CUA Authorusation on systems

Hey there,
In our SAP landscap we plan to use CUA. The user-maintenance is divided in two sections. Section A maintain the production systems, Section B maintain the Development systems. We have one CUA for all systems.
Cal anyone help wich authorization object I have to use to make the propely authorization profile?
Thanks Hans Bloem

Hi Hans,
Have a look at S_USER_SAS and S_USER_SYS.
Jurjen

Similar Messages

Synchronisation of CUA and satelite system

we have implemented CUA and 3 satelite systems (PROD, TEST, QAS). By accident the complete user-access information has been deleted in QAS. Is there any possibility to push the information from CUA again into QAS to synchronize CUA and satelite system?

HI Dagmor,
Find CAU cookbook:http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/fe4f76cc-0601-0010-55a3-c4a1ab8397b1?quicklink=index&overridelayout=true
But it would be good if more elaborate your problem "user-access information has been deleted" like what you did in system. So that we can check and support you with better solution.
Hope this helps..

How to create automatically users&roles in CUA and child systems

Hi,
i have a CUA on a 2 chlid R/3 systems (test and training) and 2 portal systems (test and training).
i need to create a web application to create automatically users test and users training in CUA and see them in the R/3 chlid systems and at the same time to create autmatically a roles in CUA and R/3 chlid systems for those users (we sppose that the role is already stored in a table).
are there any standard BAPI or Funcion modules that can do this job?
is the role created automatically in CUA can be seen automaticall in the portal child system?
any help?
Thanks&Best regards

Thank you all. I got the solution.
Regards
Rajesh

Rename 600+ users in CUA implemented 3 system landscape

Hello All,
Task ahead :
Rename around 600+ users in my Production system which is my CUA central system as well. I am having a simple 3 system landscape.
Advice on :
What can be the pitfalls for this activity ?
Since CUA is ON, there would not be a Rename Option available any more...so How to proceed with this activity ?
Is there any negative impact for such renaming actions in the system.
Any inputs would be rewarded handsomely...
Thanks for your time.
Br,
Sri

Hi Happyman,
How do i perfrom the Rename in my central system ? Its OK, i can delete child systems from the centrral CUA and perfrom a rename and then re add it back to CUA...bt my query is how to tackle this issue in central PRD system.
does that means i need to delete the existing CUA altogether and recreate it again after utilising the rename option ?>
Thx for the inputs...
Br,
Sri

CUA - Adding Child systems after implementation

Hello all, just have a quick question:
We have about 10 systems all with 8-10 clients in each of them and are in desperate need of the CUA. I wanted to just do a couple of systems at first so that everyone could get used to the CUA and then add the rest of the systems at a later time. Is there anything wrong with this? Or does the whole distribution model have to be setup BEFORE setting up the CUA?
Thanks

i know your question is answered but i wanted to add my comment anyway - i was not around the last few days ... so: endure it now !
there's no restriction as to when to add other clients/systems to your distribution model. you can go step by step here if you like.
i have an adivce anyway: normally i do it systemwise (not client-wise) because in that way i find it more transparent what ports (WE20/21) and rfc-destinations (SM59) i have created (because i maintain them with the same names/numbers in all the systems in one landscape - just in case there is a system-copy to a new sandbox or somesuch ... then my settings will already be there).
but that's just a personel preference.

Indirect Role Assignment with HR-ORG in a system landscaper with CUA

Hi all,
we have 2 SAP systems:
1) SAP ECC6 (with composite roles)
2) SAP HR with PA and OM
We would like to assign SAP ECC6 roles through HR-OM.
Since HR-OM is not on the same ECC6 system, we would like to try the logic: HR-OM -> CUA -> ECC6
There are several documents that describe this situation (ex. SCUR351).
From PFCG point of view, we should create a composite role in CUA system which include simple roles of child system.
If we try to create a composite role in CUA central system, we can insert only simple roles available in central system (and not in child).
Any experience on this scenario ?
Pros vs cons ?
Are the different possible scenarios ?
Many thanks...
Andrea

