SAP_AUDITOR* roles on SAP ECC 6.0

Dear all,
I am trying to check some roles existing in the Note 451960, which refer to some audit roles.
Looking for those role in my system (PCFG role name SAP*AUDITOR) I did not get the list of SAP standard roles .
Do you have some idea why? and what I should do in order I can have those standard roles in my system?
I will appreciate any help in this regard.
Thanks in advance.
FedeX

>
FedeX wrote:
> Dear all,
>
> I am trying to check some roles existing in the Note 451960, which refer to some audit roles.
>
> Looking for those role in my system (PCFG role name SAP*AUDITOR) I did not get the list of SAP standard roles .
>
> Do you have some idea why? and what I should do in order I can have those standard roles in my system?
>
> I will appreciate any help in this regard.
>
> Thanks in advance.
> FedeX
Put one more * and you'll find them. PFCG->SAPAUDITOR

Similar Messages

Creating Roles in SAP ECC for autority in BO

Hi Guru's,
Can anyone point me to additional information about how provisioning works in SAP ECC for BO?
I am also looking for information on how to create some general roles in SAP ECC to transport into BO to control authority.
I have already read through the "Business Objects Enterprise Admin Guide".
Thank you in advance,
Steven

Hi,
to synchronize the roles you can use CUA. In CUA, you define 1 system as a central store for user administration and then distribute the users + roles + groups to the systems. You configure your EP and ECC to receive the user data from that system, therefor, you user information is in sync.
SAP Help: http://help.sap.com/saphelp_nw70/helpdata/EN/07/622441cd87a12be10000000a1550b0/frameset.htm
For more information, there is an SAP product: Identity Management.
SDN: https://www.sdn.sap.com/irj/sdn/nw-identitymanagement
To upload ECC roles to EP:
SDN Article: https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/06a0e690-0201-0010-4b9f-e529c345a831
User Mapping is for logging in to a backend, when the userid in the backend is different from the userid in the portal
SAP Help: http://help.sap.com/saphelp_nw04s/helpdata/en/f8/3b514ca29011d5bdeb006094191908/frameset.htm
br,
Tobias

Implications of uploading roles from SAP 4.7 to SAP ECC 6.0 EHP 5?

HI Gurus,
Please tell what would be the cons for uploading the roles from SAP 4.7 to ECC6.0 EHP5.
Would there be issues in doing the same?
Regards,
Sonu

Hi Sonu,
There me be changes in authorization object assignment for the roles. Some objects may be deleted and new objects may be addedd to the transactions.
Instead of uploading you can better get the list of transactions for every role and create them newly in ECC 6 EHP 5 system and maintain them according to the old roles.
Thanks,
Kranthi

Maximum Nr of Roles in a SAP ECC 6.0 System

Hi,
How many roles maximum could be assigned to one user in a SAP ECC 6.0 System?
In case some single roles are assigned several times to the same user ( because one single role belongs to the several composite roles) ..then will be this role count only 1 time?
Thanks,
FedeX

> can I find this note in SDN?
Notes are to be found in the SAP service marketplace.
> the secoond part of my question would interest to me..
> if the profile appears 2 times...it will count as 1 or as 2.
If the role appears twice in the user master record and PFCG_TIME_DEPENDENCY runs regularly the profile should appear (and count) only once.

SAP ECC 6.0 delivered Roles - SOD compliant?

Are SAP ECC 6.0 delivered roles SOD compliant as per the GRC ruleset?

Ivanka,
the SAP ECC 6.0 roles are not SOD compliant as per the GRC ruleset. You will actually find a number of violations within the standard roles.

SAP Personas using SSO to connect SAP ECC

Hi,
We configured SAP Screen Personas test landscape.
When I launch the mainapp page, the system is prompting for user credentials.
Then I get "System Selection" screen where the system I have configured (SAP ECC).
When I click on system backend, an new popup ask for user and password (SAP ECC credentials).
We are trying to understand if it is possible configure SSO to access ECC backend.
So, the ECC backend credentials will not be required anymore.
I am not sure if it is possible this configuration.
According SAP note 1684886 - License conditions of SNC Client Encryption, I think this scenario requires additional license.
Any help to resolve this is highly appreciated.
Best Regards,
Leonardo.

