To make/change easily so many roles & profiles

Hi,
Does anyone know how to make/change easily so many roles & profiles?
Or, what tools are more efficient in this task?
We're required to make hundreds (or thousands...!!) of roles & profiles...
Katsumi Makabe

Hi katsumi,
Read this thread,
Mass creation of roles in ECC 6
Regards
Juan

Similar Messages

RAR v5.3 - Ignore Critical Roles & Profiles = No is not Working

Hello everyone,
I have SAP_ALL and SAP_NEW configured as critical profiles in Rule Architect. I changed the Ignore Critical Roles & Profiles option to "No" to see the delta. Yet, when I run the risk analysis (ad hoc or batch) against users with SAP_ALL, it still says No Conflicts found even though I changed the config to look at SAP_ALL users.
Do I have to restart the server for the new Config to take effect? It doesn't say it in the option like some of the other Config options do, but It's the only thing that I can think of.
Thank you,
Johonna

Hi Johanna
Have you run the synchronization job subsequent to the configuration of critical roles / profiles ? If not so try running the Synchronization job and then try risk analysis.
Regards
Swarna

SU24 - Changing SU24 after many years.

Hello SAP Security Gurus,
We have never maintained SU24 in our systems (more than 10 years). Currently we have a requirement to update or maintain a custom auth object against standard HR transactions. Please let us know what are the implications of this change. Our concerns are as follows:
1. Once we check maintain the auth object for the standard tcodes, will all the existing roles having these tcodes go out of sync?
2. Should we make sure that SU24 is in sync in all the clients before changing it?
Please let us know if you have any inputs regarding this issue and do the needful.
Thanks,
Karthik Kiran

Hi,
my inputs -
1. No, the roles will remain the same unless you want to change it in a future date. When you add a new transaction to one of these existing roles, or use the expert mode in pfcg, all changes from SU24 are updated in the role automatically and you need to maintain all required fields.
Note that SU24 changes for existing SAP transaction must be done only after careful consideration as not every existing role may need the modifications (depends entirely on business scenario), and you might unwittingly make changes to some critical roles.
2. Ideally SU24 should be in sync in all clients for the best possible system setup. It will still work if you only update SU24 in the development system only, if this is where all roles are created and then transported to QAS and PRD systems.
regards,
Sanju

How to make changes in Authorization profile?

Dear Guru's
In R/3 4.7 i used to change authorization profile in tcode SU02.where as in ecc 6.0 i dont find any change option it shows "Generated profile can only be displayed"
I want to remove the particular tcode from that authorization profile.please help.
Regards
AKI

Aki
In new SAP versions, they have replaced direct profile generation with Roles concept and all the new profiles are attached to the roles. Follow this link and read it completely and understand the concept.
http://help.sap.com/saphelp_bw21c/helpdata/en/52/6714b6439b11d1896f0000e8322d00/content.htm
You cannot change a profile directly, instead you will have to insert authorization from the existing profile into a new role and generate a new profile for that role.
Goto PFCG, create some new Z role. Save it, then goto authorizations tab, in the profile text box enter the profile name you want to edit authorization of. Goto change authorization Data. make the required changes. Then in the menu on top left hand side you will see a red and white ball press that and generate profile. Now you have a new role with required authorization. You can attach the role to required users.
Rahul

Communal iCal calendar; many users can make changes to calendar?

Is it possible with iCal to publish a calendar that other people can change? i.e. add events or notes to the calendar? Is it also possible to add a password so that only a select group can make changes?
Thanks!

