Which auths for BASIS tasks?

We want to carry out BASIS support tasks on our customer's SAP systems (ABAP & Java)
They are not ready to provide SAP_ALL & SAP_NEW auths for this purpose.
What auths will be required to perform these tasks?
We intend to perform the std daily/weekly/monthly BASIS tasks such as:
Servers (SM51), processes (SM50), database (DBxx), O/S (ST06), Dumps (ST22), bkg jobs (SM37) and so on
(about 20+ tcodes)
It would be great if someone could provide links which we could refer.
Thanks in advance

Cons,
BASIS tasks are not limited to certain number of transactions and should be wide enough to cover most of the critical function with respect to security in mind. What your BASIS team would do in some critical situation when you may have restricted them to say 10 transactions.
In my view you need to define the requirements. Best thing to start with is to discuss with your BASIS team about the requirements. Once you confirm the requirements than start building role and let them test in staging environment and tune your role till you (as security personal and your BASIS team) are comfortable.
There are also fast and easy ways such as copying template and assign admin profiles, however question is what level of access is appropriate from your BASIS team's daily tasks prospective and have you already identify the risk associated with level of access which is in line with your organizations strategy.
There is a reason why SAP provides its GRC tool set to manage Super access.

Similar Messages

How to set the Expiration Date for a task which is been assigned explictly.

Hi,
When I assign a task to myself and not work on it for couple of weeks the task is getting released automatically into the original unassigned pool. The TaskActionHandler WSDL is causing that to happen. I don't want a task to be automatically released into the pool when I don't work on it for couple of weeks, how can I make that happen? TaskActionHandler is something which comes with the BPEL so I can't change the way how it behaves. Do I need to set the expiration date or duration explicitly when a task is created?then how do I do that?
If anybody could let me know how to make TaskActionHandler not to release a dehydrated task, I would be glad.
Thanks,
Mythili.

Hi,
Make AUTO RELEASE a restricted action for the task by adding the following line:
<restrictedAction>AUTO RELEASE</restrictedAction>
to the <restrictedActions> tag in the task configuration file.
Works effectively.
Alternatively, you can specifiy the auto release durations on a per task priority basis. There is more on that in the BPEL Dev Guide.
Hth, Sjoerd

Which solution is better for schedules task? Console application or windows service?

I have a "MULTI-LEVEL" XML file that I will be getting on daily basis and I want to accomplish following tasks:
1) I have to read and parse the "MULTI-LEVEL" XML data
2) Then I have to set or create some kind of .net service (c#) that read the xml and parse the data once a day (daily)?
3) Now I have SOAP service from other software where I want to feed this XML data to. The schedules service will compare the XML data with software data and update (or add) based on the comparision.
For this task, I come to conclusion that there are 2 best ways to do this:
1) Create a console application and use windows task scheduler to run it everyday
2) Create a windows service that runs in the background
Which is a better way (or reliable) solution to do this task? Please advise

There are several things to keep in mind when writing an app that is designed to run without a user logged in. One of the most common mistakes is requiring some sort of user input. Since the task will run without user intervention you don't want
any sort of calls to Console.ReadLine, MessageBox.Show, etc. They will cause the task to freeze and eventually need to be terminated. You also don't want to rely on any sort of desktop apps running since a user may or may not be logged on at the
time.
Also be aware that a task can be scheduled to run under any user context. As such you either need to ensure it runs under an account with sufficient privileges or that your app needs no special privileges. You mentioned you tried to run it from
bin\debug but you most likely have your project under your Documents directory. Only you would have permissions to that folder and therefore will run into issues if the task is run under a different context. You also mentioned you put it in the
C:\ but users don't have write privileges to that folder and therefore if you tried to write a file out it would fail. If you need to read/write files then you should pick a common location that all users have access to or at least the one that will run the
scheduled task. Be aware that, by default, Task Scheduler will not run a task elevated. You need to check the option to run elevated when you configure the user to run the task under.
One of the key things to ensure you do with a task is verify it is working properly as a normal app. You should also ensure that you have good logging so that if it does fail you can trace down the failure more easily. One common thing that people
tend to do in console apps is put a try-catch around the main function and display a message if an unhandled exception occurs. This is going to cause problems in a task. Simply log the exception and rethrow it so Task Scheduler will flag the run as a
failure.
If you still cannot figure out why your task is failing then please add some logging and then tell us what code is being run at the time and what the failure is.

