Role Authorization Profile Search

All,
We are trying to identify all the derived/single roles that are not generated without going into each individual role and looking. Is there a serch or query that allows us to identify what roles are not generated?
Also, with these roles we have identified a couple derived roles that were not generated and where the others derived roles related to these roles were generated. What is the best way to move these up? Should we just identify which roles were not generated correctly and put them in a mass transport?
Any suggestions and/or ideas are appreciated.
Thanks,
-Daniel

Daniel,
run TX SE38...enter the program name... RSUSR020 -> and click on the activate tab to activate the report.
or
SUPC will give you a list but you don't have to generate them at the same time., but I think there is an option to automatically generate profiles after the selection just make sure that the box isn't checked
After this you can go head with mass transport / one at a time.
Thanks,
Sri

Similar Messages

Role or Profile with Full Authorization in DISPLAY MODE

Hi all,
Can anyone help me or tell me if there is any standard role or profile which has full authorization in display mode.
I wanted to assign this to all our support team for the PRD server who shud only have the display auths so that the pre-production client can be safe.
I have checked many places for this kind of activity, but found no threads on the same and also realted links.
Can anyone tell me how to get this task done....
I have also tried few possible ways which never helped me and all my efforts failed.
Waiting to hear from SDNs, for which i can assure REWARD POINTS.
Thanks to all in advance
Regards
Hari Haran

Hi,
By enabling the permission level as 'read', the authorized user/group/role can:
1. View the object in the Portal Catalog using the browse and search capabilities.
2. Open the object in its respective primary and secondary editors in read-only mode; the object cannot be modified.
3. Create instances (delta links and copies) from the object.
4. Gain access to and choose templates in the object creation wizards.
This permission level can be used to prevent portal administrators from editing a particular object, while still allowing them create an instance of the source and use the new instance in any way
Regards
Srinivasan T

After BI 7.0 Upgrade, Authorization Roles and profiles are not visible

Hi Gurus,
We have an issue with authorization roles and profiles are not visible for all end users with new Bex Analyzer (BI 7.0) tool. But still they can see these roles with old Bex Analyzer ( Bex 3.5) tool.
As a developer I have SAP_ALL acces and I can see all authorization roles in new BEx Analyzer (BI 7.0).
I verified in SU01 for user access and every are assigned there roles and they are green.
Do we need to add any new authorization object to fix this issue, please let me know
Thanks and appreciate your help.
Thanks
Ganesh Reddy.
Edited by: Ganesh Reddy on Oct 26, 2009 4:41 PM

Hi Ganesh,
check the behaviour, if you assign
S_USER_AGR
   ACT_GROUP = "..name of the assigned role.."
   ACTVT = 03 (for "display")
b.rgds,
Bernhard

Roles and their authorization profiles time period

Can roles and their authorization profiles be assigned to a user for a limited time period?
please reply
Thanks
Edited by: tracey_hrecc6.0 on Nov 1, 2010 5:24 PM

Hi,
It is possible.
Read below links for more details
http://help.sap.com/saphelp_mic10/helpdata/en/69/1810a4c51144dc833353183155ec88/content.htm
http://www.sap-img.com/basis/frequently-asked-questions-on-authorization.htm
http://help.sap.com/saphelp_wp/helpdata/en/cd/cc5664d22a11d296110000e82de14a/content.htm
Regards
S.Ravi
Edited by: S.Ravi-at-SAP on Nov 25, 2010 5:36 AM

Tcode authorization without any role or profile

Hi Experts ,
Can you please suggest on authorization issue , if observed that one Tcode not given in to any roles or profile but some user still using this authorization.
When I checked role and profile for such user using the SUIM still it shows no data.
So is there any other way to assign direct Tcode without using any role or profile.
Thanks in advance .

not sure how you are using SUIM to check, just to be sure, use the complex selection method or the authorization values method. the by transaction method only check for transactions that were added via the menu.
look for object= S_TCODE, value=(the transaction code)
SUIM will then calculate if the transaction code was added manually and as part of a wild card or a range.
i.e. if the transaction was MM02 it will be accessible if the S_TCODE had
wild card value M*, MM*, MM0* or
range value A*-Z*
Otherwise, it is possible that it was called indirectly and the BADI does not perform a S_TCODE check.

3rd party tools to migrate Authorization profiles to roles

Experts,
Are there any 3rd party tools to migrate Authorization profiles to roles while upgrading to ECC 6.0?
NW

Hi,
Thanks so much for replying. I posted the errors here (no answers though):
XML to Forms conversion gives error for menus
Error when converting form to XML

Authorization : roles and profiles

Hi,
I have two questions that I need answers
- How do I check roles that are assigned to reports and
- roles and profiles needed to execute reports
thanks in advance

Hi,
Roles or profiles are assigned to user not specific reports or queries, if u need u can check what roles are assigned to u in SU01, provide the user name and go to display mode there u will find profiles tab, u can check .
Hope this helps u a lot.........
Assigning points is the way of saying Thanks in SDN
Regards
Ramakrishna Kamurthy

How to get all authorization objects for a certain authorization profile

Hi ABAP experts,
I have the following problem: for a certain authorization profile of a role (created with transaction PFCG) I would like to get all contained authorization objects: e.g. for the contained object PLOG I would like to know/read all corresponding parameter values.
So:
- where are these values stored (dictionary table)?
- is there already a FM or a report to read all authoriation values for a certain authorization profile?
Thanks in advance.
Best regards,
Oliver

Hi,
check the following it might useful for you:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c
if helpful reward points are appreciated

Query related to Authorization profile.

