Creatkion of customized profiles and roles
Dear Experts,
Im new to SAP and SDN.
My requirement is that i need to create a new profile for technical people
as z_tech_role giving access to transactions as SE38,S71,smartforms etc.
Similarly a functional one needs to be developed as z_func_role access to Se16,
solar01,solar02 ,va01,ad other VA transactions.
The same for a workflow profile.
Can you please provide me with steps how i need to create this profile and how to attach roles in it to the profile.
Thanks in advance
Hi,
There is one forum for SAP Security, you've to post this message in that forum to get quick and exact reply..
Anyways, please follow the help.sap link above povided already.
Somebasic concepts:
1. Tcodes are assigned to Roles.
2. When Roles are generated, they create profiles.
3. Roles are assigned to Users. (profiles are not directly assigned, except few like sap_all, sap_new etc)
So what you can do, create a role z_tech_role in PFCG and add transaction SE38,S71.. etc.then maintain authorizations, generate the role. and then go to user tab, add the users whom you want to be assigned with the new role z_tech_role. (role assignement can also be done in SU01, roles tab)
Thanks,
Debasis.
Similar Messages
-
Hi,
I created a few profiles with special roles and metadata fields in my ucm.
I did all the work in my computer and now i want to change the machine(computer) and i don't want to loose all my work.
Are there any ideas how to duplicate all my profiles and roles(my configuration) to another computer??
NOTE: I just want to duplicate my custom environment of the ucm.
Eran zFor this purpose you have Administration -> Comfig Migration Admin (Configuration Migration Utility).
http://download.oracle.com/docs/cd/E17904_01/doc.1111/e10792/c06_migration.htm#CHDBIJAJ
Regards,
Boris -
Developing Custom User and Role Providers
Hi
I am new to Fusion Middleware and trying to develope a Custom User and Role Providers based on the pdf "Oracle® Fusion Middleware Application Security Guide 11g Release 1 (11.1.1) E10043-06"
It mentioned a sample code "sampleprovider.zip" in chapter 18.10.7 Example: Implementing an Identity Provider
I couldn't find this zip file anywhere, Can someone know this please let me know how to get this zip?
Many Thanks
djia002URL:
http://download.oracle.com/docs/cd/E14571_01/core.1111/e10043/devuserole.htm#CHDEBAEB
18.10.7.1 About the Sample Provider
The sample provider is bundled in <b>sampleprovider.zip</b>. Unzip the file. It should generate the following structure (...) -
Profile and roles internet sales
Hi.
I need profiles and roles that are use in internet sales.
ThanksThere are basic three type of user in ISA.
1) B2B_FULL
2) B2B_ORDER
3) B2B_VIEW
<b>For B2B Full below is the Roles</b>
SAP_ISA_B2B_FULL
SAP_ISA_SUB_BILLING_VIEW
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CONTRACT_UI
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_ORDER_MAINTAIN
SAP_ISA_SUB_QUOT_DISPLAY_UI
SAP_ISA_SUB_QUOTATION_UI
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
<b>For B2B_ORDER</b>
SAP_ISA_B2B_ORDER
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CONTRACT_UI
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_ORDER_MAINTAIN
SAP_ISA_SUB_QUOT_DISPLAY_UI
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
<b>For B2B_VIEW</b>
SAP_ISA_B2B_VIEW
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
pl. reward a point if it helps you.
Thanks and Regards.
Ashish Patel. -
Difference between profile and role
Can any explain me the difference between profile and role.
I was given a user Id on ABAP stack of XI.
My profile: SAP_ALL
I was not assigned any roles.
I am not sure if I need different roles or this profile
would serve the purpose.
-Naveen.Hi Naveen,
Adding to Gus points a few more inputs.
Profiles were the menas of assiging authorizations to users until 4.0 Versions.
Later to the same it was upgraded to the concept of Roles. The crux always remains the same.
Be it a profile or a role, it contains the Auth Object and the respective values.
But in present scenario, you can get confused by the profiles that are assignable to Users.
IN short the following points can be helpful.