Whole idea of CUA is to manage your roles and users centrally, on the contrary you can manage the roles/profiles by setting up the attributes for the CUA thorugh Central user Management console - SCUM Transaction.
CUA has its own pros -
Central rep,Users Sync,Role Provisioning statergy - Global composites(consists of individual child roles) Distibuted model -Provisioing at individual child systems for roles, etc.Central user store,easy maintenance.
on the contrary - change documents is always a concern ( because cua uses - interface Ids or the RFC ids to push the idocs from cua to child system), CUA maintenance while system refresh - Copied distribution models have to be deleted and re-created, system backups has to be defined per you distribution model, password maintenance if defined global then Child systems act as inactive nodes, reading the roles into cua which are created in childs so as to establish a pointer to that system.
It also depends on the number of systems you have in your landscape so that you can calculate the overhead and then have a Go -no-Go decison on CUA.
Overall, I consider CUA as a good approach provided we streamline the process of provisioning, de-provisioning per the cua standards.
Rakesh

CUA - System Refresh

Hello,
I am new to CUA and need help in determining the pre and Post steps for CUA during the System Refresh. The System Refresh is performed on the Child System and after the Refresh my original users and Role assignments have to overwrite the users and Role Assignments of the Copying System.How do I retain my original User data ?
Are their any guidelines to this process ?
I am researching oss and forums,and so far I don't have any clear procedure.
thanks,
Farah

Hello Farah,
I think by system refresh you mean system copy.
From system copy perspective follwing steps need to be taken:
pre copy steps:
1. Disconnect CUA. Please go to the child system. Go to TRANSACTION BD64 and delete the ALE model view for CUA.
Subsequently go to parent system. Then to transaction SCUA. In menu bar go to Distribution model and then to Delete. Choose the radiobutton Child System and then give the logical name of the child system.
Post system copy activties:
1. in case the system copy has been performed from parent system of CUA to child system then go to child system and then goto BD64. Delete the exisitng ALE model for CUA. If parent system is not the source system of CUA you can ignore this step. Next Login to parent system. Go to SCUA then change mode and then add the logical system name of child system to it.Next go to SCUG and do user master reconcilliation.for this double click on child system and then under do transfer users wherver it is available.
Frankly these are ideal steps after system copy ahich I follow since there is not much disparity in user master data across systems in my CUA. So even if system copy happens the user master data in child system remains more or less the same.
If at all there is a minor difference I adjust it through SU01 or SU10. However in case there is a major difference then you it becomes a bit complicated. reasons being system copy wil overwrite entire stuff. Whether it is CUA or any other data. Say for example a child role exisits in child system but is not in the source system of system copy then it wont be present after system copy. if there are such issues then let us know. May be we can think
something. otherwise this approach should do the job for you.
Please award points if you found the anwers useful.
regards.
Ruchit.

AC CUP: User created in CUA with system specified

Hello,
I create a new account request to provision a user in the CUA and child systems.
The user is created in the CUA and the child system: OK.
In SU01 of the CUA the system is specified. The pb is that the user can login directly to the CUA (even if he has no role).
I think the system should not be specified for the CUA. Does anyone have a solution to avoid to specify the system for the CUA?
Regards

Hi Simon,
You can config the CUA to allow the creation of user in child client. But then if the user already exist in the CUA, the CUP request will create the user in the child but with a wrong password.
Regards

Role Creating in Central System CUA

Hi,
I am in the process of configuring CUA in my system.
Please let me know if it is possible to create roles in the Central System and push it to child system
Please advice

I think it will help for you
[http://help.sap.com/saphelp_nw04s/helpdata/en/b5/737c4177f1030de10000000a1550b0/content.htm]
[https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/7c16d1f4-0901-0010-528b-f101f94cb09d]
Regards,
Raja. G

CUA - how can I disable child system user record RENAME?

I have setup CUA. How can I disable SU01/RENAME from the child system? If a user is Renamed directly in the child system, the new record is unlocked and can be edited in the child system. These new records are now out of sync with CUA master data.
I dont see an option for 'rename' in SCUM.
Is this how CUA is supposed to work, or can the rename function be disabled?
Thanks.

