Profiles to Roles (4.5B to R/3 4.7)
Hello,
We have a R/3 4.5B system. Apparently Authorizations in 4.5B is handled using Profiles, not Roles.
Migration is going to be done to 4.7 Enterprise in few days.
Kindly help me with the process of converting the Profiles to Roles in 4.7.
Regards,
Gautam.
Hi Gautam,
Best starting point is TR SU25 and the corresponding helpfiles at [saphelp|http://help.sap.com/saphelp_nw2004s/helpdata/EN/e3/3b9e583bc311d5b3cb0050dae02d7c/frameset.htm].
That should get you on your way.
Good luck!
Jurjen
Similar Messages
-
Hi,
I created a few profiles with special roles and metadata fields in my ucm.
I did all the work in my computer and now i want to change the machine(computer) and i don't want to loose all my work.
Are there any ideas how to duplicate all my profiles and roles(my configuration) to another computer??
NOTE: I just want to duplicate my custom environment of the ucm.
Eran zFor this purpose you have Administration -> Comfig Migration Admin (Configuration Migration Utility).
http://download.oracle.com/docs/cd/E17904_01/doc.1111/e10792/c06_migration.htm#CHDBIJAJ
Regards,
Boris -
User Profiles with roles & responsibilities.
How do create the User Profiles with roles & responsibilities in sd
Hi,
This is done with T. Code PFCG. Here we select the userid and give the required roles with which tell what the users can or cannot do.
<a href="http://help.sap.com/saphelp_nw04s/helpdata/en/9d/39d0401117dd50e10000000a1550b0/content.htm">PFCG info 1</a>
<a href="http://help.sap.com/saphelp_sm40/helpdata/en/57/3fc0413f1b6524e10000000a1550b0/content.htm">PFCG info 2</a>
Hope this helps. Please reward if useful.
Thanks & Regards
Sadhu Kishore -
3rd party tools to migrate Authorization profiles to roles
Experts,
Are there any 3rd party tools to migrate Authorization profiles to roles while upgrading to ECC 6.0?
NWHi,
Thanks so much for replying. I posted the errors here (no answers though):
XML to Forms conversion gives error for menus
Error when converting form to XML -
Two user with same profile and role having different authorization
Dear All,
I have very strange case of authorization . We have a new abap developer in our company . Her profile as copied from an exiting abap developer's profile in Development system. But she don't have authorization for lot of transaction that the existing user have. I checked the profile tabs , role tabs . then done the user compare for all the roles , but of no use.
I did a compare of the two uses using S_BCE_68001430 and could see is that the existing abap user is having authorization starting with T_PXXXXXXXX that is giving him extra rights. These authorization is not present in any of the existing role he is assigned to (checked using S_BCE_68001396). The authirsaction in the roles start with T-DXXXXXXXX
Will appreciate if any one can give any input . The problem is i need to assign each authorisation the existing user having manually to the new user.
regards
TonyThanks for the mail.
I check the "Reference User for Additional Rights" -- there is no refernce user assgined.
I checked the table USR04 the no. of Profle for the two users are diffrent and in the table UST04 also the the existing uer is having addtional profiles.
I like to add one more point Some of the roles of the two users are composite roles and both the composite and its orignial roles are included the profile of both users.