1. The profiles like SAP_ALL;SAP_NEW,S_SPO_ALL etc are standard Profiles delivered by SAP which when assigned to a user in his profile in SU01 would get all the related authorizations.
( You must be lucky to have SAP_ALL assigned to ur ID by ur basis guy)
2. A role is created by assigning a few transactions to this role and when this role is generated, it generates a PROFILE. But this profile is a system generated one and cannot be ever assigned to any user. These profiles can be sorted out as they have the standard naming like T-XXXXXXXX where they are the numbers and it can never be assigned to any user.
3. Note prior to 4.0 its all Profiles that are assigned to users and later to the same came the concept of Roles and hence this change.
Hope the answer is helpful in making u undersand a few inputs form my side.
FYI:
Method to create a role can be checked out from the link below.
http://help.sap.com/saphelp_bw21c/helpdata/en/52/6714b6439b11d1896f0000e8322d00/frameset.htm
Br,
Sri
Award points if answer is helpful. -
Oracle Profile and Role scripts
RDBMS :Oracle 10.2
Hi,
I have several Profile and Roles on my server.
Can I extract sql to create those Profile and Roles ?
e.g. I have role datareader, I want to extract its creation script and it include all the privileges assigned to that role
thankstry
SELECT dbms_metadata.get_ddl('ROLE', 'datareader') FROM dba_roles;
SELECT dbms_metadata.get_granted_ddl('ROLE_GRANT', 'datareader) FROM dual;
SELECT dbms_metadata.get_granted_ddl('SYSTEM_GRANT','datareader') FROM dual;
SELECT dbms_metadata.get_granted_ddl('OBJECT_GRANT','datareader') FROM dual;
datareader should be in CAPS -
Customizing profile and copying to default
what is the best way to customize a profile and copy that to the default?
What I have been doing is
login as an admin, customize the desktop, settings, themes, etc... then log out
login as another admin user, delete the Default user profile under c:\Users\Default
rename the Admin folder to Default
Go under the Default and remove the User.dat file
how else would you do it?The only supported method for customizing the default user profile in Windows Vista and newer is to use the CopyProfile setting with Sysprep. This is the only way to ensure that all user-specific
information is properly removed from the profile and to ensure that new user accounts created from the default user profile are properly directed to their own, unique resources. Your error with new user profiles being directed to the Administrator profile’s
resources is a perfect example of this.
Once you have created a default user profile through this method and the profile has been cleaned of profile specific elements, that default user profile can be copied and moved to other locations
for use as a default user profile. For example, it can be used as a network default user profile, or a mandatory profile.
The
link provided by arnavsharma provides the details for all of this.
Brandon
Windows Outreach Team- IT Pro
Windows for IT Pros on TechNet -
Two user with same profile and role having different authorization
Dear All,
I have very strange case of authorization . We have a new abap developer in our company . Her profile as copied from an exiting abap developer's profile in Development system. But she don't have authorization for lot of transaction that the existing user have. I checked the profile tabs , role tabs . then done the user compare for all the roles , but of no use.
I did a compare of the two uses using S_BCE_68001430 and could see is that the existing abap user is having authorization starting with T_PXXXXXXXX that is giving him extra rights. These authorization is not present in any of the existing role he is assigned to (checked using S_BCE_68001396). The authirsaction in the roles start with T-DXXXXXXXX
Will appreciate if any one can give any input . The problem is i need to assign each authorisation the existing user having manually to the new user.
regards
TonyThanks for the mail.
I check the "Reference User for Additional Rights" -- there is no refernce user assgined.
I checked the table USR04 the no. of Profle for the two users are diffrent and in the table UST04 also the the existing uer is having addtional profiles.
I like to add one more point Some of the roles of the two users are composite roles and both the composite and its orignial roles are included the profile of both users.
