FICO and SPRO access in development system

hi security admins,
i am a security consultant. now i am in development system. i want to give FICO access and SPRO access( only fico nodes should be authorised to access, others nodes should not authorised ) in development system. please suggest and tell me the procedure for restricting specific access.
regards
ramesh

>
Dimitri van Heumen wrote:
> using search will give you useful topics such as [this one|Trace File|UTFS]
Dimitri,
That one links me to a thread about trace files..... or am I missing something here?

Similar Messages

Query developement and se16 access on productive system

Hi,
we are setting up an authorization concept on ERP2004s and our users asking for query development rights and se16 on our productive system. I think queries and se16 should be on the test system due to security reasons. Please post some feedback how do you think about it!? I think queries should be developed on the test system and transported.
Thank you in advance!
Best regards
Frank

Hi Frank,
I dont think that you can give access to writing a quaery in production system.
writing a query also need access to:
Transaction Code: SE16
Authorization object: S_TABU_DIS
Activity: 02 AND 03
Risk: The risk here is that users who have this access, have the ability to maintain table data directly in the production system. This includes transactional, masterfile, security and configuration data.
Hope it is useful.
Please award points if it is useful.
Thanks & Regards,
Santosh

Groups having which folders and universe access in a System

Hi All,
I have requirement as need to fetch data each group having access to which folders and which universe (if any).Can anyone assists me to write q query for the same.
For Example :
One group having access to which reporting folders and which universes.As our system has nearly 150 groups and more than 500 groups and many universe. Manually giving access of each group and checking the access from infoview is TDS Task.
Thanks in advance,
Sambasiva

Although, I suppose it'd be better off to just get a 570 at that point. The price would be about the same and would perform up to par with the 6870, while having CUDA/Folding support. Still curious if it's possible.

SM30/SM31 and SE16 access in Production systems - Confusion

Hi Security Experts,
Could any one give some information why SE16 or Sm30/SM31 access should not be granted directly in production systems even if its for a custom tables which are assigned to authorisation groups?
I have been going through lot of forums where every one says access to tcodes should be restricted or access need to provided in alternate way but i could not see the clear information on why this is should not be granted?
I can think of risk providing to standard table authorisation groups but i don't understand the reason why custom table access via SM30/Sm31/Se16 should be restricted?
Could any one explain the implications of granting the access directly, if possible please provide information from audit point of view.
In our company there are many users who have got access to SM30/Sm31 to maintain z* tables which are assigned to authorisation groups, is this a security risk?
Please shed some light on this. Your information is much helpful in clearing my doubts and is much appreciated.
Thanks,
Sandhya

What you should also consider is that S_TABU_RFC lets you remotely turn the S_TABU_DIS checks off for specific tables if you create a view to them.
It means that the calling application has taken care of the security before the call and the application user authorizations are correct and the view is correctly designed.
Normally display activity in the debuger (s_develop actvt 03 object type DEBUG) is sufficient in the remote system to see everything in the target system - depending on the authorizations of the technical SYSTEM or COMMUNICATION user. These should ideally not access tables directly.
For table / view comparisons you can use a "current user" destination (or use trusted RFC).
It is unrealistic to restrict users to trouble shoot local problems, so you should ideally implement only the business scenarios for the RFC steps and those should be BAPI application type and not direct table access or generic interfaces to run programs, perform subroutines, install programs, etc.
It is quite easy (with lots of time) to build a catalog of access from the (remote) application to datavia APIs, but you must first get away from the direct table access and control the client access to the generic functions and transactions.
SE16 / Sm30 and many reports and function modules which can very easily be started by adventurous users which offer exactly that.
If the users are doing axactly that then from a security administrator perspective you can only try to restrict it and process "tickets" all day long...
Cheers,
Julius
Edited by: Julius Bussche on Oct 2, 2011 9:12 PM

Access Rights in Development system

Hi,
I would like to understand whether as a practice, access rights in development system also follow the same principle of need to know and need to do basis,
or generally all the users having access to development system are given the same access rights?
As only SAP support personnel or developers have the access to the system, Can the access to configuration (SPRO) be restricted to the respective relevant modules like MM consultants will have access only to the MM module and SD will have SD module etc.
I am also interested in understanding how the access can be restricted to the respective modules? i.e. what are the authorization objects relevant for this purpose?
Thanks in advance for any help.
Krishna