Doug,
Published calendars are not editable, but here are some other hints to get you started with sharing, editing, and password protection.
1. Publishing a password-protected iCal calendar to iDisk
2. macosxhints.com - Publish non-MobileMe-account protected iCal calendars
3. macosxhints.com - Publish iCal calendars without .Mac
4. BusySync - Sync iCal and Google Calendar - from BusyMac
;~)

GRC AC10 RAR :"Ignore Critical Roles/Profile" option not available in

Hello Gurus,
I have configured RAR and the reports are working as usual , but i observed that i could not see two things
1) Option to select "IGNORE CRITICAL ROLES/PROFILE" during Role/User ANALYSIS under "Reports & Analytic" tab.
I checked in SPRO>GRC>AC-->Maintain Config Settings
There is a parameter "Ignore Critical Roles/ Profiles" which i first set to "Yes" and then checked in NWBC , i was unable to see the option under "Additional Option".
Later i changed SPRO setting to "NO" , then again it did not show me .
Where can i find this option , so that if i upload say 10 roles which are assigned to firefighter ID they should not be analyzed for RAR ??
2) I also could not find any option to upload "DEFAULT roles" which need to be assigned to any "NEW USER" request coming through CUP ??
Where can we make this setting, so that the basic roles can get assigned to the user when any new user request comes in.
Will you please put some light on this area ?
Thanks in advance.
Regards,
Victor

Hi Johanna
Have you run the synchronization job subsequent to the configuration of critical roles / profiles ? If not so try running the Synchronization job and then try risk analysis.
Regards
Swarna

HOW MANY ROLES ARE ELGIBLE FOR THE USER

hello gurus,
how many roles can we assign to the user... what is the maximum limit of the roles and profiles for the user.
thanks in advance!
sri

Dear Srinivas,
About roles it's indeed not to easy to tell..just imagine the scenario:
1. Maximum number of profile is 312 ... (however due to some known bug system reads about 300). So, let's say 300 profile maximum can be assigned to an user
2. Now you can have single ABAP role which generally one-to-one to profile. So, this theory says if you are only assigning single ABAP roles, you can assign maximum 312 (or 300) roles.
3. But, you might also have Composite ABAP role. A composite ABAP role can have one or more Single/Composite ABAP role. So, one Composite ABAP role can correspond to any number of Profile which is determined by number of individual Single roles under than composite role. So, when you are assiging Composite ABAP role, you have to take care underlying number of profiles and make sure total does not exceed 312 (or 300 without note correction)
4. Now, last part of complication (and my favourite one). Sometimes, there is an empty Role which does not have any ABAP authorization assigned to it. But, this type of roles are used to map a authorization role in JAVA system. These roles does not have any Profile (as it does not have any ABAP authorization). Now, that brings my confusion ..What happens you assign 300 ABAP profiles via ABAP Roles and another 20 empty role for JAVA system without profile. You see my point
Hope this clarifies a bit
Cheers !!
Satya.

Run a workflow with a low security role profile

Hello,
I created a workflow that is sending an email to the administrator when a certain action has to be done. To make sure this workflow has actually been running, I ended it with a step that update a two option field as 'Email sent'.
I would like to lock this field for users because I only want them to read it but not change its data. So I enabled security role.
The problem is that since I made that, the workflow cannot be run because users don't have the security role to change this field.
I found out while browsing thrgough the internet that I had to check 'Execute as the owner of the workflow', but this didn't help.
So does anyone has a response to my problem or another way to manage it? A solution that does not involve any code because I'm not working in IT at all, we're a small company and so I'm a salesman.
Thanks for your help.
Sylvain

Hi,
Create these 2 fields as non-searchable fields so users cannot search them. If the user does not need to change these fields, make the fields read-only on the form. There is no need to use security role profile and play with
security roles for this.
Hope this helps.
Minal Dahiya
blog : http://minaldahiya.blogspot.com.au/
If this post answers your question, please click "Mark As Answer" on the post and "Vote as Helpful"

Max roles & Profiles in user?

How many roles can we assign to the user? What is the maximum limit of the roles and profiles for the user?? *