Cannot use jstl tag for jsp page which generated from Human Task

Hi
Plz help me.
I have tried to using jstl in jsp which generate from Human Task and I deploy it to server( by ant on Jdev ) to see task detail in Oracle Worklist application. But when i submit task and then I access to worklist to see task detail, the error has show in page that "OracleJSP: An error occurred. Consult your application/system administrator for support. Programmers should consider setting the init-param debug_mode to "true" to see the complete exception message. " .
I access server to see application.log to see error and I see error show "workflowform: JspServlet: unable to dispatch to requested page: Exception:oracle.jsp.parse.JspParseException: /Header1.jsp: Line # 3, <%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c"%> "
How do I fix this error?
PS. I tried to us jstl because I need to connet to database which jstl tag(sql) if somebody has another solution for connect database in task detail page, Please help suggest me.
Thanks
user520932

Is the jstl tag libray loaded in the appsserver?
Can you use jdbc connection like
DataSource ds = ic.lookup("java:comp/env/jdbc/myDB");
Connection con = ds.getConnection();
DataSource ds = (DataSource) org.apache.derby.jdbc.ClientDataSource()
ds.setPort(1521);
ds.setHost("localhost");
ds.setUser("APP")
ds.setPassword("APP");
Connection con = ds.getConnection();
http://java.sun.com/docs/books/tutorial/jdbc/basics/connecting.html

How do we create user defined Task in OM & Which report we run for the Task

Hi
How do we create user defined Task in OM & Which report we run for the Task.
Regards
Rajesh

You can create tasks using PFCT or path: Human resources> Organizational management> Expert mode> Task catalog in Easy access.
Check this link may be useful for you: http://help.sap.com/saphelp_40b/helpdata/pt/fb/135d89457311d189440000e829fbbd/content.htm

CRM training for Basis?

Hello all,
I am a Basis guy. I am tasked to take care of the CRM part of job within the basis team. Thinking of taking a CRM traning course for basis. I don't find a CRM course which is dedicated for SAP Basis. Is there a CRM administration class? How about CR010? Please help me with this. Thanks.

Hi,
first thing is, already your working and if you find time to learn in the free timings its good and the thing is you need to install the CRM and practice after having fast track course (training).
let me know in which city your working
Thanks,
prabhu kishore reddy.

Profiles for Basis Admins

Does anyone have a list of transactions that would be considered adequate for a basis administrator on a production system, which would allow them to do all the work they may need to without logging in with a sap_all id?
What is the best practice for access for basis in production?
Lee

