mySAP environments can become advanced from the perspective of person administration because of the number of component systems, in addition to the complexity of synchronizing them. Person management includes creating new customers; deleting customers who leave the corporate; updating or modifying the grasp data; managing the component techniques, connections, and the ALE configuration and so on.
Customers from the R/3 world know effectively that the customers’ grasp information is client specific.Every client must be independently managed within a system landscape. For every SAP R/3 system and for every client there may be the need for creating users which can be going to work in that environment. Moreover, customers want authorization profiles for gaining access to the required transactions. These must even be maintained.
Usually with the SAP R/3 system, customers may very well be copied throughout clients or across methods with the transport tools or the consumer copy tools through the use of the SAP_USER copy profile, which supports the duplication of all users and their authorizations . There are no synchronization mechanisms or utilities for having all user masters updated throughout clients.
All this decentralized and laborious work, which requires a great amount of time and administration sources, has been vastly simplified in mySAP environments utilizing the CUA utility. This tool is also accessible independently in R/3 techniques since release 4.5. This level is quite vital as a result of, though the Workplace can join component systems from launch 3.1I and better, methods with a lower release than 4.5 can't make use of or be integrated within the CUA functionality.
Background of R/3: Overview of the SAP Authorization
The standard SAP and R/3 authorization system was answerable for implementing the proper security methods in order that users might entry the business transactions and info they needed. The SAP systems always provided a complete, complex, and flexible means of securing information and transactions in opposition to unauthorized use.
Because the introduction of the discharge 4.6 of R/3 and the position idea as one of many backgrounds for mySAP, the authorization system has slightly changed to make it easier to implement, extra adjustable to specific customers’ wants, and with more options for personalizing and wonderful tuning. Nevertheless, the muse of the function concept remains to be fully based on the traditional SAP R/three authorization concept. SAP R/3 users are outlined in person master information, where they're assigned one or extra authorization profiles. These authorization profiles are product of a set of authorizations, which offer management accesses or access privileges for the operating or accessing of the totally different transactions and objects of the SAP systems. Further down, authorizations refer to authorization objects that contain a variety of permitted values for various system or enterprise entities within the R/three system.
The implementation of the authorization idea never was technically difficult, though it could be very time consuming. It was, nonetheless, an enormous subject within implementation tasks due to the organizational facets of it. This sort of implementation should always be a joint mission and energy between the SAP practical and the technical people. The reason is that often SAP system managers or technical consultants do not need to cope with things like giving access to sure users to particular price centers, accounts, gross sales organizations, or product ion plants. It is usually the function of the key users, customizing specialists, builders,or enterprise consultants to outline the transactions, objects, or entities that ought to be protected by the use of authorization objects and to assign or create the corresponding authorization profiles.
SAP Authorization Profiles
An authorization profile comprises a gaggle of authorizations, that is, a bunch of entry privileges. As indicated above, profiles are assigned to customers within the consumer master records. A profile could signify a simple job position because it defines the tasks for which a consumer has access privileges. Each profile might need as many access privileges as desired. Profiles can comprise authorization objects and authorizations. Altering the checklist or contents of the authorizations inside a profile will affect all customers who are provided that profile when it's activated. It becomes efficient the next time the consumer logs on. The change isn't effective to the presently logged on users.
Composite Profiles
Composite profiles are units of authorization profiles, each simple and composite. A composite profile can contain an infinite number of profiles. They can be assigned to customers just like profiles in the person grasp records. Composite profiles are suitable for customers who have completely different responsibilities or job duties within the system.These profiles are generally known as reference profiles for assigning a larger group of entry privileges and having the possibility to raised match customers with several responsibilities. This idea is technically very related to the present role concept.
Making modifications to any of the profiles within the listing included within the composite profile will instantly affect the access privileges of all customers having that composite profile in the person master record. When displaying profiles within the different SAP screens, there is a flag indicating whether or not the profile is straightforward or composite.
SAP Authorizations
The SAP systems use authorizations to outline the permitted values for the fields of an authorization object. An authorization would possibly comprise one or more values for each field of the authorization objects. An authorization object is type of a template for testing access privileges, consisting of authorization fields that finally define the permitted values for the authorization. An authorization is recognized with the identify of an authorization object and the identify of the authorization created for the object. An authorization can have many values or ranges of values for a single field. It is also doable to authorize for each worth (getting into an asterisk “ *”) or for none (leaving the sphere clean).