Ben,
We have installed CUA on solution manager 4.0, the back end (child) system is R3 4.7.
My CUA SCUM shows seperate tabs for Address and Logon data.
On the Address tab Ive set everything to global, its a long list.
On the Logon tab all fields, except for inital password, are set to 'global', inital password is set to 'everywhere', to allow changes directly in the child system.
Just about everything seems to be working, except this RENAME problem. The users are greyed out in the child system, the create button doesnt even exist anymore in SU01 in the child system. Syncing between the CUA and Child systems is working as I expect.
Any suggestions?
Thanks for the quick response.

Optimum Child Systems for each CUA

Hi, Is there a limit to the number of child systems a CUA server can administer ?
Or Is there a recommended number for optimum performance ?
Thanks

Hi,
Setting up the number of child systems depends on your system landscape and the number of clients you are maintaining in each system.
Further it depends on the budget you have, if you have enough budget you can set CUA in the system where Solution manger is running or set CUA as an independent running system.
We have 3 system landscapes with DEV QAS and PRD and CUA is set up on the PRD system.
For the performance issues you need to fine tune your CUA system and you will find many threads in the forum.
Rakesh

CUA on PRD without child systems

Hi,
We are planing to implement CUA on PRD without child systems. And also DEV as the parent for all non-productive systems. Anybody provide pros/cons making PRD as parent without child systems? Is it recommended?
Thanks
Craft

Hi,
CUA without child system is of no use. One of the use that I can explain it to you is say:-
For example:- If you want to assign 10 similar roles to 100 similar user in DEV,Quality or Prod
1.If CUA is present:-
You can assign all roles to all user in DEV,Quality or Prod via CUA which will save your time
2.If CUA is not present:-
You have to assign all roles to all user first in DEV and then Quality and then in Production which will be more time consuming. You have to log in to individual system and then assign.
Even maintainance of user becomes easy if you have CUA system. Even removal of roles becames easier
CUA system without a child system will not be called as CUA system. It will be normal system.

CUA user master table updates from child system

Hi Experts,
In my system although there are roles assigned to users in child system they are not showing up in CUA for few user.
Is there any program in CUA which i can use to update the user master tables for only a limited set of users from child systems.
Regards,
Sandeep

Hi Sandeep,
Just want to check below queries....if this solves your problem..
Is these are the new systems assigned to CUA or moved from other CUA as you said that role assignment is available in child system but not in CUA ? Another thing that I want you to check the User Group assigned to user in child system and in CUA.If user gorups assigned to users are different in CUA and child system or particular group is missing in any one of the system then idoc will not move. Also check the Output device type along with address data...Any mismatch of these will stop the idoc.
After that run the SCUG for all users, in CUA as suggested by akshay, this you can run for all 10 child system from CUA, no need to go in every child system.....

Roles created in CUA are not distributing?

Hi,
I have configured CUA in my system between 3 clients.when am creating a user it is reflecting in the child systems but where as roles created are not reflecting in the child systems.
Even i have check in SCUM roles are maintained GLOBALLY.what may be reason....and how o check the IDOC in WE05?
Thanks in Adavance

Hello:
A CUA is a 'central user administration'.
A CUA does not cover a central role administration. Therefore you need to maintain your roles as usual, means locally in each child system of your CUA.
role assignements ot users can of course been maintained centrally in the central system.
b.rgds, Bernhard

Unable to see user created in Child system

Hi There,
I am facing a peculiar issue with CUA.
1) A user created in CUA is not appearing in Child system.
2)When I checked the IDOC status it is Green(03) in both the systems.
3)When I remove the system in the CUA for that client , it is fine.
4)When i again added the system it is fine in IDOCs as well and when I reset the password the status of IDOC in child system says user does not exist.
Please let me know if anybody had similar issue and any solutions I could look into

Just to make things more clear.
1)logical systems would not be an issue because the idocs would not appear in child system had it been the case.
2)I tried the option to remove the particular child system from the user profile under systems ,saved and then added the system.
When I went to child system, the idoc says user created but again when I reset the password in the CUA for that system and check the idoc in child systems it fails saying user does not exist.

CUA Authorusation on systems

Similar Messages

Maybe you are looking for