>
Krishna Mohan Unnam wrote:
> I am also interested in understanding how the access can be restricted to the respective modules? i.e. what are the authorization objects relevant for this purpose?
> Krishna
The activities within the implementation mainly consists of one thing. Transaction codes. The tricky thing is to find out which transaction code to use, but... SAP have developed a smart tool where you define a project in SPRO_ADMIN and there you assign activities by selecting nodes from the IMG. This can then be inserted into a role via PFCG.
You will find many hits that give you tips on how to work with it if you search in the forum!
Regards
Fredrik

NI LabVIEW Base Development System for Windows and NI CVS-1454

I have NI CVS-1454 and NI LabVIEW Base Development System for Windows (LabVIEW 8.5, no LabVIEW Real-Time Module and Vision Development Module). How can I build a LabView-program and run it on my CVS-1454?
Kirill Kostousov

Hi Kirill,
In order to use your CVS-1454 you will need to buy the LabVIEW Real-Time Module and Vision Development Module as these features are not supported in your version of LabVIEW.
Thomas Clark
Applications Engineer
National Instruments UK & Ireland

New Development system copy from Production

Hi All,
Hope you can help me out here with some ideas.
We are currently planning to implement a new SAP BW Development system, and for this we would like to make it a 1:1 copy of our current production system. Meaning all from customizing, ABAP, workbench objects etc.
But what we do not want is all the transaction and master data in infoobject, cubes etc., we are only interested in the structure and objects. Therefore we can rule out "System copy".
My question is then, is there any other ways to do this when system copy is a no go? I know we can do client copy but then we will not get all the workbench / ABAP programs which we need.
Any ideas on how to do this?
Thx. in Advance

Hi Rasmus,
But what we do not want is all the transaction and master data in infoobject, cubes etc., we are only interested in the structure and objects. Therefore we can rule out "System copy".
Options 1: As BI objects are cross client , copying client will not solve your purpose 100%.
You can perform system copy and then clean up data in DEV
Option 2: You can create a new Development and then create TRs for required configuration objects and move to new development system.
Option 3: Use SLO tools to perform container copy without any data.
Hope this helps.
Regards,
Deepak Kori

I have just sought to update my lightroom and am now unable to access the develop function and get a note stating that I have reduced functionality what it this about and how do I get my product back

I have just sought to update my lightroom and am now unable to access the develop function and get a note stating that I have reduced functionality what it this about and how do I get my product back

Hi there
I have version 5.7 and every time I opened it I was told that updates are available and to click on the icon to access these. Instead it just took me to the
adobe page with nowhere visible to update. I then sought to download lightroom cc and this is when I could not access the 'develop' section due to reduced
functionality It was apparent that my photos had been put in cc but no way to access them unless I wanted to subscribe.
I have since remedied the problem as my original lightroom 5.7 icon is still available on the desktop and have gone back to that. I do feel that this is a bit
of a rip off and an unnecessary waste of my time though.
Thank you for your prompt reply by the way.
Carlo
Message Received: May 04 2015, 04:52 PM
From: "dj_paige" <[email protected]>
To: "Carlo Bragagnolo" <[email protected]>
Cc:
Subject: I have just sought to update my lightroom and am now unable to access the develop function and get a note stating that I have
reduced functionality what it this about and how do I get my product back
dj_paige created the discussion
"I have just sought to update my lightroom and am now unable to access the develop function and get a note stating that I have reduced functionality what it
this about and how do I get my product back"
To view the discussion, visit: https://forums.adobe.com/message/7510559#7510559
>

VISA Write differs between TS Development System and LV Run-Time Engine

Hi all
I made an application on LabVIEW to test BERs (Bit Error Rates), and I used VISA Write between two COM ports to exchange data.
Everything works fine using just LabVIEW.
Afterwards, I used TestStand to call my application (VI). The LabVIEW adapters from TestStand were set to Development System by default, and everything works OK!!
Finally, I needed to disable the development system, and set the LabVIEW adapters from TestStand to LabVIEW Run-Time Engine and I notice that the speed of the data exchange between the two COM ports decreased dramatically.
The only difference was the speed...because all the data (changed slowly in this case) arrived correctly on the other COM port too.
The symptom was the same as decreasing the baud rate...but the baud rate and all the other configurations remained the same. The only difference was the change between Develpment System to Run-Time Engine to notice this decreased speed between the exchanged data using VISA Write.
Any solutions for this?
Thanks in advance
Joao
Solved!
Go to Solution.