Does any one have idea of the authorisations starting with T_PXXXXXXXX
regards
tony
MANDT BNAME PROFILE
100 CHARLHO B_LSMW_ALL
100 CHARLHO T-D1780054
100 CHARLHO T-D1780057
100 CHARLHO T-D1780058
100 CHARLHO T-D17800581
100 CHARLHO T-D1780075
100 CHARLHO T-D17800751
100 CHARLHO T-D1780086
100 CHARLHO T-D17800861
100 CHARLHO T-D17800862
100 CHARLHO T-D17800863
100 CHARLHO T-D17800864
100 CHARLHO T-D1780087
100 CHARLHO T-D1780088
100 CHARLHO T-D1780247
100 CHARLHO T-D1780304
100 CHARLHO T-D1781182
100 CHARLHO T_P0920411
100 CHARLHO T_P09204111
100 CHARLHO T_P092041110
100 CHARLHO T_P09204112
100 CHARLHO T_P09204113
100 CHARLHO T_P09204114
100 CHARLHO T_P09204115
100 CHARLHO T_P09204116
100 CHARLHO T_P09204117
100 CHARLHO T_P09204118
100 CHARLHO T_P09204119
100 TESTUSER2 B_LSMW_ALL
100 TESTUSER2 T-D1780054
100 TESTUSER2 T-D1780057
100 TESTUSER2 T-D1780058
100 TESTUSER2 T-D17800581
100 TESTUSER2 T-D1780075
100 TESTUSER2 T-D17800751
100 TESTUSER2 T-D1780086
100 TESTUSER2 T-D17800861
100 TESTUSER2 T-D17800862
100 TESTUSER2 T-D17800863
100 TESTUSER2 T-D17800864
100 TESTUSER2 T-D1780087
100 TESTUSER2 T-D1780088
100 TESTUSER2 T-D1780247
100 TESTUSER2 T-D1780304
100 TESTUSER2 T-D1781182 -
Profile and roles internet sales
Hi.
I need profiles and roles that are use in internet sales.
ThanksThere are basic three type of user in ISA.
1) B2B_FULL
2) B2B_ORDER
3) B2B_VIEW
<b>For B2B Full below is the Roles</b>
SAP_ISA_B2B_FULL
SAP_ISA_SUB_BILLING_VIEW
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CONTRACT_UI
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_ORDER_MAINTAIN
SAP_ISA_SUB_QUOT_DISPLAY_UI
SAP_ISA_SUB_QUOTATION_UI
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
<b>For B2B_ORDER</b>
SAP_ISA_B2B_ORDER
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CONTRACT_UI
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_ORDER_MAINTAIN
SAP_ISA_SUB_QUOT_DISPLAY_UI
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
<b>For B2B_VIEW</b>
SAP_ISA_B2B_VIEW
SAP_ISA_SUB_CATDISPLAY
SAP_ISA_SUB_CATPRICE
SAP_ISA_SUB_CUSTOMER_READ
SAP_ISA_SUB_RFC
SAP_ISA_SUB_TEMPLATE_MAINTAIN
pl. reward a point if it helps you.
Thanks and Regards.
Ashish Patel. -
Difference between profile and role
Can any explain me the difference between profile and role.
I was given a user Id on ABAP stack of XI.
My profile: SAP_ALL
I was not assigned any roles.
I am not sure if I need different roles or this profile
would serve the purpose.
-Naveen.Hi Naveen,
Adding to Gus points a few more inputs.
Profiles were the menas of assiging authorizations to users until 4.0 Versions.
Later to the same it was upgraded to the concept of Roles. The crux always remains the same.
Be it a profile or a role, it contains the Auth Object and the respective values.
But in present scenario, you can get confused by the profiles that are assignable to Users.
IN short the following points can be helpful.
1. The profiles like SAP_ALL;SAP_NEW,S_SPO_ALL etc are standard Profiles delivered by SAP which when assigned to a user in his profile in SU01 would get all the related authorizations.
( You must be lucky to have SAP_ALL assigned to ur ID by ur basis guy)
2. A role is created by assigning a few transactions to this role and when this role is generated, it generates a PROFILE. But this profile is a system generated one and cannot be ever assigned to any user. These profiles can be sorted out as they have the standard naming like T-XXXXXXXX where they are the numbers and it can never be assigned to any user.
3. Note prior to 4.0 its all Profiles that are assigned to users and later to the same came the concept of Roles and hence this change.
Hope the answer is helpful in making u undersand a few inputs form my side.
FYI:
Method to create a role can be checked out from the link below.
http://help.sap.com/saphelp_bw21c/helpdata/en/52/6714b6439b11d1896f0000e8322d00/frameset.htm
Br,
Sri
Award points if answer is helpful. -
Transfer of profiles to Roles in PFCG
Hello,
yes i know that it is possible to transfer profiles to roles in pfcg.
