Roles in su01

in SU01 Which roles we need to give to wokflow developer and workflow admin .
Regards
ajay.

hi ajay ,
SAP_BC_ENDUSER
SAP_BC_SRV_USER
SAP_BC_BMT_WFM_ADMIN
These are roles we need to assign in su01 for workflow admin
if any , let me know.
Regards ,
kiran

Similar Messages

ABAP program/Function module to assign the roles in SU01

Hi,
Is there any ABAP program/function module to assign the roles in SU01. And program/function module which does all teh SU01 related activities.
Thanks and Regards,
Rashmi

Hello,
Check the function modules that start with BAPI_USER*
To assign roles :
BAPI_USER_ACTGROUPS_ASSIGN
To assign profiles :
BAPI_USER_PROFILES_ASSIGN
To change user's metadata (name, settings, ... other SU01 functions) :
BAPI_USER_CHANGE
Success.
Wim

Where the BP internet role's SU01 data stored in CRM

Hi Guys,
We are creating BUSINESS PARTNERS using a abap upload program . We are using CRM 4.0 620 release.
I have created roles for all the Business partners(All the roles are stored in but100).. one of the assigned roles is INTERNET USER ROLES.
When i select this role for a Business partner in using BP transaction i could see the SU01 roles assigned to the particular business partner under internet user tab screen of the BP transaction.
can some one tell me when i select the INTERNET USER ROLES for a BP where the related SU01 data is picked from and which is the CRM table storing this data .
Will appreaciate an early reply..
Regards,
Sundar

Hi Sundar,
This is the integration between the BP and SU01.
The SU01 data is not stored in any BP related tables. Only the role is stored in the table BUT000. Entire data is picked from the user tables.
The module 'SUSR_USER_READ' is used to read the user information from the user tables. Details about this can be found in the central person module BUCP_BUPA_EVENT_ISDAT. Hope this helps.
Regards,
Sudheer.

Indirect pfcg role assignment - no roles in SU01

Hi experts,
I would like to assign PFCG roles via indirect assignment, this means i would assign roles with the organisational model (transation ppomw).
I did the assignment and i executed the transaction pfud for user master data reconciliation. But the pfcg roles are not assigned to the user (see roles in transaction SU01). Usually the roles should be displayed (in blue and with xflag for indirect assignment).
Are there any customizing configurations i have to keep in mind?
Hope you can help as fast as possible.
Thanks a lot and best regards,
Natali

Run PFUD if this is still an issue.

Copy user roles/profiles : Su01

Hello,
I want to copy user roles /privileges from one user to other?
how do we do this and which user can do this ? my pisuper does not seem to have authority to copy user profiles from one user to other?
Thanks

Try to Copy the user(Src user to Target user) from SU01 by logging in your user. When it displays authorization error, open a new Session of SU53. It will tell you the missing authorization objects. Add those authorizations to your user & you will be able to copy Users using ur userid.
If you want to keep it simple.. Give yourselves SAP_All. You can do whatever you want.
Copying Users
http://help.sap.com/saphelp_nw04/helpdata/en/52/6711c5439b11d1896f0000e8322d00/content.htm
Regards,
Siva Maranani

Deletion of particular roles from SU01 for specific users

Hi,
Actually I have to certain(only some) roles for users in SU01.
This is bulk data so doing it manually through SU01 is not possible.
Is there any function module/BAPI which will delete particular roles for users??
Disha.

Hi David.
David Berry wrote:
I take it this is being run in PRD? What checks are being carried out during the table entry deletions and are you 100% happy sitting at your keyboard when pressing the 'run' button?
Changes are made in PRD. The program was tested and is approved by each customer.
Is there an easy way back to the previous state should it go wrong and how do you explain it to the auditors if needed that you assigned-number of roles in PRD against your own user ID possibly with no CDHDR/CSDPOS entries to back you up.
Sorry for the 'negative vibes' but I don't like direct table maintenance in PRD for security.
Best wishes
David
The way back is uploading the old role assignment previously exported from AGR_USERS. The program takes an excel sheet. In addition this excel sheet is attached to the change requests.
From risk perspective we say (and experienced): mass changes through copy and paste lead to much more errors and faulty authorizations.
Regarding direct table maintenance: standard function modules are used (like the one mentioned above) and the changes are visible in the change documents, Therefore the auditors grant an exception for using such tools.
Cheers, Tobias

Security Issues with the BP Internet user role creation--SU01

Hi All,
We are implementing the B2B Internet sales scenario using CRM 4.0. we
have contact persons who logs in and chose the distributor and then
start placing orders or look at product catalog .... Now contact person
is created as a BP in CRM and relation ship is maintained to sold to
(bp). During this process the contact person should be created under
the Internet user role which uses the SU01. so we will be able to
change password or change the roles of the users while creating BP
under the internet user role -- same as what we do in SU01.
This is now a security Issue because who ever can access the BP
(create/change) will be able to do the things we can do under
transaction SU01. But we still need to access the Internet user role in-order to assign the user id to the contact person . Is there any other
way of doing this.
Please advice ASAP.
Thanks
Vasu