Joao,
you state that using the LV Developement System as execution platform for your LV code modules result in faster datatransfer between the COM ports than using the LV Run-Time Engine.
So i am pondering: Does this refer to TS at all?
Please check the following:
Run you communication using a sole LV application in LV Developement System. This should be fast. Now build an executable of this application and run that one. Do you see the same behavior?
If there is no difference in a sole LV approach, there have to be some settings in the TS approach making this slow. So please let us know:
Are there different modules involved in that data transfer (which in fact points to the reply Christophe made)?
What about loading/unloading options of the modules?
How big is the hierarchy of the modules, e.g. is it necessary for the RTE to load stuff the Dev Env has already in memory due to loading a lvproj.......?
Could you provide a simple example sequence+modules showing this behavior?
What versions of LV and TS are you using?
hope this helps,
Norbert
CEO: What exactly is stopping us from doing this?
Expert: Geometry
Marketing Manager: Just ignore it.

LV 8.6 will Not Compile in LV 2010 - Labview 10.0 Development System Has Encountered a Problem and Needs to Close

I submitted this support request to NI on 8/12/2010.
When I compile my LV 8.6 app in LV2010 I get this error:
"LabVIEW 10.0 Development System has encountered a problem and needs to close. We are sorry for the inconvenience."
I was told to do a "Mass Compile" of my LV 8.6 app in LV2010...this failed too.
I was then told to go to each and every vi and "Mass Compile" individually...after about the 50th vi this got old quickly...and it still didn't compile. I then sent NI tech support "my code". The good news is my LV 8.6 app didn't compile with LV2010 @ NI.
My LV 8.6 app compiles and runs great in LV 8.6. I don't want to be left behind with the newer upgrades and I want to move to LV2010. I have lots of LV8.6 code to maintain and I really don't have the time to debug all of my apps.
I was told this will be looked @ in LV2010 SP1.
One note...back up your LV8.6 data before you move to LV2010. Once your LV8.6 code is compiled in LV2010 you will not be able to go back to LV8.6.
I restored all of my LV8.6 code and I'm back working with LV8.6.
It's a tough call, do I stay in LV8.6 and get left behind?
Do I bite the bullet and try to debug this mess in LV2010?
I was told the compiler is completely different in LV2010. That's great, but one reason I have NI Maintenance Agreement is to keep updated with the latest software. I can't afford to re-compile LV code every few years. Like most people, maintaining my Apps with customer's revisions, and modifications is enough work. I don't want more work!
I was told LV2010 SP1 would likely appear in May or June of 2011. I'd hate to break out my old Turbo Pascal apps again...but hey...they still work! My NI maintenance agreement is due this month too, I guess I'll pay NI one more year, and see if they come up with a solution. But if NI doesn't fix this LV8.6 compile in LV2010 problem...I don't see any value staying current with LV software.
I found another Bug with LV2010...you are going to love this one!
There is a new "LV Update Service". Perfect! I like updating my LV software when new patches are available. When I click "update" the update spins over and over "Checking for New Version". I have let it run ALL day with no results...just sits and spins over and over.
OK, I know give NI a break! Yes, LV2010 has a new compiler...and Yes, I will renew my NI maintenance agreement. I just want NI to know failing to compile just one LV8.6 app in LV2010 is not a good idea for customer relations.
Thanks,
Doug

For your update service problem
Unable to Update Current Version of NI Update Service
Why am I Unable to Update My Version of NI Update Service in Windows Vista or Windows 7?