This is possible over
EDIT>Insert Authorization->from Profile
But we need to transfer over 500 Profiles to new roles. Do we have a change to automating this process? Or do we need to do this manuell for any profile?
Gruß
A. SteinhäuserHi Julius,
thank you for the tip with SU25. Did not remember that there was a point 6
This will perhaps an option to import all our mauell profiles to roles.
After this, i think we can use ECATT to rename the new roles to the naming conventions.
Gruß
Toni -
Oracle Profile and Role scripts
RDBMS :Oracle 10.2
Hi,
I have several Profile and Roles on my server.
Can I extract sql to create those Profile and Roles ?
e.g. I have role datareader, I want to extract its creation script and it include all the privileges assigned to that role
thankstry
SELECT dbms_metadata.get_ddl('ROLE', 'datareader') FROM dba_roles;
SELECT dbms_metadata.get_granted_ddl('ROLE_GRANT', 'datareader) FROM dual;
SELECT dbms_metadata.get_granted_ddl('SYSTEM_GRANT','datareader') FROM dual;
SELECT dbms_metadata.get_granted_ddl('OBJECT_GRANT','datareader') FROM dual;
datareader should be in CAPS -
Error while creating user - not authorized to assign profiles or roles
I have configured CUA according to the help.sap.com instructions. I am getting this error (in TCODE SCUL)..
+You are not authorized to assign profiles
Message no. 01589
You are not authorized to assign profiles to users or to cancel the authorization.+
I can create the user, change the address data, and initial password.
I get errors on assigning to a group, parameters, or the role and profiles.
We are on NW Mobile 7.1 (ABAP stack only) SP05.
I've read Note "492589 - CUA: Minimum authorizations for communications users."
It mentions SP07. Is this not compatible?> Run SU53 (immediately after you receive the error message) and check which authorizations that failed. You probably miss S_USER_PRO with activity 01 or 02 from your own roles.
I think that will not work in his situation. The errors show up in SCUL so they may come from one or more of the CUA children. Running SU53 in the CUA master will (if that is the case) not provide the necessary info. -
Custom Auth. Object with Profile and role assignment not working
Hi,
I have created custom Authorization Object with field ACTVT with allowed values - 01,02, 03. Now test it with custom program using AUTHORITY-CHECK OBJECT 'Z_AUTHORIZ' it is working fine and returning sy-subrc 12. At this point i have not created any role using this Auth Object.
Now I have created custom role ZPM_**** and assigned above Auth object to it with value ACTVT 03. Assigned this role to user.
When I try to test the above custom program with any ACTVT value it is giving sy-subrc as 0. Used below custom code in program.
AUTHORITY-CHECK OBJECT 'Z_AUTHORIZ'
ID 'ACTVT' FIELD '01'.
Am I missing anything? The profiles are generated correctly.
Best Regards,
NileshBelow are the screen shots for PFCG:
-
Creatkion of customized profiles and roles
Dear Experts,
Im new to SAP and SDN.
My requirement is that i need to create a new profile for technical people
as z_tech_role giving access to transactions as SE38,S71,smartforms etc.
Similarly a functional one needs to be developed as z_func_role access to Se16,
solar01,solar02 ,va01,ad other VA transactions.
The same for a workflow profile.
Can you please provide me with steps how i need to create this profile and how to attach roles in it to the profile.
Thanks in advanceHi,
There is one forum for SAP Security, you've to post this message in that forum to get quick and exact reply..
Anyways, please follow the help.sap link above povided already.
Somebasic concepts:
1. Tcodes are assigned to Roles.
2. When Roles are generated, they create profiles.
3. Roles are assigned to Users. (profiles are not directly assigned, except few like sap_all, sap_new etc)
So what you can do, create a role z_tech_role in PFCG and add transaction SE38,S71.. etc.then maintain authorizations, generate the role. and then go to user tab, add the users whom you want to be assigned with the new role z_tech_role. (role assignement can also be done in SU01, roles tab)
Thanks,
Debasis. -
Profiles for Roles showing as not generated
My newly created roles show that their profile versions are not generated although the authorizations tab in PFCG is green and the authorization profile status states that it is generated. No errors were encountered when the role was generated. Older role profiles are OK.