Hi Ashwini,
you need to modify the logon routine and then in the user management (isauseradmin application) to do this. Then there are likely changes to the catalog identification, and very likely to most processes in the shop. I really wouldn't advise doing so. As accounts usually have contact persons: Why does your client insist in providing a login for the organization and not for a person?
To achieve something that looks almost like the desired solution you, e.g., could model a dummy contact person for each account that shall get a logon, that then does the job. The contact person could be named like the company and then you are back to plain standard.
Rgds
Thomas

Stopping of assignment of duplicate role in SU01 and same user in PFCG.

Hello Experts,
I have a requirement, wherein I have to restrict assignment of duplicate roles in the user master (SU01) also I should not be able to assign same users twice in the user tab in PFCG.
Please advise...Thanks in advance.
Best Regds,
Suyog Chakot...

Hi Suyog,
There are two ways to do it:
1 - PRGN_COMPRESS_TIMES
2 - SSM_CUST .
PRGN_COMPRESS_TIMES has its own limitation, it works perfect in Non-CUA landscape while have lot of issues in R/3 CUA landscape.
SSM_CUST is universal and I guess it can be used in al landscape. CUA as well as NON CUA. Let us know if you need any more information on this.
Just search with these two key words and I am sure you will get your reply.
Edited by: sap.sec.akshay on Dec 30, 2009 6:55 PM

Regarding assignment of roles in SU01

Why People will add auth object in roles tab in SU01 instead of profiles tab very often? Is there any diff in that?
Edited by: mydhili talluri on Aug 14, 2008 8:04 AM

Let me explain you this to satisfy you.
Initially all sap systems had only one way to authorize or secure system through profiles and system security was based on profiles only.
Down the line SAP introduced the terms Role.
Role has many options and easy to manage than profile.
When you create roles in SAP and generate it .System automatically create profiles .
Still you can create profile with help of transaction su03 and maintain the user master data .
So initially I belive before 3.1i we had only option for security was profile.
Now we have to two options roles and profile both.
Roles are easy to manage than profiles.
Hope it helps.
Amit

Setting personalization via profile parameter in the business role vs su01 personalization

We are trying to have the personalization for a user on login determined by the business role they choose (if they have more than one) via the profile parameter in the business role.
Setting the personalization this way doesn't seem to get picked up for the user, any experience with this issue?
Regards,
Curtis Finchercr

Hi Curtis,
In CRM, users can personalize their screens by logging in to web client by selecting the business roles.
Once they are in to the business role they can able to see "Personalize" option on right hand side top corner. If they click that option they can able to modify their own data (personal information), Lay out, Settings, Groupware integration and Favorites modifications as well.
Thanks,
Siva

Assign biz role through CRM -SU01 and display page at portal

HI, SDN Fellows.
I am creating some custom portal roles at portal and mapped it to the custom business roles for some PCUI screens at crmc_blueprint_c --> "Assign Portal Role to Single Role" ("Assignment of CRM Role to Portal Role").
Currently, our portal UME data source is mapped to CRM system.
Right now, I have to assign both the CRM Role through SU01(to have access the CRM Object Method at CRM-PCUI application) and Portal Role through User Admin of WAS/portal (to access/display the PCUI iView in the portal).
My goal is to just assign role through CRM-SU01 and achieve the same output as I described above. Meaning can I just do the role assignment for the CRM role (through SU01) and able to access to the CRM-PCUI application through portal (able to see the pcui screen)?
Thanks,
Kent

What I want is when I assign a role (Sales Manager) said user A in CRM system, userA should able to see the related workset/page/iviews in the portal (without the need to assign the same: Sales Manager role in portal).
Now, what I have to do is assign the related objects into a single/composite roles in CRM (for backend data access), then I have to assign a portal role (through User Admin of Portal, so that they can see the portal content),
is that a way we can do it in one step?
Thanks,
Kent

Role creation: SAP ALL with SU01 and PFCG in display only

hi all,
I am looking for the easiest way to create a "sap all " like role with SU01 and PFCG in display only.
i found several solutions, which sound very complicated.
Thank you in advance,
Julien

Hi,
As per your query there is not profile of SAP to give display authorisation, for this you have to create new profile on module wise and assign to user.
Anil

CUA : SU01 role change

Hello friends,
I am developing a report in Sending system, based on role change information for user id. We configued CUA correctly and everything is working fine.
Is there any table or funciton module or report which shows Role modification history with timestamp for a user in Sending system.
Lets say if i change a user's role in SU01 roles tab in sending sytem, i can only find role modified date but i am unable to find time when was modified.
thanks.
Macs