Hi Lee-
I can understand where are you coming from :). You needed the list of all possible basis tcodes in production environment rather adopting strenuous task of deriving and identifying all required functionality from SAP Standard role template for basis. Not an issue
You can refer the tcodes listed below in production environment. It includes all required for regular support, monitoring & performance analysis.
SSO2 Workplace Single Sign-On Admin.
STRUSTSSO2 Trust Manager for Logon Ticket
BD82 Generate Partner Profiles
SMT2 Trusting systems (Display <->Maint.)
SPAU Display Modified DE Objects
SDCCN Service Data Control Center
SLG1 Application Log: Display Logs
SGEN SAP Load Generator
STMS_MONI TMS Import Monitor
STMS Transport Management System
SCOOL COOL Repository
PFUD User Master Data Reconciliation
SMMS Message Server Monitor
SICK Installation Check
SMICM ICM Monitor
SE38 ABAP Editor
AL04 Monitor call distribution
AL08 Users Logged On
AL11 Display SAP Directories
AL12 Display table buffer (Exp. session)
AL13 Display Shared Memory (Expert mode)
AL15 Customize SAPOSCOL destination
AL16 Local Alert Monitor for Operat.Syst.
BD21 Select change pointer
BD50 Activate Change Ptrs for Mess. Type
BD51 Maintain function modules (inbound)
BD52 Activ.change pointer per chng.doc.it
BD54 Maintaining Logical Systems
BD64 Maintenance of Distribution Model
BD97 Assign RFC dest. to Logical Systems
CK11 Create Product Cost Estimate
DB01 Analyze exclusive lockwaits
DB02 Tables and Indexes Monitor
DB03 Parameter changes in database
DB12 DBA Backup Logs
DB6BACKHIST DB6: DBA Planning Calendar
DB6CLP DB6: Command Line Processor
DB6COCKPIT DB6: DBA Cockpit
DB6EXL DB6: Analyze Exclusive Lock Waits
DB6PERF DB6: DB2 UDB Cockpit Performance
DB6SPACE DB6: Space Analysis
FTXP Maintain Tax Code
KOSRLIST_PR Projects/Nets: Coll. Displ.SettRules
LBWE LO Data Ext.: Customizing Cockpit
LSMW Legacy System Migration Workbench
OS01 LAN check with ping
OS03 O/S Parameter changes
OS04 Local System Configuration
OS05 Remote System Cconfiguration
OS06 Local Operating System Activity
OS07 Remote Operating System Activity
OSS1 Logon to SAPNet
OY05 Factory calendar
RBDMIDOC Variant for RBDMIDOC
RSA7 BW Delta Queue Monitor
RZ01 Job Scheduling Monitor
RZ03 Presentation, Control SAP Instances
RZ04 Maintain SAP Instances
RZ10 Maintain Profile Parameters
RZ11 Profile Parameter Maintenance
RZ12 Maintain RFC Server Group Assignment
RZ20 CCMS Monitoring
SA38 ABAP Reporting
SAINT Add-On Installation Tool
SALE Display ALE Customizing
SASAPIMG Call Up Project IMG
SBIW BIW in IMG for OLTP
SCON SAPconnect - Administration
SCOOLTOOL COOL Tools
SCOT SAPconnect - Administration
SCU0 Customizing Cross-System Viewer
SCU3 Table History
SE03 Transport Organizer Tools
SE06 Set Up Transport Organizer
SE12 ABAP/4 Dictionary Display
SE13 Maintain Technical Settings (Tables)
SE15 ABAP/4 Repository Information System
SE18 Business Add-Ins: Definitions
SE37 ABAP Function Modules
S_TABU_DIS Display Tables (customize it to ztcode)
SCC4 (customize it to ztcode)
SE63 Translation: Initial Screen
SE11 ABAP Dictionary
SE11_OLD ABAP/4 Dictionary Maintenance
SE80 Object Navigator