The project requirement is avoid the user can log in with SAPGUI and run the standard transaction.
So, the user can log in only with SAP personas user/password and run the transaction on backend with a modified screen with the restrictions of authorization roles.
Regards,

Error while Importing Integration kit Transport Requets into SAP ECC 5.0

HI ,
1. AT BO side -> I can see the many roles, but under 'role import tab' in CMC when i add any 'role' and click on update button,
     system showing an error as below .
   "Failed while trying to get user list using class CSecRfcRemoteUsersActGrp in method CSecSAPR3Binding::GetUsersInternal(). Error code: 3. Description: Syntax error in program /CRYSTAL/SAPLSECURITY .. "
2. After successfull installation of integration kit on windows 2008 server, i have imported the transport request into SAP ECC
   5.0 When i imported open sql connectivity transport request, i got error mesage . The error message number is 8 and it came
for Generation of programs and screens. i have installed sap gui 710 ( verion : 7100.1.0.1027).
I also transported remaining transport request (infoset, row level, cluster definition, security functions) but all these request
contain similar error. Now when i try to login into sap its going dump.Is there any possibility of reverting back the transport
requests.
Pls help me to fix these issues.
Edited by: sheshikanth reddy on Apr 14, 2010 2:15 AM

Hi ingo,
Now i can able to transport successfully after following the order.
Thank you very much
Edited by: sheshikanth reddy on Apr 14, 2010 11:46 PM
Earlier i have imported non unicode request numbers into sap unicode system.
tats why i got error.
Now i have imported unicode request number to unicode sap system with sequence.
Edited by: sheshikanth reddy on Apr 15, 2010 12:19 AM

Can I retrofit from SAP ECC to SAP R/3

My understanding was yes. However how do I set this up in SMSY? My system is coming in as an R/3 Enterprise system. However when I select the system role for post processing only my SAP ECC systems show up in the drop-down.
How do I include my SAP R/3 system:clients in the SAP ECC drop down?

Hmmm, it can be done both the ways. What system you need to keep it eventually?.
Form your point, Your ECC system is defined right?.
If thats that case, goto Txn SMSY-><your SID>-> Header Data-> Installed prodiuct version->from the free selections select SAP R/3->and the related compoent-(I Guess ECC server). This actually creates by itself an duplicate in R/3. but you have to un-check the leading product role box. (You can have the desired system- by cleaning up the inconsistencies).
The vice versa in the other case.
Does this sound OK. I know, its bit confusing all over, Please try it for a test/Sandbox SID first, to get that on place.
Thanks,
Jagan

Difference between SAP CRM Security and SAP ECC 6.0 security

Hi
I have extensively worked on SAP ECC security but haven't have chance to work on CRM Security.
Can anyone please let me know the difference between CRM security compared to ECC security.
Thanks...

I am sorry to say, but instead of giving the guy a decent answer you are starting a fight or discussion about stupid forum points...
really sad.....
The big difference between SAP ECC and SAP CRM Security (up to release 5.0) was the following:
1) For sure there are very different transaction codes in SAP CRM as compared to SAP ECC in the first place
2) If you are familiar with R/3 or ECC authorizations; then you know that already on transaction code level, the 'allowed activity' is controlled on tcode level , whereas in SAP CRM , in most cases the 'allowed activity is not controlled by the Transaction code, but on authorization object level....
E.g. transaction code BP allows you to create/change/display any type of Business Partner (e.g; sold-to/ship-to/contact person/employee/customer) which is based on the business partner ROLE concept.... anyway...you can control the allowed activity based on different authorization objects.....
another example is business transaction processing...which can be launched by:
a very generic transaction code: CRMD_ORDER
transaction category related transaction codes :e.g.
> CRMD_BUS2000126 for activity management
> CRMD_BUS200115 for Sales processes
Again...allowed activity is not controlled by the tcode, but on authorization object level...
3) As of the new WEBCLIENT UI (which is valid as of release CRM2006s/CRM2007/CRM7.0) SAP also invented an extra authorization layer, which is UI COMPONENT LEVEL and logical links.... controlled by object UIU_COMP.
However, they also introduced the BUSINESS ROLE Concept (e.g; SALESPRO/MARKETINGPRO/...) which defines actually the functionalities, navigation bar, screen configuration, logical links you can use/see within the new WEBclient UI.
Another thing is that instead of using TRANSACTION CODES, as of these new releases, you are actually using 'external services'....so you do not authorize on tcodes basically....but the logic between tcodes and external services in relation to the authorization objects that are checked is more or less the same....
STANDARD authorization setup in the new WEBUI client is therefore controlled by both backend authorizations (not UIU component related) and the UIU_COMP (restricting access to workcenters/logical links/...)
4) Additionally SAP also provides a concept called ACE (which stand for ACCES CONTROL ENGINE)....
This requires a bit of customizing...and the rest is more or less pure customer development, as you will create your own methods where you'll define a logic which dynamically will verify what kind of access you have for an object....
You should now that ACE is actually implemented on top of your 'normal' sap crm security setup....
cheers
Davy Pelssers