Hi,
Tables USL04, USLA04, USZBVSYS gives changed date information only. But i am looking at time information.
Table USZBVSYS contains all information for whatever you change in SU01. So i dont know whether role has been changed or user data has been changed.
Table AGR_USERS gives date and time but it is only for local systems. In CUA sender system, user can have roles for different systems. So, i need to get information from the sender system about what roles has been changed with Date Time.
It would be too good for me to share any ideas if you have.
thanks,
Macs

Inserting queries in a role

Hi Gurus,
i need to assign queries to a role so that users having this role will be able to get the queries in their menu when they log into the system. How can I do it?
Partha

Steps 1)PFCG -->create ROLE
2)SU01 -->assign ROLE to user
3)RSECADMIN -->create authorization object,assign activities of 0TCT*
Note - RSECADMIN uses 0TCT* objects
basis ADMIN should have S_RSEC object to be assigned in order for him to use 0TCT* objects
Roles - Query
PFCG - create Role
Authorization tab -change authorization data
S_GUI = *
S_TCODE = RRMX
S_USER_AGR
ACTVT = 2,3 and ACT_GROUP = *
S_USER_TCD = RRMX
Profiles to be given to developer
SAP_ALL
SAP_NEW
0BI_ALL is the new object which gives all authorizations to users.
More info-
Re: How to add a Role?
Hope it Helps
Chetan
@CP..

Roles for JAVA Authotizations

Hi All,
We have a requirement from one user.
He needs access to the following Java tools:
SQL TRACE, NWA and Content Administrator.
He has the following roles in SU01:
SAP_SLD_ADMINISTRATOR
SAP_XI_ADMINISTRATOR_ABAP
SAP_XI_ADMINISTRATOR_J2EE
SAP_XI_BPE_ADMINISTRATOR_ABAP
SAP_XI_ID_SERV_USER
SAP_XI_IR_SERV_USER
SAP_XI_IS_SERV_USER
Wich other roles are needed?
Thanks a lot and best regards.

Hi,
there are next roles in sap XI:
SAP_XI_ADMINISTRATOR_ABAP Exchange Infrastructure: Administration Tasks
SAP_XI_ADMINISTRATOR_J2EE Exchange Infrastructure: Administration Tasks
SAP_XI_APPL_SERV_USER Exchange Infrastructure: Service User for Application Systems
SAP_XI_BPE_ADMINISTRATOR_ABAP Exchange Infrastructure: BPE Administration Tasks
SAP_XI_BPE_CONFIGURATOR_ABAP Exchange Infrastructure: BPE Configuration Tasks
SAP_XI_BPE_MONITOR_ABAP Exchange Infrastructure: BPE Monitoring Tasks
SAP_XI_CMS_SERV_USER Exchange Infrastructure: Change Management Service User
SAP_XI_CONFIGURATOR_ABAP Exchange Infrastructure: Configuration Tasks
SAP_XI_CONFIGURATOR_J2EE Exchange Infrastructure: Configuration Tasks
SAP_XI_CONTENT_ORGANIZER_ABAP Exchange Infrastructure: Organizational Tasks
SAP_XI_CONTENT_ORGANIZER_J2EE Exchange Infrastructure: Organizational Tasks
SAP_XI_DEMOAPP Exchange Infrastructure: XI Demo Examples
SAP_XI_DEVELOPER_ABAP Exchange Infrastructure: Development and Design Tasks
SAP_XI_DEVELOPER_J2EE Exchange Infrastructure: Development and Design Tasks
SAP_XI_DISPLAY_USER_ABAP Exchange Infrastructure: Display
SAP_XI_DISPLAY_USER_J2EE Exchange Infrastructure: Display
SAP_XI_ID_SERV_USER Exchange Infrastructure: Integration Directory Service User
SAP_XI_IR_SERV_USER Exchange Infrastructure: Integration Repository Service User
SAP_XI_IS_SERV_USER Exchange Infrastructure: Integration Server Service User
SAP_XI_MESSAGE_MODIFY Exchange Infrastructure: Change Messages
SAP_XI_MONITOR_ABAP Exchange Infrastructure: Monitoring Tasks
SAP_XI_MONITOR_J2EE Exchange Infrastructure: Monitoring Tasks
SAP_XI_RWB_SERV_USER Exchange Infrastructure: Service User for Runtime Workbench
SAP_XI_SUPPORT_ABAP Exchange Infrastructure: Support
SAP_XI_SUPPORT_J2EE Exchange Infrastructure: Support
for IR and ID: SAP_XI_ID_SERV_USER and SAP_XI_IR_SERV_USER
or you can set sap_xi_administrator ..it depends on user tasks.
but sap_all and sap_new is not enough
Vasanth

Roles in su01

Similar Messages

Maybe you are looking for