SE81 Application Hierarchy
SE82 Application Hierarchy
SE84 R/3 Repository Information System
SE93 Maintain Transaction Codes
SESSION_MANAGER Session Manager Menu Tree Display
SICF HTTP Service Hierarchy Maintenance
SM01 Lock Transactions
SM02 System Messages
SM04 User List
SM12 Display and Delete Locks
SM13 Administrate Update Records
SM14 Update Program Administration
SM20 Security Audit Log Assessment
SM21 Online System Log Analysis
SM28 Installation Check
SM35 Batch Input Monitoring
SM36 Schedule Background Job
SM37 Overview of job selection
SM37C Flexible version of job selection
SM38 Queue Maintenance Transaction
SM49 Execute external OS commands
SM50 Work Process Overview
SM51 List of SAP Systems
SM56 Number Range Buffer
SM58 Asynchronous RFC Error Log
SM59 RFC Destinations (Display/Maintain)
SM61 Backgroup control objects monitor
SM62
SM63 Display/Maintain Operating Mode Sets
SM64 Trigger an Event
SM65 Background Processing Analysis Tool
SM66 Systemwide Work Process Overview
SM69 Maintain External OS Commands
SMEN Session Manager Menu Tree Display
SMGW Gateway Monitor
SMLG Maint.Assign. Logon Grp to Instance
SMLT Language Management
SMQ1 qRFC Monitor (Outbound Queue)
SMQ2 qRFC Monitor (Inbound Queue)
SMQR Registration of Inbound Queues
SMQS Registration of Destinations
SMT1 Trusted Systems (Display <-> Maint.)
SMX Display Own Jobs
SNL1 Display NLS (character set, lang.)
SNOTE Note Assistant
SNRO Number Range Objects
SNUM Number Range Driver
SO00 SAPoffice: Short Message
SO01 SAPoffice: Inbox
SO02 SAPoffice: Outbox
SO03 SAPoffice: Private Folders
SO04 SAPoffice: Shared Folders
SO05 SAPoffice: Private Trash
SO07 SAPoffice: Resubmission
SO23 SAPoffice: Distribution Lists
SO50 Rules for inbound distribution
SO99 Put Information System
SOST Overview transmission requests
SP01 Output Controller
SP12 TemSe Administration
SPAD Spool Administration
SPAM Support Package Manager
ST01 System Trace
ST02 Setups/Tune Buffers
ST03 Performance,SAP Statistics, Workload
ST03N R/3 Workload and Perf. Statistics
ST04 DB Performance Monitor
ST05 Performance trace
ST06 Operating System Monitor
ST07 Application monitor
ST10 Table Call Statistics
ST11 Display Developer Traces
ST14 Application Analysis
ST22 ABAP dump analysis
STAD Statistics display for all systems
STAT Local Transaction Statistics
SU01D User Display
SU03 Maintain Authorizations
SU51 Maintain Own User Address
SU52 Maintain Own User Parameters
SU53 Evaluate Authorization Check
SU55 Call the Session Manager menus
SU56 Analyze User Buffer
SUIM User Information System
S_BCE_68001285 Transaction S_BCE_68001285
S_BCE_68001402 With Unsuccessful Logons
S_BCE_68001418 Act. Grps According to Complex Crit.
S_BCE_68001420 Act. Grps According to Complex Crit.
S_BCE_68001429 Transactions for User
TU02 Parameter changes
USMM Customer measurement
WE02 Display IDoc
WE05 IDoc Lists
WE07 IDoc statistics
WE08 Status File Interface
WE09 Search for IDoc in Database
WE20 Partner Profiles
WE21 Port definition
WE30 Development IDoc Type
WE46 IDoc administration
WE60 Documentation for IDoc types
WE61 Documentation for IDoc record types
WE63 Documentation
Cheers!
Ashok

