Max roles & Profiles in user?

Question

How many roles can we assign to the user? What is the maximum limit of  the roles and profiles for the user?? *

Answer 1

Dear Praveen,
You can assign <b>300</b> authorization profiles to a user (see SAP Note <b>410993</b>).
Note 410993:
You would like to know the maximum number of:
profiles per user
authorizations per profile
authorization values per authorization
Reason and Prerequisites
All maintenance transactions work with the USR04, USR10 and USR12 tables.
Solution
As of Release 4.6A, the structure of the database tables used, and not the kernel, causes some restrictions:
1. Table USR04: Profile assignments for users
              This table contains both information about the change status of a user as well as the list of profile names that were assigned to the user.
              The PROFS field is used to save the change indicator (C = User created, M = User changed) and the name of the profiles assigned to the user.
The field is defined with a length of 3,750 characters. Since the first two characters are for the change indicator, 3,748 characters are still available for the list of profile names per user. Since the maximum length for each profile name is 12 characters, the maximum number of profiles per user is 312. Note 841612 delivered a solution for increasing the number of usable profiles per user from 300 to the maximum value of 312.
              Possible enhancements:
When you use roles exclusively, the number of profiles per user can only be doubled by assigning a reference user.
If you also use manual profiles, you can combine these to form collective profiles.
              Caution: In principle, we must advise against using these options. Reason:
Enhancements of this type increase the risk of an unwanted summation of authorizations. On the other hand, the number of entries also increases in the user buffer for authorizations (table USRBF2), which may result in longer runtimes when you perform authorization checks.
2. Table USR10: Authorizations or subprofiles per profile
              Due to the length of the AUTHS field (3,750 characters), you can enter the following maximum values in the manual profile maintenance (transaction SU02):
300 subprofiles    per collective profile or
150 authorizations   per single profile
Of course, the maximum value of 150 authorizations applies to the profiles generated in transactions PFCG or SUPC. Therefore, after you exceed this threshold, a new profile is automatically created.
3. Table USR12: Authorization values per authorization
              To save the authorization values, you use the VALS field, which is 3,750 characters long (just like the PROFS field in the USR04 table). Since the values can have different lengths, the number of values per authorization also varies. If you are unsure about whether VALS can accept all of the values that you maintain, you can check the length of the character string using the following formula:
NSTRING =
3 + 18*NFLDS +
NNORM(    1)(MAXLEN(    1)+1) + NGENE(    1)(MAXLEN(    1)+3) +
NNORM(    2)(MAXLEN(    2)+1) + NGENE(    2)(MAXLEN(    2)+3) +
...                                                            +
NNORM(NFLDS)(MAXLEN(NFLDS)+1) + NGENE(NFLDS)(MAXLEN(NFLDS)+3)
What the parameters mean:
NSTRING   = Total length of the character string in VALS
NFLDS    = Number of fields in the authorization object (10 = maximum)
MAXLEN(I) = Number of characters in the longest value in field I
NNORM(I)  = Number of normal (not generic) values in field I
NGENE(I)  = Number of generic values in field I
I = 1, ..., NFLDS
The absolute maximum length of an authorization value is 40 characters. NNORM(I) and NGENE(I) are the total number of values maintained in the 'From' and 'To' columns in field I.
Example:
The following authorization (chosen at random) for the S_USER_AUT object demonstrates how to apply the above formula:
Field No.  Field Name   From Value          To Value
   1       ACTVT        03
                        08
  2      AUTH         TESTFIAUTH00        TESTFIAUTH10
                        Z*
  3       OBJECT       F_KNA1*
                        F_BKPF*
                        F_KNKK_BED
The variables have the following values:
NFLDS = 3
  I       MAXLEN(I)    NNORM(I)    NGENE(I)
  1          2           2          0
  2          12          2           1
  3          10          1          2
This results in the following value for the length of the characterstring in the VALS table field:
NSTRING = 3 + 18*3 +
          2( 2 + 1) + 0( 2 + 3) +
          2(12 + 1) + 1(12 + 3) +
          1(10 + 1) + 2(10 + 3)   = 141
Further explanations:
If NSTRING is greater than 3,750, the authorization cannot be activated or generated, which means that the values must be distributed across several authorizations. Exception: The profile generator can automatically divide authorizations in roles (activity groups) with just one field (example: the S_TCODE object) into up to 100 generated authorizations.
If profile generation fails because a role contains too many values for an organisation level, you cannot use additional authorizations to solve the problem. Due to the cross-object validity of organizational levels, their values would automatically be copied to the new authorizations. In this case, you only have the option to distribute values across several roles.
Hope this will help.
Regards,
Naveen.