Dear Praveen,
You can assign <b>300</b> authorization profiles to a user (see SAP Note <b>410993</b>).
Note 410993:
You would like to know the maximum number of:
profiles per user
authorizations per profile
authorization values per authorization
Reason and Prerequisites
All maintenance transactions work with the USR04, USR10 and USR12 tables.
Solution
As of Release 4.6A, the structure of the database tables used, and not the kernel, causes some restrictions:
1. Table USR04: Profile assignments for users
              This table contains both information about the change status of a user as well as the list of profile names that were assigned to the user.
              The PROFS field is used to save the change indicator (C = User created, M = User changed) and the name of the profiles assigned to the user.
The field is defined with a length of 3,750 characters. Since the first two characters are for the change indicator, 3,748 characters are still available for the list of profile names per user. Since the maximum length for each profile name is 12 characters, the maximum number of profiles per user is 312. Note 841612 delivered a solution for increasing the number of usable profiles per user from 300 to the maximum value of 312.
              Possible enhancements:
When you use roles exclusively, the number of profiles per user can only be doubled by assigning a reference user.
If you also use manual profiles, you can combine these to form collective profiles.
              Caution: In principle, we must advise against using these options. Reason:
Enhancements of this type increase the risk of an unwanted summation of authorizations. On the other hand, the number of entries also increases in the user buffer for authorizations (table USRBF2), which may result in longer runtimes when you perform authorization checks.
2. Table USR10: Authorizations or subprofiles per profile
              Due to the length of the AUTHS field (3,750 characters), you can enter the following maximum values in the manual profile maintenance (transaction SU02):
300 subprofiles    per collective profile or
150 authorizations   per single profile
Of course, the maximum value of 150 authorizations applies to the profiles generated in transactions PFCG or SUPC. Therefore, after you exceed this threshold, a new profile is automatically created.
3. Table USR12: Authorization values per authorization
              To save the authorization values, you use the VALS field, which is 3,750 characters long (just like the PROFS field in the USR04 table). Since the values can have different lengths, the number of values per authorization also varies. If you are unsure about whether VALS can accept all of the values that you maintain, you can check the length of the character string using the following formula:
NSTRING =
3 + 18*NFLDS +
NNORM(    1)(MAXLEN(    1)+1) + NGENE(    1)(MAXLEN(    1)+3) +
NNORM(    2)(MAXLEN(    2)+1) + NGENE(    2)(MAXLEN(    2)+3) +
...                                                            +
NNORM(NFLDS)(MAXLEN(NFLDS)+1) + NGENE(NFLDS)(MAXLEN(NFLDS)+3)
What the parameters mean:
NSTRING   = Total length of the character string in VALS
NFLDS    = Number of fields in the authorization object (10 = maximum)
MAXLEN(I) = Number of characters in the longest value in field I
NNORM(I) = Number of normal (not generic) values in field I
NGENE(I) = Number of generic values in field I
I = 1, ..., NFLDS
The absolute maximum length of an authorization value is 40 characters. NNORM(I) and NGENE(I) are the total number of values maintained in the 'From' and 'To' columns in field I.
Example:
The following authorization (chosen at random) for the S_USER_AUT object demonstrates how to apply the above formula:
Field No. Field Name   From Value          To Value
   1       ACTVT        03
                        08
2      AUTH         TESTFIAUTH00        TESTFIAUTH10
                        Z*
3       OBJECT       F_KNA1*
                        F_BKPF*
                        F_KNKK_BED
The variables have the following values:
NFLDS = 3
I       MAXLEN(I)    NNORM(I)    NGENE(I)
1          2           2          0
2          12          2           1
3          10          1          2
This results in the following value for the length of the characterstring in the VALS table field:
NSTRING = 3 + 18*3 +
          2( 2 + 1) + 0( 2 + 3) +
          2(12 + 1) + 1(12 + 3) +
          1(10 + 1) + 2(10 + 3)   = 141
Further explanations:
If NSTRING is greater than 3,750, the authorization cannot be activated or generated, which means that the values must be distributed across several authorizations. Exception: The profile generator can automatically divide authorizations in roles (activity groups) with just one field (example: the S_TCODE object) into up to 100 generated authorizations.
If profile generation fails because a role contains too many values for an organisation level, you cannot use additional authorizations to solve the problem. Due to the cross-object validity of organizational levels, their values would automatically be copied to the new authorizations. In this case, you only have the option to distribute values across several roles.
Hope this will help.
Regards,
Naveen.

When I start Firefox I get a menu box asking me to agree to let Firefox make changes to my computer. I click yes and the program opens and goes to my homepage. See Details below.