Authorizations are entered in authorization profiles with the corresponding authorization object.When an authorization is modified after which activated, it'll instantly have an impact on all users having a profile containing that authorization in their consumer master records. The technical names for authorizations and authorization objects have a maximum of 12 positions, however normally they show in the system utilizing quick descriptive texts. For buyer-created authorizations, the one title restriction is to not place an underscore within the second position of the technical name. Additionally, every customer-created system object ought to adjust to the SAP normal type information and start with both a Z or a Y to inform apart it from the SAP authentic objects, thus avoiding the opportunity of being overwritten by a system upgrade.
Authorization Objects
An authorization object identifies an element or object within the SAP methods that must be protected. These objects work like templates for granting entry rights, by method of authorization fields, which allow for performing complicated exams of access privileges. An authorization object can include a most of 10 authorization fields. Users will be permitted to carry out a system perform solely when passing the check for each area in the authorization object. The verification towards the field contents is finished with the logical AND operator. A person’s action might be allowed provided that the person authorization passes the access check for every field contained in an object. With this mechanism, the system can carry out multi conditional tests. As with authorizations, when maintaining authorization objects, the system does not display the names, but a descriptive text for every object.
Authorization objects are grouped in object courses belonging to different application areas which can be used to limit the search for objects, thus making it faster to navigate among the many many SAP system objects. SAP predefined authorization objects should not be modified or deleted, besides if instructed by the SAP support personnel or a SAP note. Deleting or altering standard authorization objects can cause extreme errors in programs that check these objects. Before an authorization object is to be modified, all authorizations defined for that object should be first deleted. If you need to use the OR logic for giving users entry to sure capabilities, you can define a number of authorizations for the same object, every time with totally different values. In the consumer grasp records, you assign each of these profiles, that are linked with the OR logic. So, when the system assessments whether or not the person has entry privileges, it will check every authorization to see if the assigned values adjust to the access condition. The system will enable access with the primary authorization that passes the test.
Authorization Fields
Authorization fields identify the elements of the system that are to be protected by assigning them an access test. An authorization discipline will be, for instance, a person group, a company code, a purchasing group, a growth class, an application space, and so on. There's one authorization subject that is present in most authorization objects: the Activity field. The Activity field in authorization objects defines the doable actions that could be performed over a selected application object. For example, activity “03” is always “Display.” So if an authorization contains two fields like “company code” and “activity,” and the company code discipline is “ *” (which means all company codes), it means that the consumer with that authorization can only
display the corporate codes.
The listing of standard actions in the system is held on the SAP commonplace desk TACT. The relationship between the authorization objects and the activities is held on table TACTZ. Not all authorization objects have the Activity authorization field. Authorization fields are the parts of authorization objects. Fields are also a half of the standard ABAP operate call AUTHORITY-CHECK.
When maintaining authorization, the system does not show the actual names (technical names) for the fields, instead it exhibits a description for each field.Desk TOBJ contains the fields which may be associated with every authorization object, which is how the SAP system knows which fields belong to an authorization object. The fields in an object are associated with data elements within the ABAP knowledge dictionary. Authorization fields usually are not maintained from the user upkeep menu, but should be defined within the development environment. Normally, customers don't need to vary customary authorization fields, besides if they're adding or modifying system parts and wish those components to be examined with authorizations.
The Profile Generator
Creation, modification, and task of authorizations and profiles was a fancy task within SAP projects. This job is commonly underestimated within the planning charter. So as to overcome the problem of lacking authorizations and the shortcoming for working normally, there's a natural tendency to assign full privileges to many customers, which might create problems and also critically threaten safety and control.
Effort and time needed for authorization tasks, along with customer requests, made SAP design a instrument for lowering the time needed for implementing and managing the authorizations, decreasing the implementation costs. This instrument is known because the Profile Generator.
The Profile Generator is an SAP utility obtainable since launch 3.0F and productively since release 3.1G. Its purpose is to facilitate the users’ authorizations and the management of users’ profiles. It can be used for routinely creating authorizations and profiles and assigning them simply to users.