Hi Professionals,
Please help me out as I'm not a BASIS consultant but PP.....
We've created Users profile and assigned them profiles that contain a particular bunch of Transaction codes module wise.
Now we want to to create and assign such a Authorization profile to Users which will contain all Display transaction codes either related to all modules OR that particular module only say PP, MM, FI, CO etc.....
For example
MM03- Display material master
CS03- Display material BOM
CR03- Display work center
ME53N- Display Purchase requisition etc.
Is there any standard profile for that that are already provided by SAP? If it's there, how do we know that are related to what module?
Suppose if we assign such profiles, what will be implications related to future and user discipline?
Thanks & Regards,
Abu Arbab

Hi Abu, don't worry about being a PP consultant, most of us here are not Basis either, rather we focus on security.
There are no standard roles delivered by SAP which give this. There are standard SAP display roles but none will include all the display transactions for a module.
What you should do is get each functional team to list the dispay transactions which are used by the business processes which they have configured. There is no point in creating a display role with 500 transactions if the business processes only requires 30 transactions. Access is more usually required for business processes rather than module so you would often need to combine your modular display roles to cover a single process.
By building the roles to include the transactions you use rather than are available, you also avoid one of the mistakes often seen with using standard SAP roles - users having wider authorisations than they require to perform their job.

How to determine role authorization of user in MAM?

Hi everyone,
I'm new to SAP and SAP MI, and I am currently implementing (or "enhancing") a MAM. I have the following question on user authorization:
In terms of role authorizations, does anyone know how I can determine what roles an authenticated user have from SAP? For example, if user A logs into the MI Client, and if this user accesses the MAM, is there a way for the MAM to know what kind of user roles he/she has? Is there a SyncBo that will give me such info? I checked the JavaDocs for the SyncBo's, but they have NO descriptions. The closest thing that I found was in MAM090 (Interface com.sap.mbs.mam.bo.MAM090). There are getter methods for getRoleGen(), getProfileResource(), and getPartnerRole(). Are any of these usable?
Are there any good documents that I can look at to determine what each SyncBo's does?
Many thanks!
Jeffrey

Hi Jeffrey!
Here are the 3 different checks you have to look at"Users & Authorizations" for setting up your MAM Users.
(1) SAP Backend:
(1a) The SAP MAM User who synchronizes with the Backend from the MI Client should have all necessary authorizations for Plant Maintenance Components of the SAP System that are associated with your MAM Scenarios.Pl refer to the following SAP Authorization Objects I_ALM_ME ,I_AUART,I_BEGRP,I_BETRVORG,I_CCM_ACT ,I_CCM_STRC,I_ILOA,I_INGRP,I_IWERK,I_KOSTL ,I_QMEL,I_ROUT ,I_ROUT1,I_SOGEN,I_SWERK,I_TCODE ,I_VORG_MEL,I_VORG_MP ,I_VORG_ORD,I_WPS_MEB ,I_WPS_REV in your Backend System and have it assigned to the User Profile, based on your requirement.
(1b) Service User for setting up the MAM & MI Landscape: This user logon info has to be setup in the RFC Destination that is associated with your MAM25 SyncBOs, to logon to the Backend System and this user should have the basic authorizations required to establish the connection.
(2) MI Middleware: The SAP MAM User who synchronizes with the Backend from the MI Client should have the following Authorization Objects assigned to his/her profile. S_ME_SYNC, S_RFC, S_TCODE.
(3) MI Client: Refer to MI Security Guide.Pl note that the MI Client MAM User is same as the Middleware User and the Backend User.You should be taking care of this already.This is just a FYI.
Let me know, if you are looking for any other additional info.
Thank You
Gisk

Security roles and profiles

Hello,
Could you please provide information on "security roles and profiles "
I would appreciate.
Regards,
Alex

Roles give you authorization to specific area of the system. Use TC pfcg and you will see different setting for a role.
In specific Role -> Authorization -> click on Display Authorization Data.
Here all specific InfoArea, Cube, ODS, Reporting componets: display, execute and other security rules are defined.
User Section: defines who has access to this role.
Multiple authorization are combined to create an Authorization Profile. You defined a profile at TC su01 and under profile section.
Hope that helps.
thanks.
Wond

How to make changes in Authorization profile?