When I attempt to open Firefox from my desktop icon a menu box appears and backscreen grays out and I can't access anything else except this menu box. top of menu box says User Account Control. Next line says: Do you want to allow Firefox to make changes to this computer? I can click Yes (Firefox opens) No (menu box closes Firefox doesn't open) A link I can click says "change when these notifications appear" When I click it the menu box closes, Firefox doesn't open & link does not take me to where I can change my user account controls. Annoying, I just want Firefox to open directly to my home page like it did in prior versions.

Do a clean reinstall.
* Download a fresh Firefox copy and save the file to the desktop.
* Firefox 7.0.x: http://www.mozilla.com/en-US/firefox/all.html
* Uninstall your current Firefox version.
* Do not remove personal data when you uninstall the current version or you lose your bookmarks and other data in the profile folder.
* Remove the Firefox program folder before installing that newly downloaded copy of the Firefox installer.
* It is important to delete the Firefox program folder to remove all the files and make sure that there are no problems with files that were leftover after uninstalling.
Your bookmarks and other profile data are stored elsewhere in the Firefox Profile Folder and won't be affected by a reinstall, but make sure that you do not select to remove personal data if you uninstall Firefox.
* http://kb.mozillazine.org/Profile_folder_-_Firefox
* http://kb.mozillazine.org/Profile_backup

HT201304 It would be tremendously helpful to be able to access, set restrictions, and make changes from the parents device to all devices under the same iTunes account, so that I could make changes to my kids devices without physical access.

Please help!
It would be tremendously helpful to be able to access, set restrictions, and make changes from the parents device, to all devices under the same iTunes account, so that I could make changes to my kids devices without physical access.
I understand that I can set up a different Apple ID for the kids devices, or take physical control of the device and make the changes myself. However, my teenage son is technically savvy enough to have a job in Silicon Valley, as are most young people these days. However, in order to access his devices the current way, I first have to bypass the four digit pass code. This starts a fight of why I need in the device and continues to escalate. The argument that I am the parent will gain access but the fight is simply exhausting, and quite frankly shouldn't have to happen at all. He is not yet an adult, he did not pay for his iPad or iPhone and I, as a parent, should have not only have the right to change options at will, and from anywhere, but look at history or current activity when I feel like it.
I currently have the settings where app and in-app purchases require my password to be put in, and he must come to me to type it in, but I need more control and would like, and should be able to access any of our six devices and make individual changes simply by logging in to my account, with my password.
If I can see all my devices on the "Lost My iPhone" app, this technology should be easy to make happen.
C'mon parents! I have a pretty good kid, given all things that they can get into, but I am not stupid. For everything I see has been done, there is much more I haven't seen. I want my children to be kept safe and be able to know what they are looking at or listening to. We parents are the only ones who know our beliefs and what our kids can handle and when.
Thanks for any support or information that I may be missing in order to fulfill my request.

There are mobile device management solutions that can do this, including in Apple's OS X Server system, but most parents generally find that setting this up is more work than it's worth. If you're interested, though, there are a couple that at least purport to be free (I don't know if there are any hidden "gotchas"):
http://www.unwireddevicelink.com/features/
https://meraki.cisco.com/products/systems-manager
and Apple's system:
http://www.apple.com/osx/server/features/#profile-manager
I don't think any, however, allow you to see current activity or browser history. iOS doesn't expose those to access from MDM solutions, to the best of my knowledge.
Regards.

Why do most of my stacks come ungrouped when I make changes to other files in the same folder?