The Profile Generator is the predecessor of the Menu Upkeep and Function Maintenance operate from releases 4.6 or mySAP Workplace. It might be accessed by getting into transaction code PFCG in the command field. The Profile Generator only generates simple profiles. When these profiles have been routinely generated with the Profile Generator, they cannot be maintained manually.
When profiles are manually maintained, the directors should select the authorization objects, group them into profiles, after which assign them to users.With the Profile Generator, administrators choose functions and duties-transactions-and the system robotically selects and teams the authorization objects. The definition of profiles with the Profile Generator is predicated on the potential for grouping features by activity teams in an organization menu, generated by utilizing customizing settings, that will only include those capabilities selected by the customers.
Activity groups type a set of tasks or activities that may be carried out in the system, like operating packages, transactions, and different features that usually represent a job role. The exercise groups and the data they include are what make the profiles in a place to be automatically generated.
Central User Administration
When the Workplace is used as an Enterprise Portal, all users of the component programs should be outlined inside the Workplace server (WPS). So the WPS becomes the right place for the centralized administration of users from the mySAP component systems.
The objective of the CUA software is to use a specific consumer in a system. From this consumer, it's doable to manage the user grasp information for all purchasers within a posh system landscape resembling mySAP. For each particular person consumer, it must be decided to which purchasers and on which systems the user will connect. Often, users don't want to connect to all part methods inside the Workplace.
The CUA device additionally permits defining which data from the user grasp information can be centrally managed and which data can be managed locally. The interchange and synchronization of data is possible using the ALE technology. ALE can be used for configuring and working distributed applications within SAP environments. Using CUA, data might be distributed:
In the case of roles, both easy or composite, and the authorization profiles, this data is often maintained domestically and not centrally. It's because the systems may have completely different releases, and customizing is often completely different in component systems. With a objective to use the CUA instrument for SAP, R/3 techniques release 4.5B or increased is required.
Related posts
What is SAP and Why do we are in need of It
What is SAP Full form and its definition part one
sap internet transaction architecture
SAP internet transaction application components
Customers from the R/3 world know effectively that the customers’ grasp information is client specific.Every client must be independently managed within a system landscape. For every SAP R/3 system and for every client there may be the need for creating users which can be going to work in that environment. Moreover, customers want authorization profiles for gaining access to the required transactions. These must even be maintained.
Usually with the SAP R/3 system, customers may very well be copied throughout clients or across methods with the transport tools or the consumer copy tools through the use of the SAP_USER copy profile, which supports the duplication of all users and their authorizations . There are no synchronization mechanisms or utilities for having all user masters updated throughout clients.
All this decentralized and laborious work, which requires a great amount of time and administration sources, has been vastly simplified in mySAP environments utilizing the CUA utility. This tool is also accessible independently in R/3 techniques since release 4.5. This level is quite vital as a result of, though the Workplace can join component systems from launch 3.1I and better, methods with a lower release than 4.5 can't make use of or be integrated within the CUA functionality.
Background of R/3: Overview of the SAP Authorization
The standard SAP and R/3 authorization system was answerable for implementing the proper security methods in order that users might entry the business transactions and info they needed. The SAP systems always provided a complete, complex, and flexible means of securing information and transactions in opposition to unauthorized use.
Because the introduction of the discharge 4.6 of R/3 and the position idea as one of many backgrounds for mySAP, the authorization system has slightly changed to make it easier to implement, extra adjustable to specific customers’ wants, and with more options for personalizing and wonderful tuning. Nevertheless, the muse of the function concept remains to be fully based on the traditional SAP R/three authorization concept. SAP R/3 users are outlined in person master information, where they're assigned one or extra authorization profiles. These authorization profiles are product of a set of authorizations, which offer management accesses or access privileges for the operating or accessing of the totally different transactions and objects of the SAP systems. Further down, authorizations refer to authorization objects that contain a variety of permitted values for various system or enterprise entities within the R/three system.
The implementation of the authorization idea never was technically difficult, though it could be very time consuming. It was, nonetheless, an enormous subject within implementation tasks due to the organizational facets of it. This sort of implementation should always be a joint mission and energy between the SAP practical and the technical people. The reason is that often SAP system managers or technical consultants do not need to cope with things like giving access to sure users to particular price centers, accounts, gross sales organizations, or product ion plants. It is usually the function of the key users, customizing specialists, builders,or enterprise consultants to outline the transactions, objects, or entities that ought to be protected by the use of authorization objects and to assign or create the corresponding authorization profiles.
