Copy user roles/profiles : Su01

Hello,
I want to copy user roles /privileges from one user to other?
how do we do this and which user can do this ? my pisuper does not seem to have authority to copy user profiles from one user to other?
Thanks

Try to Copy the user(Src user to Target user) from SU01 by logging in your user. When it displays authorization error, open a new Session of SU53. It will tell you the missing authorization objects. Add those authorizations to your user & you will be able to copy Users using ur userid.
If you want to keep it simple.. Give yourselves SAP_All. You can do whatever you want.
Copying Users
http://help.sap.com/saphelp_nw04/helpdata/en/52/6711c5439b11d1896f0000e8322d00/content.htm
Regards,
Siva Maranani

Similar Messages

Trying to understand "User/Role/Profile Synchronization" and Batch Analysis

Hello,
Im trying to understand what exactly and from which tables these jobs are copying to which tables in CC. I have a understanding that these jobs are moving also deleted roles from backend. This is causing unnecessary delay to long lasting job.
I would appreasite if some one could explain the logic behind these jobs. What the fullsync and incremental is reading ? What kind of changes are causing a role/user/profile to be included to the full and incremental jobs?
How the incremental analysis logic is built ?
br Janne

Janne,
In my current implementation we are going for an offline risk analysis due to the heteregoneus system landscape of our client (several SAP and non SAP systems and several SAP systems under 4.6C). Eventhough within our approach we don't perfrom the backend synchronization (we use CC data extractor to pull data from backend into CC) hope the following info could hel you:
The tables such jobs you mention access to, are all the SAP backend system tables related with users, roles, profiles, action and permissions. If you check the data mapping appendix of the "user and configuration guide for 5.2" you will see all the data that CC retrieves. For instance, in order to extract user info (UserID, FName, LName, Email, Phone, Email, Department) tables USR21, USR02, ADRP, ADR6 and ADCP must be accessed.
In terms of CC tables:
VIRSA_CC_SYSUSR >> UserIDs and Systems ID relationship
VIRSA_CC_GENOBJ >> User, Role and Profile master data
VIRSA_CC_GENACT >> User-action, role-action and profile-action data
VIRSA_CC_GENPRM >> User-permission, role-permission and profile-permission
VIRSA_CC_SAPOBJ >> Action-permission
VIRSA_CC_OBJTEXT >> Objects descripcions (ACT, PRM, FLD, VAL, ORG)
Hope this helps.
Regards,
Imanol

Solution Manager 4.0 Solution Monitoring User -Roles-Profiles for Satellite

Hi All,
I have installed Solution Manager 4.0 (OS -Linux ,Database - DB2) .
Now i need to connect solution manager to the R/3 4.6C
Satellite Systems (DEV, QAS ,PRD) for Solution Monitoring
and Service level Reporting .
I have read the configuration guide , but unable to get clear idea .
1) what users (alos type of user -Dialog , Service, Communication etc) do i need create in DEV , and Test in QAS for solution Monitoring .
2) what exact roles /profiles need to be assigned to these users in satellite systems .
3) what users/roles /profiles needs to be done in SOLMAN system
i have applied all the required plug ins and support packs
in satellite systems and solman 40 ..
Please advice . Your response will be a great help for me .
Satish

Hello Satish,
Just clarify, if u have meant connecting the satellite systems for EWA reports to be precise. Early watch Reports. If its is the case, then repond so that i can putin my inputs which may be helpful for you in this config.
Rgds,
Sri

Function module to modify the user roles & profiles

Hi All,
I am working on user maintenance and i need a function module to modify the user roles & profiles.
Thanks in Advance.
Phani.

i used the below fms
BAPI_USER_ACTGROUPS_ASSIGN for assigning the roles.
delete the profiles of the user qnd assign the profiles to the user:
BAPI_USER_PROFILES_DELETE
BAPI_USER_PROFILES_ASSIGN
i used the above FMs for my requirement.
Regards,
Phani.

Compliance Calibrator 5.2 user/role/profile sync

I have run into an issue with a user. Where the user is getting flagged as having risks associated in basis for having a combination of transactions. Under CC it is saying that she has S_Develop Auth Obj with Activity 1 and 2. However when we check the user in R3 all of her profiles and roles that have a Basis associated and have the auth object she has activity 3. So the information is not synchornizing properly.
Thanks for any help

when was the last time you ran a user/role/profile synchronization or a batch risk analysis for this user ?
In case you need more info, check : https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/50cd7177-5c22-2a10-8cba-8e0c64bc4ea8
Regards.