SAP ECC 6.0 - Using BAPIs for C# to extract data out

I have had a client recommend a strategy of extracting data usin C# (Visual Studio 2005) to extract data from SAP ECC using BAPIs.
We do have an existing methodology in place using flat files to extract data to non SAP systems
We have purchase XI which we intend to implement next year.
I basically wanted to keep things tidy and continue with the flat file interface strategy just to keep things simple going forward to XI.
THen there is also the security piece, the developer has had to slowly build a profile / roles that alows him to come in thru visual studio to access these BAPIs
I am looking for anyone who has had experience with this and what your experiences are. As well, what are the SAP best practicies concerning this strategy
Thank YOU ALL who will reply

I think that SAP's strategy toward exposing BAPI is leaning toward leveraging their AS-JAVA stack. With the AS-JAVA Enterprise Services and standard delivered web content, SAP is already exposing many existing BAPI/Business Functionality outside of the ABAP world. However, that's not saying that traditional flat files have no place in the future. Matter of fact, I don't see flat/delimited files going away any time soon.
It all really comes down to what you are doing, you may even end up with a landscape that's a mix of files/RFCs. Here inhouse, we leverage file based transfers for large data sets such as SAP BI OHS extracts, and daily R/3 FI extracts. Why file? because it's simple, easy to control, and you can see the data being transferred. A file can be "hold in my hands" if you will, at best there's just a few characters in-flight.
As for RFCs, any type of RFCs in fact (Anything from sap .net connector to AS-JAVA ESOA Based ES), are basically designed for transactional data. Here, you are looking at things that are high in transactional count but small in individual size. Your client's call using C#, it all really depends on how you are doing it. MOST IMPORTANTLY: Make sure you are using a proven, standarized, and SAP supported way, PERIOD. NEVER EVER go into production with a "hack".
For the high-transactional-count-small-individual transactions, we leverage BizTalk Server (BTS) here. I'll be frank, we are not using BTS because we wrote it. We are using BTS because it just works better for us, in our environment. BTS now support SAP 2.0 connector (registered program ID) and SAP 3.0 (WCF based, direct SAP RFC call, supported by Microsoft AND SAP). We are leveraging these adapters and BTS (as distribution and transformation) in our environment more and more.
So, long story short: Determine the transaction type, multiple solutions is ok, make sure the solution is supported!

How to install BI-CONT 7.37 in SAP ECC system EHP 5

Hi SAP Gurus,
We recently upgraded BI_CONT in our BW landscape(SAP netweaver 7.3) from 7.36 to 7.37
What is the strategy to upgrade BI _CONT or corresponding changes in SAP ECC system(EHP 5).
Currently we don't have BI_CONT installed in our ECC system.
KIndly, let me know how to upgarde BI_CONT related objects.
Earlier we used to use custom extractors and data sources in ECC system for BI_CONT now we business has planned to use all standard data sources.
Question here is do we need to install BI_CONT in SAP ECC and what is the procedure?
Thanks,
Avadhesh
+91 8095226536

Hi Avadhesh,
No need to upgrade or install add-on BI CONTENT in ECC system if you have already BI landscape for doing BI functions.
BI content includes below functionality which can be installed as an add on in ECC when you dont have BI landscape.
DataSources
Process chains
InfoObjects
InfoSources
Transformations
InfoProvider (InfoCubes and DataStore objects)
Variables
Data mining models
Queries
Workbooks
Web templates
Roles
Aggregation level
Planning function
Planning function type
SAP Crystal Reports (BI Content Ext.)
SAP BusinessObjects Dashboards (BI Content Ext.)
Regards,
Karthik