SAP Authorization Profiles
An authorization profile comprises a gaggle of authorizations, that is, a bunch of entry privileges. As indicated above, profiles are assigned to customers within the consumer master records. A profile could signify a simple job position because it defines the tasks for which a consumer has access privileges. Each profile might need as many access privileges as desired. Profiles can comprise authorization objects and authorizations. Altering the checklist or contents of the authorizations inside a profile will affect all customers who are provided that profile when it's activated. It becomes efficient the next time the consumer logs on. The change isn't effective to the presently logged on users.
Composite Profiles
Composite profiles are units of authorization profiles, each simple and composite. A composite profile can contain an infinite number of profiles. They can be assigned to customers just like profiles in the person grasp records. Composite profiles are suitable for customers who have completely different responsibilities or job duties within the system.These profiles are generally known as reference profiles for assigning a larger group of entry privileges and having the possibility to raised match customers with several responsibilities. This idea is technically very related to the present role concept.
Making modifications to any of the profiles within the listing included within the composite profile will instantly affect the access privileges of all customers having that composite profile in the person master record. When displaying profiles within the different SAP screens, there is a flag indicating whether or not the profile is straightforward or composite.
SAP Authorizations
The SAP systems use authorizations to outline the permitted values for the fields of an authorization object. An authorization would possibly comprise one or more values for each field of the authorization objects. An authorization object is type of a template for testing access privileges, consisting of authorization fields that finally define the permitted values for the authorization. An authorization is recognized with the identify of an authorization object and the identify of the authorization created for the object. An authorization can have many values or ranges of values for a single field. It is also doable to authorize for each worth (getting into an asterisk “ *”) or for none (leaving the sphere clean).
Authorizations are entered in authorization profiles with the corresponding authorization object.When an authorization is modified after which activated, it'll instantly have an impact on all users having a profile containing that authorization in their consumer master records. The technical names for authorizations and authorization objects have a maximum of 12 positions, however normally they show in the system utilizing quick descriptive texts. For buyer-created authorizations, the one title restriction is to not place an underscore within the second position of the technical name. Additionally, every customer-created system object ought to adjust to the SAP normal type information and start with both a Z or a Y to inform apart it from the SAP authentic objects, thus avoiding the opportunity of being overwritten by a system upgrade.
Authorization Objects
An authorization object identifies an element or object within the SAP methods that must be protected. These objects work like templates for granting entry rights, by method of authorization fields, which allow for performing complicated exams of access privileges. An authorization object can include a most of 10 authorization fields. Users will be permitted to carry out a system perform solely when passing the check for each area in the authorization object. The verification towards the field contents is finished with the logical AND operator. A person’s action might be allowed provided that the person authorization passes the access check for every field contained in an object. With this mechanism, the system can carry out multi conditional tests. As with authorizations, when maintaining authorization objects, the system does not display the names, but a descriptive text for every object.
Authorization objects are grouped in object courses belonging to different application areas which can be used to limit the search for objects, thus making it faster to navigate among the many many SAP system objects. SAP predefined authorization objects should not be modified or deleted, besides if instructed by the SAP support personnel or a SAP note. Deleting or altering standard authorization objects can cause extreme errors in programs that check these objects. Before an authorization object is to be modified, all authorizations defined for that object should be first deleted. If you need to use the OR logic for giving users entry to sure capabilities, you can define a number of authorizations for the same object, every time with totally different values. In the consumer grasp records, you assign each of these profiles, that are linked with the OR logic. So, when the system assessments whether or not the person has entry privileges, it will check every authorization to see if the assigned values adjust to the access condition. The system will enable access with the primary authorization that passes the test.
Authorization Fields
Authorization fields identify the elements of the system that are to be protected by assigning them an access test. An authorization discipline will be, for instance, a person group, a company code, a purchasing group, a growth class, an application space, and so on. There's one authorization subject that is present in most authorization objects: the Activity field. The Activity field in authorization objects defines the doable actions that could be performed over a selected application object. For example, activity “03” is always “Display.” So if an authorization contains two fields like “company code” and “activity,” and the company code discipline is “ *” (which means all company codes), it means that the consumer with that authorization can only
display the corporate codes.