Does any one have idea of the authorisations starting with T_PXXXXXXXX
regards
tony
MANDT BNAME PROFILE
100 CHARLHO B_LSMW_ALL
100 CHARLHO T-D1780054
100 CHARLHO T-D1780057
100 CHARLHO T-D1780058
100 CHARLHO T-D17800581
100 CHARLHO T-D1780075
100 CHARLHO T-D17800751
100 CHARLHO T-D1780086
100 CHARLHO T-D17800861
100 CHARLHO T-D17800862
100 CHARLHO T-D17800863
100 CHARLHO T-D17800864
100 CHARLHO T-D1780087
100 CHARLHO T-D1780088
100 CHARLHO T-D1780247
100 CHARLHO T-D1780304
100 CHARLHO T-D1781182
100 CHARLHO T_P0920411
100 CHARLHO T_P09204111
100 CHARLHO T_P092041110
100 CHARLHO T_P09204112
100 CHARLHO T_P09204113
100 CHARLHO T_P09204114
100 CHARLHO T_P09204115
100 CHARLHO T_P09204116
100 CHARLHO T_P09204117
100 CHARLHO T_P09204118
100 CHARLHO T_P09204119
100 TESTUSER2 B_LSMW_ALL
100 TESTUSER2 T-D1780054
100 TESTUSER2 T-D1780057
100 TESTUSER2 T-D1780058
100 TESTUSER2 T-D17800581
100 TESTUSER2 T-D1780075
100 TESTUSER2 T-D17800751
100 TESTUSER2 T-D1780086
100 TESTUSER2 T-D17800861
100 TESTUSER2 T-D17800862
100 TESTUSER2 T-D17800863
100 TESTUSER2 T-D17800864
100 TESTUSER2 T-D1780087
100 TESTUSER2 T-D1780088
100 TESTUSER2 T-D1780247
100 TESTUSER2 T-D1780304
100 TESTUSER2 T-D1781182 -
Custom Cluster and role of INDX in that???
Hi All Gurus,
I need to create a custom cluster and then import and export the data to DB.
I saw some threads where i saw INDX being used.
Can anybody tellme what is this INDX table and how does it play a in creation of custom cluster also how do i create one.
Thanks in advance.
Regards,
NehaHi,
INDX may be used as a template for a custom cluster table. The keyfields and the last two fields are mandantory - all others might be deleted/replaced.
Creation of cluster tables and IM/EXPORT are well documented (F1 at EXPORT - follow the links).
have fun,
hp -
Custom Auth. Object with Profile and role assignment not working
Hi,
I have created custom Authorization Object with field ACTVT with allowed values - 01,02, 03. Now test it with custom program using AUTHORITY-CHECK OBJECT 'Z_AUTHORIZ' it is working fine and returning sy-subrc 12. At this point i have not created any role using this Auth Object.
Now I have created custom role ZPM_**** and assigned above Auth object to it with value ACTVT 03. Assigned this role to user.
When I try to test the above custom program with any ACTVT value it is giving sy-subrc as 0. Used below custom code in program.
AUTHORITY-CHECK OBJECT 'Z_AUTHORIZ'
ID 'ACTVT' FIELD '01'.
Am I missing anything? The profiles are generated correctly.
Best Regards,
NileshBelow are the screen shots for PFCG:
-
BAPI to create,get Profiles and roles
Hi,
I am using the SAP RFC SDK to do the provisioning of entities in the SAP environment.
My SAP system is 6.20 .
I wanted to know if there are BAPI's which exist for the following
a)Profile creation
b)Profile Fetching
c)Role creation
d)Role Fetching
I could not find the same in the SAP IDM document provided for IAM vendors
Best Regards
ManojHi Manoj,
Everything you need to know about this, and more, can be found in the following PDF from SAP: <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/668e6629-0701-0010-7ca0-994cb7dec5a3">SAP Identity Management APIs</a>.
In summary:
To find a user's roles and profiles, use <b>BAPI_USER_GET_DETAIL</b>.
To assign & delete a user's roles, use <b>BAPI_USER_ACTGROUPS_ASSIGN</b> and <b>BAPI_USER_ACTGROUPS_DELETE</b>.
To assign and delete a user's profiles, use <b>BAPI_USER_PROFILES_ASSIGN</b> and <b>BAPI_USER_PROFILES_DELETE</b>.