I have a folder of about 3000 graphics and photos that I use for work. I've meticulously organized them all by using unique file names, keywords, and sorting. However, when I make changes to a set of files (especially using the batch rename tool), a large percentage, even a majority, of the other stacks in the folder come ungrouped.
This has been happening to me for several months, and so far I can't see any type of order or factor that makes certain files come ungrouped. Many times, it's the same files that come ungrouped, but in addition to those, there will be other random stacks that I lose. My stacks are only a few files big (each stack is comprised of the same picture in different file types) and with how many files I have, this has become seriously detrimental to my workflow and efficiency. Anywhere from 20-70 stacks will become ungrouped. I almost always have my files sorted by filename, and when I rename files using batch rename, I give them such similar names that I'd think there would be no reason for the rest of my files to come ungrouped. For example, if there are three files I want to group, I will give them a name like background_001, background_002, and background_003. After I do this, I'll discover that my stacks with names like template_(sequence number) and UI_(sequence number) have come ungrouped. It will do this with pages and pages of stacks at the same time, regardless of how I have the files / stacks sorted. It doesn't happen everytime I rename a batch, either. I just created 10 batches of 3 like-named files each, and after this last batch, about a hundred files came ungrouped.
I understand that doing things like changing the sorting method of files, or renaming a file so that it's thrown in the middle of a stack, will ungroup my stacks. I don't think I'm doing any of these things (I've been trying desperately to make sure I don't change the sorting method of my files or do anything to a file that might have an effect like this). I don't use ratings or color labels in these folders, the only tools I use are batch rename, keywords, and stacks.
Is there any way to preserve my stacks so this stops happening in the future, or I can correct it when it does?

This is my first time posting here, so I'm sorry, I re-read my post several times and honestly did think I provided enough information, but you're right, it wasn't the right kind. So please (continue to) bear with me, I'm really not trying to be ignorant. I honestly assumed the issue was something I was doing wrong in Bridge, nothing to do with my computer specs.
I am using a late-2008 Macbook, running Yosemite 10.1.1 (screenshot below)
On the Mac I am using Bridge CC 6.1.1.115 and Photoshop CC 2014 (2014.2.1 release, 20141014.r.257 x64)
Here is a link to the System Info from Photoshop on the Mac
Here is a screenshot of my System Overview on the Mac
Here is a screenshot of my Photoshop performance preferences on the Mac
I am also using a Dell desktop with Windows 8, running Photoshop CC 2014 (2014.2.1 release, 20141014.r.257 x32) and Bridge CC 6.1.0.116 x32 (on a separate CC account with separate files that I don't try to sync or anything)
Here is a link to the System Info from Photoshop on the Windows computer.
Here is a screenshot of the system overview on the Windows
Here is a screenshot of my Photoshop Performance preferences on the Windows computer
I work with jpg, psd, ai, svg, and pdf files. Most of my stacks are three different file types of the same image, usually jpg, psd/ai, and pdf.
I have not recieved any error messages
I am not having issues opening raw files, I am not having printing issues, I have listed the troubleshooting steps I have taken.
Is there any information you need that I missed? I'm trying not to be a dingus, but I'll have to ask you to be patient with me in the meantime. I haven't ever looked up half the hardware/software details that were suggested and I don't know how to off the top of my head, so I provided what I already knew how to

G'day. I am using iMovie 11 and need to clear disk space. How can I do that using an external drive, leaving me the option to go back and make changes or access old events or projects from that external drive?

G'day. I am using iMovie 11 and need to clear disk space. How can I do that using an external drive, leaving me the option to go back and make changes or access old events or projects from that external drive?

The slightly bigger question is whether you want to move all movie content to the external drive (essentially meaning that drive will always need to be attached when you're working with your videos), or whether you just want to archive older videos off to the external drive.
If you want to move all videos, then just move the 'Movies' folder in your home directory to the external drive, then create an alias of the external 'Movies' back in to your home directory. Now the 'Movies' icon in your home directory will point to the external drive and everything will just work (as long as the external drive is attached when you launch iMovie)
If you want to archive older movies then each Movie should have its own subdirectory within your Movies folder. These can easily be moved off to the external drive, and moved back should you ever need to work on those movies again.