Need to pass field value as input parameter for a task

I have the following scenario:
User opens a task from UWL and sees a UI in which a Quote no. is generated, which is saved in the backend. Next time the user comes to this UI(from the same task in his UWL) he should see the Quote no. generated. Also, the data is fetched from backend by calling BAPI which takes the Quote no. as input, which was generated the first time user visited this UI.
My concern is how can I store this Quote no. in GP, which was generated the first time, so that user sees the data specific to quote no., as relevant for that task.
Please help.
Thanks and Regards
Aanchal

Hi Srinivasan,
Thanks for ur quick response.
I am explaining my issue further.
User comes to this UI (first time), Quote no. is generated. User fills some other fields( but does not complete whatever he has to) and saves the data to backend. Now user closes the window (task remains in his UWL), but now when he opens the task, he should see the Quote no. which was generated earlier and also data which he saved(by calling BAPI). How can I get this quote no.?
Can you please explain what you mean by "expose the quote no. at process level"?
Thanks and Regards
Aanchal

How can I import songs which are filed basis one album/compilation as one folder?

How can I import songs which are filed basis one album/compilation as one folder?
i can drag and drop one folder which is a proper album into itunes under playlist. if i drag and drop two proper albums into itunes it is also ok but if itunes does not know my own compliations and i drag and rop my 3000 folders in one shot into itunes i get only one playlist containing all songs.
pleased to hear if anybody know how i can avoid to do 3000 times drag and drop a folder into itunes.
rgds, alexander

Before you begin the import, edit the properties of the tracks to set the Album Artist to Various Artists and Part of a Compilation to Yes.
For more info. see Grouping tracks into albums.
tt2

How to create a page-definition for bounded task-flow?

I should be able to create a page definition which declare all bindings required for a bounded task flow.
How do I do it in JDeveloper 11.1.1.2?
How do I navigate to the page definition when I am in the bounded task flow "Diagram tab"?

I found out the following:
1. To create a page-definition file for a bounded task flow
Right click on the "Default" activity (not a view activity) of the bounded task flow, select "Create Page Definition" from the context menu.
2. To go the page-definition file for a bounded task flow
Right click on the "Default" activity (not a view activity) of the bounded task flow, select "Go to Page Definition" from the context menu.
My new question is:
In JDeveloper 11.1.1.2, how do I create page-definition for a bounded-task-flow if all activities are view activities (page fragments) ?
How does JDeveloper I want to create page-definition for the task-flow instead of create page-definition of the page fragment or the page?

"No administrator found for the task" in the front end

Hi all,
My issue is, whenever approval request is raised from the front end ( JAVA WEB-DYNPRO), it triggers the workflow through the "sap_wapi_start_workflow" and when the workflow proceeds to the first level of approval, the front end application provides the approver with Approve and Reject options.
On click of approve, from the java webdynpro, the approve status is written in the container using "sap_wapi_write_container" and then a call is made to "sap_wapi_workitem_complete". Upon excution, the message line is "No administrator found for the task" and the return code is "1".
But if we do the same steps from the backend (R/3), the workitem is getting completed without any such error.
Please advice.
Thanks.

Hi Balaji,
I think I have an answer for you. This has happened with us when approving a WD java task using UWL (in our case for travel). The key is the return code of 1.
What has happened is this. The return code actually comes from the function SWW_WI_STATUS_CHANGE_NEW which is called deep in the WAPI wrapper. It means "infeasible_state_transition = 1".
This is due to the fact that after updating the container, your wapi call from web dynpro tries to change the workitem from status of "Ready" to status "Completed". This will not work.
What you will have to do is call "SWW_WI_STATUS_CHANGE_NEW" to set the status to 'SELECTED' beofre setting the item to complete.
The reason for this is that when you are executing from R3, the status change is done for you. When calling from the WD, no reservation of the workitem occurs.
Sorry about last night, I live well outside of town and the phone reception at my place is poor.
Regards
Gareth

R1: tcAPIException: Duplicate schedule item for a task that does not allow multiples.

Hi,
I'm struggling with the following task:
I have to assure an account exists for a given resource. I do provision it with the .tcUserOperationsIntf.provisionObject().
I've created a createUser task to create the account.
The task code checks if there is already matching account.
If no account exists, is is created in the disabled state, and the object state of OIM account is set to 'Disabled' by means of task return code mapping.
If it exists, it is 'linked' to OIM account.
The problem is if the existing account is enabled, I have to change the OIM account state to 'Enabled' either.
To implement this (thanks, Kevin Pinski https://forums.oracle.com/thread/2564011 )) I've created an additional task 'Switch Enable' which is triggered by a special task return code. This task always succeeds, and its only side effect is switching the object status to 'Enabled'.
By I've getting the 'Duplicate schedule item for a task that does not allow multiples' exception constantly:
This is the stack trace:
Thor.API.Exceptions.tcAPIException: Duplicate schedule item for a task that does not allow multiples.\
at com.thortech.xl.ejb.beansimpl.tcUserOperationsBean.provisionObject(tcUserOperationsBean.java:2925)\
at com.thortech.xl.ejb.beansimpl.tcUserOperationsBean.provisionObject(tcUserOperationsBean.java:2666)\
at Thor.API.Operations.tcUserOperationsIntfEJB.provisionObjectx(Unknown Source)\
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)\
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\
at java.lang.reflect.Method.invoke(Method.java:601)\
at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310)\
at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)\
at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)\
...skipped
at Thor.API.Operations.tcUserOperationsIntfDelegate.provisionObject(Unknown Source)\
... skipped
What did I wrong?
Regards,
Vladimir