Hope this helps,
Darren
<a href="http://www.fortybeans.com/">My blog</a> -
How to set custom profiles in iphone 5 and viewing sent messsges and dialed calls seperately
i found that i cannot set any other profiles other than silent and general is there any app to create custom profiles and also i can't view the dialed calls seperately only missed calls can be viewind seperately is there any app to overcome that problem?and also i want to view sent messages seperately in my messages option.
These are not a features of the iPhone and iOS. No 3rd party app can provide these functions due to Apple restrictions.
-
Canon 5d2 DNG +custom profiles = bad preview in Bridge?
I'm using DNG Profile Editor (1.0.0.39 Beta 2) to make custom profiles for my new Canon 5D Mark II, and then using DNG Converter (5.2) plus Photoshop CS3 Bridge to process images. All on Windows XP.
After my 5D2 custom profiles were in place I noticed that the image preview in Bridge CS3 was "bad." The Bridge preview is very blurry and does not update when changes are made to the DNG file via ACR. For example, if I change exposure in ACR and click "Done" or "Open in Photoshop, the change is saved OK in the DNG file but the Bridge preview remains the original blurry image.
Took a long time to figure this out because I did not immediately associate the problem with the creation of custom profiles. Older 5D2 DNG files previewed OK in Bridge, as did DNG files from my other cameras. I even re-converted some old camera raw files to DNG and they previewed OK in Bridge. There are custom profiles in place for those older cameras.
I spent a lot of time on the usual suspects - purging cache, reseting preferences. All to no avail. Then I removed all my custom profiles and deleted the index.dat file. Ran DNG converter again to make new DNG files from the 5D2 raw. Now the Bridge preview was OK. Then I restored my custom profiles and converted raw to DNG again, getting bad Bridge previews again. Yet the previous converted files would still preview OK in Bridge.
My conclusion: The DNG converter is using camera profiles during the conversion, and in the case of 5D Mark II raw files is creating an error. I'm guessing it is putting an embedded jpeg in the DNG file that somehow confuses Bridge.
I've repeated the tests many times now. I've changed the DNG Converter "jpeg preview" preference to none, medium and full. For the 5D2 files I get bad Bridge previews on all settings. But I get good Bridge previews on my Canon 20D and Canon 1Ds DNG files regardless of any settings. Regardless of the presence or absence of custom profiles, regardless of the jpeg preview size, regardless of the ACR default settings.
So I'm hoping the Adobe team can take a look at this. Or anyone willing to confirm or deny my tests. I don't have an easy way to post a DNG file, but could email one of my "bad" ones to anyone willing to take a look.The lack of response to this post forced me to keep testing. Now I've more closely pinpointed the problem and found an easy work around. First some background.
ACR camera profiles are stored in two places. The Adobe supplied profiles are in:
C:\Documents and Settings\All Users\Application Data\Adobe\CameraRaw\CameraProfiles
and your custom profiles are in:
C:\Documents and Settings\yourusername\Application Data\Adobe\CameraRaw\CameraProfiles
Adobe Camera Raw, and it turns out the DNG Converter, both build an Index.dat file in this last folder. Apparently this index is built by scanning both camera profile directory trees and building a list of all the profiles it finds. It then sorts that list alphabetically by the profile name that is embedded in the file, not the Windows file name.
The "Adobe Standard" profile for a camera has a file name like "Canon EOS 5D Mark II Adobe Standard.dcp", but embedded in that file is the profile name of just "Adobe Standard". That's why only "Adobe Standard" shows up in the drop down list of profiles in ACR. And that's why "Adobe Standard" appears before "Camera Faithful", which appears before "Camera Landscape". It's alphabetical order.
Now, when you create a custom profile with the DNG Profile Editor, the "Export" function puts "Canon EOS 5D Mark II" on the front of the name. If you are an idiot, like me, you type over all that with something simple like "5D2 Bouce Flash" for the profile name. But wait, "5D2 Bounce Flash" sorts alphabetically before "Adobe Standard" and appears first in the ACR drop down menu. Sounds OK so far.