The listing of standard actions in the system is held on the SAP commonplace desk TACT. The relationship between the authorization objects and the activities is held on table TACTZ. Not all authorization objects have the Activity authorization field. Authorization fields are the parts of authorization objects. Fields are also a half of the standard ABAP operate call AUTHORITY-CHECK.
When maintaining authorization, the system does not show the actual names (technical names) for the fields, instead it exhibits a description for each field.Desk TOBJ contains the fields which may be associated with every authorization object, which is how the SAP system knows which fields belong to an authorization object. The fields in an object are associated with data elements within the ABAP knowledge dictionary. Authorization fields usually are not maintained from the user upkeep menu, but should be defined within the development environment. Normally, customers don't need to vary customary authorization fields, besides if they're adding or modifying system parts and wish those components to be examined with authorizations.
The Profile Generator
Creation, modification, and task of authorizations and profiles was a fancy task within SAP projects. This job is commonly underestimated within the planning charter. So as to overcome the problem of lacking authorizations and the shortcoming for working normally, there's a natural tendency to assign full privileges to many customers, which might create problems and also critically threaten safety and control.
Effort and time needed for authorization tasks, along with customer requests, made SAP design a instrument for lowering the time needed for implementing and managing the authorizations, decreasing the implementation costs. This instrument is known because the Profile Generator.
The Profile Generator is an SAP utility obtainable since launch 3.0F and productively since release 3.1G. Its purpose is to facilitate the users’ authorizations and the management of users’ profiles. It can be used for routinely creating authorizations and profiles and assigning them simply to users.
The Profile Generator is the predecessor of the Menu Upkeep and Function Maintenance operate from releases 4.6 or mySAP Workplace. It might be accessed by getting into transaction code PFCG in the command field. The Profile Generator only generates simple profiles. When these profiles have been routinely generated with the Profile Generator, they cannot be maintained manually.
When profiles are manually maintained, the directors should select the authorization objects, group them into profiles, after which assign them to users.With the Profile Generator, administrators choose functions and duties-transactions-and the system robotically selects and teams the authorization objects. The definition of profiles with the Profile Generator is predicated on the potential for grouping features by activity teams in an organization menu, generated by utilizing customizing settings, that will only include those capabilities selected by the customers.
Activity groups type a set of tasks or activities that may be carried out in the system, like operating packages, transactions, and different features that usually represent a job role. The exercise groups and the data they include are what make the profiles in a place to be automatically generated.
Central User Administration
When the Workplace is used as an Enterprise Portal, all users of the component programs should be outlined inside the Workplace server (WPS). So the WPS becomes the right place for the centralized administration of users from the mySAP component systems.
The objective of the CUA software is to use a specific consumer in a system. From this consumer, it's doable to manage the user grasp information for all purchasers within a posh system landscape resembling mySAP. For each particular person consumer, it must be decided to which purchasers and on which systems the user will connect. Often, users don't want to connect to all part methods inside the Workplace.
The CUA device additionally permits defining which data from the user grasp information can be centrally managed and which data can be managed locally. The interchange and synchronization of data is possible using the ALE technology. ALE can be used for configuring and working distributed applications within SAP environments. Using CUA, data might be distributed:
- Person master knowledge akin to deal with, logon data, default values, and so on could be distributed.
- The assignment of users to simple roles is possible. Composite roles and profiles should be achieved in every of the component systems. The advantage of utilizing CUA for these assignments is that it's not required to attach regionally to each system that will comprise these assignments. It can be carried out in a centralized method from the Office server.
- When a model new consumer is added, the preliminary password is distributed to the element techniques for which the user is defined.
- Besides the traditional locking mechanisms for users (logon failures, session lock, manual lock) there's a new world lock. This lock is efficient in all component programs where the consumer is outlined and could be unlocked either regionally or globally.
In the case of roles, both easy or composite, and the authorization profiles, this data is often maintained domestically and not centrally. It's because the systems may have completely different releases, and customizing is often completely different in component systems. With a objective to use the CUA instrument for SAP, R/3 techniques release 4.5B or increased is required.
Related posts
What is SAP and Why do we are in need of It
What is SAP Full form and its definition part one
sap internet transaction architecture
SAP internet transaction application components
No comments :
Post a Comment