HT1923 I have a Vista Operating system with 2 users. Somehow I got two different play lists each with one user. One is too big for the storage and has a vast amount of duplicates. Can I delete the one that is twice as large and then access the other li

I have a Vista operating system with 2 users. Somehow I got two diffent libraries for the users. How can I delete the one and then access the correct library on the other users profile?

Use the trackpad to scroll, thats what it was designed for. The scroll bars automatically disappear when not being used and will appear if you scroll up or down using the trackpad.
This is a user-to-user forum and most people will post on here if they have problems. You very rarely get people posting to say there update went smooth. The fact is the vast majority of Mountain Lion users will not be experiencing any major problems with the OS, or maybe with apps which are not compatible, but thats hardly Apple's fault if developers don't update their apps.

What is the difference between developement system and delivery system?

Hello Experts,
I have some questions regarding publishing the content on delivery system.
Could some one help me.
1) Can we use Development System as Delivery System?
2) Can we Publish a Site into Development System?
3) How to check whether the installation done in development mode or in delivery mode? I mean do we have any procedure to check ?
4) What are the Advantages of Delivery System over the Development System?
Note: I installed Webcenter sites11gR1 on Weblogic10.3 server and windows 7.
Thanks in advance
Rajendar.

Rajendar Raj wrote:
I got the answers.
1) Can we use Development System as Delivery System?
Ans:
Yes, a development system contains the same functionality as a delivery system. Conversely a delivery system doesn't have a contributor interface so it cannot be used for managing assets.
Not recommended and it also depends on the sizing of your environment and tuning. Delivery systems usually are architected with performance in mind, depending on the expected load, logs are minimal and usually Remote Satellite Servers are added. Important as well is that no content or any assets is created directly on the delivery system, you might run into unique ID constrains when you publish content from Authoring to Delivery, in your case Development.
2) Can we Publish a Site into Development System?
Ans:
Yes, you can.
Be careful this is not recommended, you can run into unique id constraints issues
3) How to check whether the installation done in development mode or in delivery mode? I mean do we have any procedure to check ?
Ans:
Look in the ominstallinfo directory, in the location where WebCenter Sites was installed. there is a file called omii.ini that contains installation-time choices and parameters. Look for the parameter "Development"
- true, indicates it was a Development type install. Advanced UI will be available, as will the Contributor UI
- false, indicates it was a Delivery type install. Only Advanced UI will be available.
4) What are the Advantages of Delivery System over the Development System?
Ans:
A delivery type install is more secure, as the contributor UI and some other editorial components are not installed. It also prevents editors from changing content on the delivery system by mistake.
In general Delivery systems are architected different, more emphasis on performance, caching and security.
Thanks and Regards
Rajendar.Regards,
Rodney

Transport Webi Reports and Web services as the backend of dashboards from BO Production to BO Development system

Hello Experts,
I am working on SAP BO 4.1. I have made several dashboards on top of web services ie;Web Service Method. I have 2 systems in BO ie; Development and Production Systems.The BW production system is connected to BO Development and Production both.
The Webi reports are made on top of BI BEx Query. From the webi reports, BI Web Services are made on top of which the dashboards are made further.
The Webi Reports, Web Services and the Dashboards everything is made directly in BO Production.
My question is, Can I transport the Webi Reports and the Web Services from BO Production to BO Development?
And If yes, will it have any other impact on webi reports, web services or dashboards?
Thanks & Regards,
Alfred Thomas

Hi Gill,
As per your reply,with the promotion managament i have make the web services again manually in Dev system...Right?
Is there any way possible that i can transport the webservices and the webi reports usind Query AS A Web Service Designer. And if yes, through this QAAWS will the WSDL or the URL required for the web services in the connection button in dashboards will automatically updated or changed as per the Development System?
But i am not able to enable the "Deploy to Other servers Option" in QAAWS.
Can you please help?
Regards,
Alfred thomas

Service product replication for test and developement system

Hi Experts,
In our scanario service product is created in production system and later manually created in test and developement system.
Is there is any standard function module avilable to replicate the product master data into test and developement system
Or Is it possible to use the middleware functionallity to replicate the service product details.
Please advice on this issue.
Thanks,
Senthil .R
Edited by: Senthil Vadivelan R on Dec 17, 2007 3:46 PM

You can use the FindFile method in the TS API:
FindFile Method
Syntax
Engine.FindFile ( fileToFind, absolutePath, userCancelled, promptOption = FindFile_PromptHonorUserPreference, srchListOption = FindFile_AddDirToSrchList_Ask, isCommand = False, [currentSequenceFile])
The function itself returns a boolean which indicates if the file exists or not.
Then just use a Call Executable step to run command line string to delete the file.
Hope this helps!
jigg
CTA, CLA
teststandhelp.com
~Will work for kudos and/or BBQ~

Full production refresh to development systems and Charm?