But then the magic occurs. The DNG converter uses the camera profiles. It actually accesses that Index.dat file, and if it does not exist, the DNG converter will rebuild it, just like ACR. Why it does that I can't imagine. Seems to me that the DNG converter should be simply converting raw to DNG and passing the EXIF and embedded camera jpeg along as is. What need does it have for camera profiles?
Anyhow, if that 5D2 profile is first in the list due to its alpahbetical name, the resulting DNG file will confuse Bridge. Bridge will display a fuzzy preview and will never update that preview, or the thumbnail, when you make adjustments in ACR.
But if you name the 5D2 custom profile such that it sorts alphabetically after "Adobe Standard", then all is OK. The DNG files can be previewed and thumbed OK by Bridge. So I named my custom profile "My 5D2 Bounce Flash", a simple workaround.
Now I can move on to more important things. Like generating a good custom profile for the 5D2. So far the Adobe Standard profile beats anything I've generated. Especailly if I remove that curious Point Curve which can sometimes muck up the shadows.
And now that Bridge previews are "OK" I can work on the mystery of why Bridge Previews of 5D2 DNG files do not match the previews of their equivalent TIF or PSD files. If you're curious you can see samples and read more about that here: http://forums.dpreview.com/forums/read.asp?forum=1032&message=30748423 -
Difference Between Attribute Tab and Role Attribute Option
Hi Experts,
What is the relation between option custom fields and sub-option attribute under option roles in CUP> config.
I am asking this because, i have created a workflow based on functional area and now i am getting two functional area options in CAD(select attribute) and in initiator.I know, from where they are coming from....
1.Custom field>functional area.
2.Roles>Attributes>functional area.
Under both options different values are maintained for functional areas,for e.g.AP and AR in first and Bank and Asset in the other one.
The strange thing to me is that i am able to view only values maintained in Custom field>functional area while creating a test request no value is coming from Roles>Attributes>functional area.
However, while selecting role(option selct role), initially creating request, i can see the values maintained under functional area(coming from Roles>Attributes>functional area)
Regards,
MukeshMukesh,
In simple words, there is no relationship between custom fields and role attributes.
Function area under role attribute is referred as "Functional Area of Role" in CUP. The other functional area refers to the "functional area of the user". In a company, both these functional areas can be similar or different as an user from "AP" can have roles from "AP" as well as "FI".
When you are creating CAD, do not select functional area of role and you would not see the attribute values from role FA.
I hope this helps you.
Regards,
Alpesh -
Unable to set/update custom profile option value in R12.1.3
Hi All,
I have defined a custom profile. After querying the custom profile and I select a value from the resulting LOV(popup).
Whenever I am trying to save the changes the LOV again pops up for selecting the value.Hi,
I think this is the wrong forum for this question. This forum is for questions about Oracle Enterprise Data Quality.
Regards,
Mike
Maybe you are looking for
-
Is there a way to connect the Apple TV as a second display without it automatically changing my Mac's audio output? I would prefer to use an audio interface for playback and the apple tv as a third display. I know I can go back to system preferences
-
Hello, I would like to know if it´s possible to communicate with Adobe Professional through a Indesign script (.jsx). I need to convert the pdf file that I export from Indesign to specific standard type that is only available in Adobe Professional. I
-
Quad for a young designer?
I am a young graphic designer trying to get setup to do freelance work. This will be the first Mac that I will purchase, and want to make sure I do it all right, and get what I will need. (I usually have all the CS2 apps open at the same time) I was
-
Why is the Spry image slideshow not showing all of the thumbnails?
Hi, I have a problem with the Spry image slideshow with filmstrip. I downloaded it and inserted all of my pictures and thumbnails. When I load it up in Firefox and IE seems to work perfectly. However when one scrolls through the images, some of the
-
How to develop variable column in alv report
Hi all, I want to develop a alv report where the column will be variable and created in runtime as per data.Is it possible in SAP ALV grid display?If possible tell me how I develop such type of report. For example MATERIAL BATCH