User, Role, Profile Synchronization Job Fails

Hi Gurus,
When I am scheduling a job the User, Role, and Profile Sync. job fails giving an error
"Cannot assign a java.lang.String object of length 53 to host variable 5 which has JDBC type VARCHAR(40)."
This happens when the synchronization happens with a portal system. We dont have a ruleset for the portal system, So if I put in a "*", it includes this system and results in the error, If I manually select all other system, it works fine. Is there any way to remove this error so that I can schedule the jobs without having to select every system manually.
Regards,
Chinmaya

Hi,
As per my knowledge, in the Portal system, you should perform only user sync. Roles/profile sync will not work since portal will have workset roles.
Please refer SAP Note 1168120, which may help you to understand the limitations
Hope this helps!!
Rgds,
Raghu
Edited by: Raghu Boddu on Nov 4, 2010 7:39 PM

RAR: Best strategy for users/roles/profiles synchronization

Hi all,
Assuming that:
1) we will be never interested about profiles risk analysis (just users and roles)
2) roles risk analysis will be run first and after sometime (threee weeks) we will run it for users.
and we will run batch risks analysis:
Question 1) Is it possible to synchronize just roles and do it for users just when we want to execute risk analysis for them? Or is a best practice to synchronize always for users/roles and profiles eventhough risk analysis will not be done for all three?
Question 2) If we execute just full sync and full risk analysis, users/roles or profiles deleted in backend between executions are also deleted from DB? or removal takes place only when executing incremental sync?
Many thanks in advance. Best regards,
Imanol

Hi Imanol,
Answer Q1: Yes, you can just select user and roles for the snych and risk analysis. Go to configuration-background jobs - shedule job. If you don't run risk analysis for profiles, you shouldn't sync and select them.
Answer Q2: Both, the Full risk analysis will alwaly update your DB. I will recommend you, to do this job in some periodic times. The incremental sync job will as well update your DB, if anything changed in the backend system. Normally your are going to run your daily or weekly jobs with this selection.
Thanks,
Martin

Security Issues with the BP Internet user role creation--SU01

Hi All,
We are implementing the B2B Internet sales scenario using CRM 4.0. we
have contact persons who logs in and chose the distributor and then
start placing orders or look at product catalog .... Now contact person
is created as a BP in CRM and relation ship is maintained to sold to
(bp). During this process the contact person should be created under
the Internet user role which uses the SU01. so we will be able to
change password or change the roles of the users while creating BP
under the internet user role -- same as what we do in SU01.
This is now a security Issue because who ever can access the BP
(create/change) will be able to do the things we can do under
transaction SU01. But we still need to access the Internet user role in-order to assign the user id to the contact person . Is there any other
way of doing this.
Please advice ASAP.
Thanks
Vasu

Hi Ashwini,
you need to modify the logon routine and then in the user management (isauseradmin application) to do this. Then there are likely changes to the catalog identification, and very likely to most processes in the shop. I really wouldn't advise doing so. As accounts usually have contact persons: Why does your client insist in providing a login for the organization and not for a person?
To achieve something that looks almost like the desired solution you, e.g., could model a dummy contact person for each account that shall get a logon, that then does the job. The contact person could be named like the company and then you are back to plain standard.
Rgds
Thomas

XIUSER - Service users role/profile at R/3 system

All,
Currently, we have the following scenarios
1) IDoc to XI to 3rd Party System
2) 3rd Party System to XI to R/3 RFC
3) R/3 RFC to XI to 3rd Party System
These scenarios are working using service user XIUSER with SAP_ALL, SAP_NEW access at R/3.
I would like to know the Roles needs to process the above scenarios.
Thanks,
Peter

hi Peter,
>>>>2) 3rd Party System to XI to R/3 RFC
it depends what does your RFC do
if you're posting MM transaction then you'll need MM roles if SD then SD, etc
>>>>1) IDoc to XI to 3rd Party System
SAP_XI_APPL_SERV_USER <-- user role on the XI
http://help.sap.com/saphelp_nw04/helpdata/en/d4/d12940cbf2195de10000000a1550b0/content.htm
Regards,
michal

Cannot see BEx Query in user role profile in BEx query designer

I assigned several BEx query objects into user profile menu via t-code PFCG first.
Then expected - when I need and open them in BEx query designer I could find them after clicking "Role" button in "Open" window. But unfortuantely I'm not able to do that.
Do I miss anything to archive that? Is other customizing activity else neccessary?
Thank you for any suggestion.