SAP GRC 10 - PSS Access from SAP ECC System

I have configured Password Self Service in GRC System and is working perfectly fine for all password resets if access provided to NWBC from GRC System.
We have requirement to provide end users to reset password using SAP ECC System only. I have tried to access NWBC using SAP ECC System but is giving me error that Menu not configured or roles not assigned.
Currently Maintain Data Sources is configured as below
User Search Data Sources , User Detail Data Sources & User Authentication Data Sources set to ECC Connector and End User Vertification Set to yes.We are not using LDAP / Active Directory for the User Search Database and instead ECC Only
Can anyone provide the roles to be assigned in SAP ECC System to access NWBC - Password Reset .

Hi Anil,
In support to Colleen's comments, It seems that you have not configured the USER on the End User Services. You need to make sure that the guest user (not available in GRC) is configured in each of the 10 services in SICF for the end user Login Pages to work.
Here are the 10 required services to be activated:
1.)GRAC_OIF_MY_PROFILE_EU
2.)GRAC_GAF_NAME_CHANGE_SERV_EU
3.)GRAC_POWL_REQUEST_STATUS_EU
4.)GRAC_GAF_PWD_SELFSERVICE_EU
5.)GRAC_OIF_USER_REGISTER_EU
6.)GRAC_GAF_ACCREQ_WITH_REQREF_EU
7.)GRAC_OIF_REQUEST_SUBMISSION_EU
8.)GRAC_GAF_ACCREQ_WITH_TEMPL_EU
9.)GRAC_GAF_ACCREQ_WITH_USEREF_EU
10.)GRAC_UIBB_END_USER_LOGIN
You can refer note#http://service.sap.com/sap/support/notes/1628387
If the user is not present in GRC system then, they have to go with end-user-logon page to reset their passwords where you can always define the user authentication configurations.
Regards,
Ameet
Message was edited by: Ameet kumar

Create Substitute Users in SAP ECC 6.0

Dear Gurus,
Can someone guide on how to create a temporary user Substitute User) in SAP ECC 6.0. This is a user who will only use the SAP system for a short period while the substantive user is away on leave such that the system should lock the substitute user automatically when the leave preiod expires.
regards,
Chansa

> Very valid points on the PID's etc - hadn't thought of those!.
A lot of things are easily overlooked when designing substitution or emergency user procedures.
> Seems that, if the covering user doesn't have the authorisations in their UMR and has to fall back on the reference user's roles, it shows the reference user ID instead.
This would be very application specific and is not "mainstream". Where you can use it is with WAPIs (Workflow Application Program Interfaces) and BatchInput has been much the same for decades already.
> I'm not really sure if there''s a way around this as it may cause some questions internally but may benefit the business as the supplier/vendor etc think they are still dealing with their original contact.
On the backend you still have the created by and posted by fields for many application documents (all else being the same - which I would not rely on...).
> For small user groups, when one person is covering for another absent user in their user group then there shouldn't be any increased SoD figures (as long as reporting on org levels hasn't been activated in RAR) but we have found many instances where the covering user is either a team leader or similar which tends to increase SoD.
This is often because the user ID is changed (to a service user) when entering the "special mode". So access other user's (namely back to your own) spools, jobs, variants, layouts, work items, queries, office messages, etc etc is needed, and these are generally protected by strong administrator authority-checks. These will in combination provide many SoD conflicts or usually over-riding system admin access which makes the application restriction pretty weak in comparison.
> Pity it (SM20N) doesn't seem to work by user group but not bad at all...
It does via naming conventions, but is backward compatible for those already logging SAP* user and expecting no entries, which would then become all users starting with the name SAP... See Rz11 param rsau/user_selection (default is "off").
> Can't make the Berlin conference unfortunately but thank you for the welcome to SDN.
You can keep an eye out for "SDN Hacker Lunch" in the news streams. After the event, I normally put the infos and discussions together into a blog on SDN.
Cheers,
Julius