Hi Vladimir,
Please select 'Allow Multiple Instance' checkbox for the process task.
Thanks,
Pallavi

Mobile 3.1 can't find bundle for base name labels

Hi all.
I installed the Business Objects Mobile 3.1 few days ago on a dedicated server without using proxy server because the installation is in test mode with no external access. Both products (BO Enterprise XI3.1 & BO Mobile 3.1) are installed on separate Windows Server 2003 machines. The installation has the default database (Apache Derby) and both services (VAS & VMS) are working. The mobile device is a virtual device on my PC using Windows Mobile 6.1 operating system.
The client application has been installed on mobile device and users can succesfully log on to the CMS using Enterpise Authentication method. After this two folder icons are displayed on screen, first for Local Documents and second for Server Documents. Clicking the Server Documents the following error message is displayed on screen "Can't find bundle for base name labels, locale el_GR (0x15)"
I tried to resolve the problem changing the regional settings from Greek to US in servers, my PC and Virtual Device but the exact error still appears. Does anybody knows what to do or where to look for a solution?
Thanks for reading my message. Happy and creative new year for all.

Here is my suggestion.
Do you have the property file named "webui-resources_en_US.properties"?
Here is the example
language="en"
country="US"
locale = new Locale(language, country);
bundle = ResourceBundle.getBundle("com.<companyname>.webui-resources");
copy the webui-resources_en_US.properties file to the directory
com.<companyname> in your workspace/IDE/localdirectory. or ftp that file to classes/com/companyname directory
This should work. I am using it that way.
which appserver r u using?

Difference between Due Date for All Tasks and Duration per task in an approval workflow

Hello,
I'm starting to read up and learn about approval workflows in Designer 2010. I am confused by the fields "Due Date for all Tasks" and the "Duration per task". I understand that the Due date for all Tasks is the date that all
of the tasks in the workflow must be completed by. And I understand that the duration means each task has x number of days to complete.
But I dont know whey we need them both. If I have the task duration set to two days and there are 3 tasks involved, then wouldn't the due date be 6 days from the start? Why would I have a due date for all tasks that is completely different than
the sum of the duration of days for each task?
Please help shed some light!

Hi Michelle,
Due date for all tasks, this setting specifies the date by which all tasks are due. It’s used for serial and parallel
task.
Duration per tasks, this setting specifies the date by which an individual
task is due, it’s used for serial workflow participants.
Note, when you create an approval workflow, select task process participants(approvers oob approval workflow), we can also
select once at a time(serial) or all at once(parallel).
For more information, see
http://office.microsoft.com/en-us/sharepoint-server-help/use-an-approval-workflow-HA101793831.aspx
Best Regards.
Kelly Chen
TechNet Community Support

No administrator found for the task error message

Dear all,
I got the message "No administrator found for the task" when the MSS user try to approve and overtime. When i double click on the error for details, it actually give
WF notification:work item cannot be executed message no. 5W141. As got overtime, i am using the standard task 20000460 which i already maintain the agent as general task. I am using the Agent (Default Rule) rule number 157 (Superior (chief position)).
I tested it in my development and it works, however it does not work in my production. Do i miss any setting or parameter?
My R/3 backend is 4.7 with Enterprise Portal 6.
Thanks
Regards,
Bryan

You hvae to refresh the organizational assignment and you can do it from SBWP txn ,
1.Execute SBWP.
2.On Menu clcik on Settings -
> Workflow Settings -
> Refresh Organizational Assignment .
and now you try to execute the workitem now you find see the error.

Which auths for BASIS tasks?

Similar Messages

Maybe you are looking for