Any thoughts or suggestions would be greatly appreciated! Thank you in advance!
Rose SchirmacherMy results were the same if generated in Display Authorization Data instead of Change Authorization Data.
Thoughts? -
Assigning Authorisation profile to roles
Hi All,
I have created a new authorisation profile by copying from the standard profile and activated the same, I have created a role using PFCG and assigned it to the user via SU01, but still the user has not got the required authorisations.
When i try to assign this profile to the role via PFCG, i am not able to assign
Either i have to select the transactions from the menu tab and the system is creating new authorisation profile and assigning it to the user,
can anybody help me out in assigning the authorisation profile to the roles
Regards
VenkatHi Venkatesh,
Short of performing an upgrade step via SU25 to convert the profile to a role (which you really don't want to do!), you can't do this to the best of my knowledge.
PFCG is called profile generator because it creates the profiles for you based on what you enter into the menu tab and the corresponding auth values that you maintain within the role via PFCG.
I strongly recommend that you build a role via PFCG and create it with the right combination of menu transactions and auth values. You can then assign this to the user. This is the standard way of maintaining authorisations now.
Alternatively you can assign the profile you have created to the user, however if the role build is role based, I would not recommend this approach at all. -
BAPI to create,get Profiles and roles
Hi,
I am using the SAP RFC SDK to do the provisioning of entities in the SAP environment.
My SAP system is 6.20 .
I wanted to know if there are BAPI's which exist for the following
a)Profile creation
b)Profile Fetching
c)Role creation
d)Role Fetching
I could not find the same in the SAP IDM document provided for IAM vendors
Best Regards
ManojHi Manoj,
Everything you need to know about this, and more, can be found in the following PDF from SAP: <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/668e6629-0701-0010-7ca0-994cb7dec5a3">SAP Identity Management APIs</a>.
In summary:
To find a user's roles and profiles, use <b>BAPI_USER_GET_DETAIL</b>.
To assign & delete a user's roles, use <b>BAPI_USER_ACTGROUPS_ASSIGN</b> and <b>BAPI_USER_ACTGROUPS_DELETE</b>.
To assign and delete a user's profiles, use <b>BAPI_USER_PROFILES_ASSIGN</b> and <b>BAPI_USER_PROFILES_DELETE</b>.
Hope this helps,
Darren
<a href="http://www.fortybeans.com/">My blog</a>
Maybe you are looking for
-
When using Photoshop Elements 9 as external editor my iPhoto version does not update
I am using Photoshop Elements 9 as an external editor in iPhoto V9.4.2 My photo's are Raw and they open in Elements fine for me to edit. When I go to save or exit I have problems. I get options to choose from - I am assuming that saving them as JPEG
-
Hi - wonder if anyone else has this problem...? I have three Framemaker book files. To simplify (and reduce the number of files, let's say I have: * Master book file file a file b file c file d * Book 1 file a file b file c * Book 2 file a file b fil
-
"Save as PDF" breaks up the document into multiple PDFs
Ever since my Lion install, when I open a doc in MSWord and try to "Save as PDF", it breaks up the document into multiple PDFs, not one saved PDF. Haven't seen this problem before. Anyone else experiencing this new "feature"?
-
PDP: How to transfer PR manually?
Dear expert, I met an issue that , in PDP, if the PR transfer failed, I need to transfer the PR again. Until now, I have only the resolution that enter an PR manually into table EPRTRANS and run report BBP_EXTREQ_TRANSFER manually. The reason why I d
-
Text dataSource Identification
Hi, I need to find out Text Master DataSource for Billing Doc type.I will provide my InfoCube details.Sothat it would be easy for you to advise me.I have the following InfoObjects in my Cube dimensions. 1.Sales document --- 0DOC_NUMBER 2.Sales Docume