Org management (integration with SAP ECC 6) and shopping cart approval

Background:
We currently use EBP 3.0 - Classic Scenario.
Our current Organisational plan was manually created in EBP, and is not the same as the HR hierarchy in SAP ECC 6
Shopping cart approvals use the workflow WS10000276 u2013 Approval Single Level over Limit, which utilises the SLAPPROVER attribute. The user name assigned to the SLAPPROVER attribute does not have to be the manager of the user. To meet our Business requirements, a fairly flat structure was created at the time we implemented EBP 3.0. The approval level an approver is allowed to approve up to is controlled with the use of roles assigned to a user. Each of the approval roles has an appropriate value set against the BBP_APPROVAL_LIMIT attribute under Personalisation.
Moving onu2026
We are just about to move from EBP 3.0 to SRM 7.0 u2013 Classic Scenario - by carrying out a new installation.
Our Business requirement has changed, in that they want the approval of shopping carts to be carried out by the line manager, if that person can approve the value of the shopping cart. If not, for the approval to go up the HR hierarch until a manager with a suitable level of approval is found.
I believe it is possible to create the Organisational structure in SRM from the HR hierarchy in SAP ECC 6. I have tried to do this in our play/test system using - Integration Business Partner-Organizational Management, without much success as yet!
I have a few questions in this area:
1.     Not all of the users in the SAP ECC 6 HR hierarchy will be SRM users. E.g. In the SAP
             hierarchy there are 3 users u2013 User A, User B and User C. User B is the manager of User
             A and User C is the manager of user B. In SRM only User A and User C are users. That
             being the case, is it still possible to initially create the organisational in SRM from SAP ECC6?
2.     If it is possible to create the organisational structure as described, then using Process
             Controlled Workflow we could use the Shopping Cart BC Set One-step manager approval.
     If we did this, what would be the best way to incorporate the approval limit of a manager?
     Can this be simply achieved by setting the BBP_APPROVAL_LIMIT attribute in conjunction
             with the One step manager approval?
     We want to avoid having to use the SLAPPROVER attribute due to the high level of
             maintenance we currently experience.
Thanks to anyone who can advise me.
Claire

Hello Clarie,
this might help
HR Data Synchronization (Org Unit, Position and Employee) to SRM
Arshad

Sold-to's missing link to ship-to's - SAP ECC -to CRM data load

I have recently extended my middleware between my CRM 2007 and SAP ECC systems. I have adjusted the CRM middleware filters to include a newly created Sales Org that was created in our ECC system. I'm loading the data from SAP to CRM and the accounts are coming across for this new Sales org however they all seem to be assigned to the Sold to Role and none of the accounts are assigned to Ship to, Bill to or payer roles. This is despite the fact that PIDE is maintained correctly in SAP ECC. My middleware objects also seem to be fine. All my other sales orgs worked perfectly in the past.
What objects (business, customizing and condition) do i need to need to run to get these relationships into CRM from SAP.
The main one that I have run is CUSTOMER_MAIN and CUSTOMER_REL
Any ideas as to what the problem might be?
Thanks in advance
eddie

This issue defintely relates back to our SAP ECC Upgrade
It looks to me like that any NEW accounts created in SAP (post our SAP ECC Upgrade from SAP 4.7) and loaded into CRM do not include the relevant account relationships
That is to say that if an account in SAP say 100001 has 4 sold tos 100002 - 100005, 1 payer 100006 and 1 bill to 100006 then that same account will not have any relationships. The 7 accounts will be created in CRM but there will be no relationships between them. All the historical data is fine, any master data that was created prior to the SAP upgrade is unaffected - the relationships exist. Even if this master data was loaded into CRM after the upgrade. The issue is with master data created in SAP after the ECC upgrade and when this loaded into CRM the problem is evident.
This never came to light during a recent business unit rollout as their master data was created in SAP before the ECC upgrade and came across to CRM without issue. We only have seen this issue as we are now dealing with a new business unit that has had all its master data created on SAP post the SAP ECC upgrade. Its this master data that is affected in CRM in terms of missing relationships.
Any advice would be greatly appreciated. Has anyone seen this issue before
Thanks
Eddie

SAP_AUDITOR* roles on SAP ECC 6.0

Similar Messages

Maybe you are looking for