Trying to understand "User/Role/Profile Synchronization" and Batch Analysis

Hello,
Im trying to understand what exactly and from which tables these jobs are copying to which tables in CC. I have a understanding that these jobs are moving also deleted roles from backend. This is causing unnecessary delay to long lasting job.
I would appreasite if some one could explain the logic behind these jobs. What the fullsync and incremental is reading ? What kind of changes are causing a role/user/profile to be included to the full and incremental jobs?
How the incremental analysis logic is built ?
br Janne

Janne,
In my current implementation we are going for an offline risk analysis due to the heteregoneus system landscape of our client (several SAP and non SAP systems and several SAP systems under 4.6C). Eventhough within our approach we don't perfrom the backend synchronization (we use CC data extractor to pull data from backend into CC) hope the following info could hel you:
The tables such jobs you mention access to, are all the SAP backend system tables related with users, roles, profiles, action and permissions. If you check the data mapping appendix of the "user and configuration guide for 5.2" you will see all the data that CC retrieves. For instance, in order to extract user info (UserID, FName, LName, Email, Phone, Email, Department) tables USR21, USR02, ADRP, ADR6 and ADCP must be accessed.
In terms of CC tables:
VIRSA_CC_SYSUSR >> UserIDs and Systems ID relationship
VIRSA_CC_GENOBJ >> User, Role and Profile master data
VIRSA_CC_GENACT >> User-action, role-action and profile-action data
VIRSA_CC_GENPRM >> User-permission, role-permission and profile-permission
VIRSA_CC_SAPOBJ >> Action-permission
VIRSA_CC_OBJTEXT >> Objects descripcions (ACT, PRM, FLD, VAL, ORG)
Hope this helps.
Regards,
Imanol

Premiere Pro CS3 - How to Save a Final Project to Make Changes to Afterwards

OK, I just registered to the forum and this is my first post/question.
I'm fairly new to Premiere Pro editing
, and I wondered if there was a way to save the whole edited project/sequence to an external drive in case the client wanted changes to the project after they had viewed it.
I edit mostly weddings, so the projects are anywhere from 1hr 30m to 1hr 50m. I've watched all the lynda.com tutorials on Premiere, and I know about saving the final project as an ISO image file or as DVD folder, etc.
Also, I thought I remembered hearing something about being able to 'delete' the footage that wasn't used in the project too, and just saving the edited project somehow? I just thought I'd ask before I go ahead and delete all the footage that pertains to this edit. I've made an ISO file, but it doesn't look like Premiere will load it; nor will it load the video_ts files/folder.
Anyway, so my questions are:
1. Is there a way to load an ISO file to make editing changes?
2. If not, then how could I save the whole project/sequence in order to load it back into Premiere to make any changes to the original edit?
3. Does anyone here use Premiere for wedding edits? And if so, how do you 'save' projects for the longterm, in case you wanted to make changes to it?
4. Once you have an ISO image file saved, how do you burn it through Encore? Or am I forced to use the Roxio Creator program?
I guess that's it for now. I'm sure there are many more questions that I need answered, but I'll save them for later. :-)
Thanks in advance for any and all suggestions!

I do a LOT of weddings. Here's the process I've come up with over the years.
First, make a window dub of the whole thing. Sit down in front of a properly calibrated TV and home theater system and watch it from beginning to end. Make notes on what needs correction (here's where the visible timecode comes in handy) - music selections, audio levels, clips to be trimmed, color corrections, misspellings, etc.
Then, make those changes.
Next, author the final DVD for client review. Send that out with appropriate paperwork for a signed approval. Never delete/archive a project without client approval. Now, because some clients would take literally months to approve a project, I instituted a time limit of three weeks. After that, any project is considered approved and may be archived. I make this very clear, with the deadline in writing, when I send out the review sample.
If the video comes back for changes, things are still in place and I just make the requested changes, sending out another review copy with a two week limit this time. When an approval comes back or if a time limit passes, I finish up the project.
I make any remaining client copies, plus one copy of the DVD to go on a shelf. I also make an ISO for storage on an internal hard drive, to be moved later to an external hard drive at the end of every year. This gives me two master copies of the finished DVD.
I then save the project file, music and other audio selections, pictures and graphics to a CD (DVD if more space is needed, but this is rare). I make two copies in case one goes bad, and file them by groom's last name in a small CD file case. The previews and conformed files can always be rebuilt, so there's no need to save them. The actual media can be recaptured from tape, so they just get put on a shelf.

To make/change easily so many roles & profiles

Similar Messages

Maybe you are looking for