Hi Brad.Ma,
If you can open query from Area "button", after that, you publish it to roles you want assign.
You try generate Authoriation in Role in Tcode PFCG.
Hope help you to solve the problem.
Dao
Edited by: xuandao_sap on Sep 20, 2011 3:33 AM

How to check user role/profile

Dear all,
I'm finding function module to get a list of profile/role of user. Would you please suggest me on this?
Btw, if you have any other advise please feel free to let me know.
Thanks in advance.
Peersit

I've just found the related threads on this site.
User Profile Details
Re: User Profile Details
User Wise Authorization/profile report needed
User Wise Authorization/profile report needed
Have a good day.

User, Role, Profile Synchronization - Full sync job

I've scheduled this job and it's been running since feb 2. I understand that this job brings only the header data into CC tables. When I look at the CC log file.- It says Delete user XXXX from all tables. I checked the userid in the backend system it actually does not exist.

Hi Partha,
GRC RIG has created an accelerator "How to Performance Optimize SAP GRC Access Control 5.3" which provides step by step instructions to increase performance of AC 5.3.
Please find the document at the following link on SDN.
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/90aa3190-8386-2b10-c4ba-ced67322ea6d?quicklink=index&overridelayout=true
Hope this helps.
Best Regards,
Sirish Gullapalli.

VIRSA tables for users, roles and profiles sync?

Hello,
I am in a customer, implementing CC 5.2. At the first time, we tried CC 5.2 in DEV environment, and when everything was OK, we redirect RFC connectors to QA environment.
After doing user, roles and profiles sync in DEV and in QA environment too, I have 4.500 user (1.100 from DEV + 3.400 from QA) when I recover all users "*" with "user level - risk analysis" from the "Informer" tab.
It seems that "users, roles, profiles, sync" works like and "APPEND", but I did a COMPLETE syncronization not an INCREMENTAL.
If I start an analysis for QA environment, CC works properly and only analyse QA users (3.400). But I would like to clean CC tables (users, roles and profiles) in order to have a clean copy of QA in CC.
Which VIRSA tables (users, roles and profiles) I need to clean?
It is necessary to do the same with authorization and text objects? Which would be these tables?
Thanks in advance,
Victor

Hi all,
SAP GRC Support provides a script which allows you to remove a connector since it does delete all data link to it. Anyway, I would recommend a deep analysis of it and find out if it does what you really want to do.
Víctor, if what you want to do it is just to remove all user, role and profile master data (stored in tables VIRSA_CC_SYSUSR and VIRSA_CC_GENOBJ) you could upload a text file using data extractor functionality with the delete field set to X. Doing so user, role and profile master data will be removed from CC database.
In order to use data extraction functionlaity you connector must be of type "File Local".
Be careful about removing data directly from DB since, as Prem states, you might loose the DB consistency.
Hope it helps. Best regards,
Imanol

How to add profiles to critical roles & profiles table in GRC RAR

Hello,
As per Note# 1034117, it says Add "SAP_ALL" type security roles and the SAP profiles, see list below for profiles, to the Critical Roles and Critical Profiles table.
SAP_ALL All Authorizations For The SAP System
SAP_NEW All Authorizations For Newly Created Objects
S_A.ADMIN Basis Operator
How do we add the profiles, to the Critical Roles and Critical Profiles table in RAR.
Thanks,

Hi,
I configured the critical roles & profiles in rule architect.
But when I schedule the background job for batch risk analysis, it is taking all the users, roles & profiles.
Is there a way to exclude users, roles & profiles? (I have already configured the excluded users, roles and profiles in exclude option), but still when I schedule the background job and say show parameter, it shows the User Range as '*'. It is not showing the excluded users.
Can you please update how to exclude the list of users, from the batch risk analysis?
Thanks,

Copy user greyed out in SU01

When i am executing SU01 t-code copy user is greyed out and infact copy user icon is also not showing . I already have the SAP_ALL and SAP_NEW authorization with my id .
Please suggest on this .

Check this help:
http://help.sap.com/saphelp_nw70ehp1/Helpdata/EN/52/6711c5439b11d1896f0000e8322d00/content.htm
http://help.sap.com/saphelp_nw70ehp1/Helpdata/EN/52/6711c5439b11d1896f0000e8322d00/frameset.htm
You are authorized to assign the authorizations, systems, roles, profiles, and reference users that are assigned to the user to be copied. Otherwise, the role for which you do not have authorization is not copied to the new user master record. When copying or assigning a reference user, the system checks whether you are authorized to assign its profiles and roles.
If you cannot copy the template user completely, because, for example, the reference user does not exist in the current system, the system displays a log with the exact causes of the error.

Copy user roles/profiles : Su01

Similar Messages

Maybe you are looking for