Role: T (Test) or P (Production)
Changes and Transport for Client-Specific objects: No Changes Allowed
Cross-Client Objects changes: 3-No Changes to Repository and Cross-Client Customizing objects
The configuration for the object VC_REAJINDX (SOBJ) is the following:
Category: CUST
Transport: 2-Automatic Transport
Adjustment: Automatically adjustable
Current Settings: Marked
With this configuration at client level and for this object, it is not possible to maintain the Index values in the target client. Then my question (doubt) is if it´s possible to maintain the index values in despite of this configuration by Authorization management (User roles/Profile Generator) for this object (Example: Give authorization to modify this object (in order to maintain the values) to a Key User with a specific role, SU01). Or if it´s not possible, then It´s necessary to change the configuration for the object (VC_REAJINDX) for the fields, Category, or/and Transport,... For this option, it´s necessary to modify the SAP standard using a Developer key and I´m not sure if it is a recommended solution.
But my client wants to maintain the index values directly from PRD system and not from a DEV system and after transport the updates to PRD.
On the other hand, the error message that the system shows it isn´t the message number TK430, It is the message nº SV052, No maintenance authorization for requested data (Diagnosis: You have attempted, in change mode, to access data for which you have no authorization.). This is the reason I think, maybe, it is possible to control it through the Authorization management.
Thanks in advance and best regards,
Fernando

Query developement and se16 access on productive system

Hi,
we are setting up an authorization concept on ERP2004s and our users asking for query development rights and se16 on our productive system. I think queries and se16 should be on the test system due to security reasons. Please post some feedback how do you think about it!? I think queries should be developed on the test system and transported.
Thank you in advance!
Best regards
Frank

Hi Frank,
I dont think that you can give access to writing a quaery in production system.
writing a query also need access to:
Transaction Code: SE16
Authorization object: S_TABU_DIS
Activity: 02 AND 03
Risk: The risk here is that users who have this access, have the ability to maintain table data directly in the production system. This includes transactional, masterfile, security and configuration data.
Hope it is useful.
Please award points if it is useful.
Thanks & Regards,
Santosh

Translations in production system.

Dear experts,
We're currently reviewing all modified objects in an upgrade project to ECC 6.0 and we are seing that there are lots of objects directly translated in the production system. If we reset to original this objects in the development system we will loose all this translations.
My question is if it is possible to lock translations in our production system. As far I know I can use SM01 to lock translation transactions like SE63, and also a properly authorization schema will he helpful here. But this is not the case, some of our developers are SAP_ALL/SAP_NEW. So they can override this mechanisms.
Is there any way to disable SE63 or just work with translations like ABAP code ?
Regards,
Joan B. Altadil

why are you giving SAP_ALL to developers in production env???/

Code changes in Production system.

Hi all,
Due to the unavailability of the development and quality i want make code changes in production system.
Please tell me is this possible and also i want know that does it effect or not?
Regards,
Ramprasd

Hi,
For editing in PRD system, u need to get authorization for editing. To get auth object, contact basis.
But proper way to edit a code is modifying in DEV, then transport it to QAS & PRD.
Regards,
Prem

Will Queries will be created in the Production system?

Hi all,
Is it possible to create queries directly in the Production System. And if there is an issue in the query in production systems can it be fixed in the production system itself nor it should be moved to development and then to qa and then to production???
can anyone guide me on this???
thanxs
haritha

Hi,
I am creating all my queries directly in the production system; it all depends on your strategy.
Of course, when you'll have an issue, you'll have to fix it directly in PROD since your query doesn't exists neither in DEV nor in QA.
Based on our authorization concepts where users are allowed to see only some queries we create new queries in PROD with a certain name so that users cannot see that query. We test it with live data and when it's ready we save it as under another name; the query is now released to authorized users in order to test it. When the query is assessed "valid" for the requester, when save it as again this time "LIVE" which is the final version of it. If they're changes, we go trhough the same cycle.
We also use our DEV (we have chosen not to have a QA) to test special scenarios and variable exits....
hope this helps...
Olivier.

Authorizations in Production System

Similar Messages

Maybe you are looking for