Hi SDN Community,
Where I work we have a policy of refreshing the development systems (ECC, CRM, APO, BI, SRM) on an annual basis with full production system data, HR data is subsequently wiped clean from the development system.
For each of our systems we have a development system, a QA system and a production system.
The decision to do these full refreshes was taken to ensure that developers and configurers can do decent testing in the Dev environments - prior to transporting to our QA system - to ensure that we have a reasonably stable QA system. Prior to the refreshes - QA was considered too unstable by our business to be used as a good test platform - the full D refreshes solved this problem.
We have recently installed SAP Charm (Change request management) which is a solution manager based product that manages the transportation of objects in change requests - attached to maintenance cycles.
During our first development system refresh we discovered that all open Charm projects (maintenance cycles) were placed into an unuseable status due to the refresh. This means we had to rebuild all of the Charm projects after the refresh - which took a considerable amount of time + resources and delayed project work. We don't want to be in this situation again for our next refresh.
SAPs response to us has been that they have no other customer that does full Development system refreshes - and also has Charm. I wonder if this is accurate, I think what SAP are saying is that they don't have many Charm customers... Is refreshing Development so uncommon?
We are considering products like SAPs TDMS - and alternatives (eg gold client) - but most of these appear a little immature - for refreshing complex system landscapes - such as ours and keeping everything in synch after the refresh.
My questions to SDN -
What do you do - do you do full refreshes to your D systems?
If not - what are the arguments against refreshing D systems (is this considered bad practice)?
Are there any other Charm customers out there in a similar situation to us?
How do you manage the stability of your QA environments and stop the transport into QA systems of untested changes - if your D systems are not similar to you production system
(note we have some 300 active users in just our ECC development system)?
Any suggestions / recommendations as to how to best proceed would be greatly appreciated.
many thanks in advance,
Julian Phillips
Edited by: Julian Phillips on Nov 11, 2008 2:33 PM

Thanks Naushad for your reply,
I wonder if D refreshes are less common - more due to the additional hardware costs incurred (disk space needed to store full production data is usually pretty large) to do them - than due to avoiding disrupting development - probably a bit of both.
I did not mention this - but in our refresh we do reimport all transports that we open prior to the refresh - which used to solve our problems - in terms of restoring active changes - but with SAPs Charm system - this approach does not work as the Charm projects are left in an inconsistent status.
We are now leaning towards introducing a 4th set of systems into our landscape - so that we have the following platforms:
Development ---> Pre QA ---> QA ---> Production
This approach will allow us to keep both the Pre QA and QA systems refreshed every 6 months or so - and our new Dev system - we will refresh very infrequently (every 5 years perhaps) if at all. We will tie the Charm system to our new development - and this system will then not be impacted by refreshes. This approach means additional hardware cost - but as it happens we have a few spare boxes - so this maybe our best bet.
The core reason for our refresh is so that we will be able to preserve the stability of our QA test platform - which for us is the critical factor here. If QA has poorly tested work in it - we run a higher risk of disrupting other testing and also of this poorly tested work reaching production.
When we used to have a development system as you described and just the single QA box - we experienced frequent instability in our QA box - due to poorly tested working reaching it - and this delayed numerous projects.
Does anyone else have a 4 box setup like this? Anyone else encountered this on an SAP project anywhere? Pros / Cons of this approach?
//Julian
Edited by: Julian Phillips on Nov 12, 2008 8:08 AM
Edited by: Julian Phillips on Nov 12, 2008 8:18 AM

FICO and SPRO access in development system

Similar Messages

Maybe you are looking for