Dear Guru's
In R/3 4.7 i used to change authorization profile in tcode SU02.where as in ecc 6.0 i dont find any change option it shows "Generated profile can only be displayed"
I want to remove the particular tcode from that authorization profile.please help.
Regards
AKI

Aki
In new SAP versions, they have replaced direct profile generation with Roles concept and all the new profiles are attached to the roles. Follow this link and read it completely and understand the concept.
http://help.sap.com/saphelp_bw21c/helpdata/en/52/6714b6439b11d1896f0000e8322d00/content.htm
You cannot change a profile directly, instead you will have to insert authorization from the existing profile into a new role and generate a new profile for that role.
Goto PFCG, create some new Z role. Save it, then goto authorizations tab, in the profile text box enter the profile name you want to edit authorization of. Goto change authorization Data. make the required changes. Then in the menu on top left hand side you will see a red and white ball press that and generate profile. Now you have a new role with required authorization. You can attach the role to required users.
Rahul

Restricting the ATP user for GATP - corrrect roles/authorizations

Hi:
If the dialog user that is used for the ATP check (from ECC to GATP) has more authorizations than needed and this is going to be a problem in production. The user can run SCM transactions from the results screen of ECC and this is not desirable.
Therefore, the ATP user should be a restricted user that has only authorizations for this specific task. If you know what are the exact roles/authorizations to give to the ATP user, could you share them?
Thanks in advance.
Satish

For R/3 please check OSS Note 447543 - APO: Authorizations too comprehensive/not user-specific.
"If it is necessary to have different authorization profiles in APO for different R/3 users when calling in APO, the following solution applies:
Activate the setting in SM59 that is used for the RFC connection CURRENT USER.
In the APO system, create the respective users and assign authorization profiles. This is necessary in order to achieve the necessary flexibility concerning authorizations in the APO system."
For APO :
AuthorizationsObject   C_APO_ATP in APO .
please chose activity as per user role.
01       Create or generate
02       Change
03       Display
04       Print, edit message
06       Delete
16       Execute
39       Check
Manish
Edited by: Manish Kumar Rathi on Oct 21, 2008 1:24 PM

Talent Management (EhP4) - cannot find structural authorization profiles

Hi All, 
I have looked in 3 different SAP ECC6.0 EhP4 system for the Talent Management structural authorization profiles stated in the IMG documentation and on the help.sap.com website. The profiles are: 
TMS_PROFILE 
TMS_ALL 
TMS_MAN_PROF 
There are also several "sub" profiles for TMS_PROFILE. 
To take an example from help.sap.com on their Authorizations page (http://help.sap.com/erp2005_ehp_04/helpdata/en/7b/6f92413c3a2e7be10000000a1550b0/content.htm ), the SAP_TMC_SUPER_TALENT_MANA_SPEC clearly indicates the TMS_ALL structural authorization profile is in the standard system: 
Authorizations for talent management superusers 
For more information, see Talent Management Superuser. 
The structural authorization profile TMS_ALL is also available as a template for the Talent Management Superuser. 
For more information, see Customizing for Talent Management and Talent Development under Basic Settings ® Authorizations in Talent Management ® Define Structural Authorizations. 
So... does anybody know anything about these and where I can find them? Do they require some form of activation outside of the standard switch activations for Talent Management? I've looked in several tcodes (SU01,PCFG, OOSP etc) for them but no luck. 
Any help gratefully received and points will be awarded for helpful answers and solutions! 
Best regards, 
Luke

Hey Luke:
Could you do me a favor and look in client 000 (the SAP delivered client)? You generally need a basis person for this activity, and I can't find one now on my own end to confirm my theory. However I'm pretty sure if you went to OOSP in client 000, you'd see those profiles. They were either never copied over from 000 or your security friends deleted all the profiles that are SAP delivered in the clients you're looking at.
I could talk for a super boring amount of time about the security concept of "SAP delivers too much access with their roles so we don't use them" that a good number of security teams use - but that's a story for a different day.
Take a peek in 000 and let me know what you see. If they're there, you can always have your basis chums copy them over to your clients that you want them in (presumably your security config client).
Thanks,
Chris

Table for Role & Authorization group

Hi Gurus,
I am looking for a table or FM to get all roles for Authorization group.
I tried in SUIM tcode but could not able to find exact DB table for these.
Giri
P.S.: To Moderator:
My earlier thread was locked for the same question, I was searching in SDN and google from last 3 days and could not able to find enough information on it. AGR_USERS, TBRG, TACT are the tables i found. But still there is a link missed between Role & Authorization Group.

Thomas,
My report have selection screen with Auth group and user.
If user provides Auth. Group then need to find all roles linked to auth group and users assigned to that role.
In my investigation, there is link between Auth. Group <--> Auth. object.
Also Auth. Object <--> Role.
but still there is a fine link missing between Auth Group <--> Role.
For Eg: Auth Object S_TABU_DIS will be associated to all Auth. Groups but assigned to only limited roles.
I tried to debug the SUIM transaction multiple times but couldn't find the tables to find the link and not able to find the FM's.
if anybody have any idea to find that link between Auth. Group & Role then it will be helpful....
Giri

Role Authorization Profile Search

Similar Messages

Maybe you are looking for