Comparing Cross-System Users, Authorizations, Roles, and Profiles (RSUSR050)

Use

You can use this procedure to compare two user master records, roles (including composite roles), profiles, or authorizations in the same system or different systems in the User Information System. You define the name of the RFC destination with transaction SM59.

When comparing composite roles, you receive as the result a list of the single roles and then below this, a comparison of the authorization objects.

This example describes how you can compare two users (the procedure is the same for roles, profiles, or authorizations). The master records are resolved to authorization field level and compared.

Procedure

...

1. Start the user information system (transaction SUIM).

2. Expand the Comparisons node.

3. Choose the Execute function in the From Users line.

4. In the User A and User B fields, enter the names of the users to be compared.

5. To compare users in different systems, choose the Across Systems button.

¡ To compare a user of the current system with a user from another system, enter the user name for user A and the RFC destination and the user name for user B. You can use the input help to select from the available RFC destinations.

¡ To compare a user from another system A with a user from a further system B from the current system, enter the RFC destinations of these systems in the fields RFC Destination for System A and RFC Destination for System B.

6. Choose Execute.

The system displays the Comparisons screen, on which a comparison of the two users is displayed. This is divided into same values, different objects, same values, and different values. In the case of different objects, only the user for which an authorization object is displayed has the object. Different values means that although both users have authorizations for the same object, the values are different. Same values means that both the authorization object and the authorization values of the two users match.

¡ To display documentation for an authorization object, select the object and choose Documentation.

¡ To display a sorted comparison of the values by authorization fields, select the relevant line and choose Select.

Result

The authorizations from different profiles were resolved, combined by objects and sorted by fields. This means that you have a compact comparison of the values for each field.
Note that this display allows a quick comparison, but that the interaction of the fields within an authorization is of vital importance. In particular, it can be the case for the objects listed under "same values" that although two users have the same values for an object, they do not have the same authorizations´, as the field values are combined differently in different authorizations. You should therefore regard this comparison function only as a utility for finding differences and not for documenting equality.

For information about investigating the user master records of two users for an object at the authorization level, see the Users by complex selection criteria section of Determining Users with the Users Node.

Unlocking a blocked admin user ID in an Oracle DB

My admin user ID has been locked out. Is there a table I can update in Oracle to reset the flag and enable myself to log in?

EXPERT RESPONSE

Select all entries of table USR02 where ‘UFLAG’=128. These users are locked by reason of incorrect logons. ‘UFLAG’=64 will give you the users that are blocked by Administrator. Set ‘UFLAG’ to 0, to unlock your account.

SAP BASIS (BC) Authorization Concepts

SAP Authorization Concept

The SAP authorization concept is based upon the logical relationship between a user ID and the range of system authorizations with which it can be associated. The architecture of the authorization system is based upon the utilization of several individuals but related logical components: Profiles, Objects, Fields, and Authorizations. The user ID refers exclusively to profiles. Each profile grants a set of specific system access authorizations to user.

Composite Profiles

Composite profiles refer to the various employee roles available in the corporation (for instance: Purchasing / Receiving Clerk or Accounts Agent). As the name suggests, composite profiles may contain multiple user IDs necessary to perform all the business operations associated with a particular role. A composite profile may encapsulate another composite profile(s). In practice, a model composite profile should be recognized for each possible role in the organization, which may be used to produce hybrid composite profiles. The over-existence of the hybrids can defy the very purpose of composite profiles and they should be created only when specific needs arise.

User Ids

User ids allow access to SAP applications. Each user must have a corresponding profile specifically assigned. In many situations, multiple composite profiles can be assigned to a user ID, depending on the role(s) an individual user is responsible for, in the business processes.

Authorizations

Authorizations are the key building blocks of SAP security. Authorization is the process of assigning values to fields present in authorization objects. In SAP, access to all system functionality is achieved through a complex array of authorizations. Sometimes users find that they lack the necessary authorizations to perform a certain function in the system, in which case the message: “You are not authorized…” is displayed at the bottom of the screen.

An authorization process may ask for second associated authorization process which in turn asks for third and so on. For example, the task of paying a vendor invoice may require 10 different authorizations.

Authorization Check:

The following actions are subject to authorization checks that are performed
before the start of a program or table maintenance and which the SAP
applications cannot avoid:

 Starting SAP transactions (authorization object S_TCODE)
 starting reports (authorization object S_PROGRAM)
 Calling RFC function modules (authorization object S_RFC)
 Table maintenance with generic tools (S_TABU_DIS)

The authorization objects S_TCODE, S_PROGRAM, S_RFC, and S_TABU_DIS
are standard SAP provided.
Creating a new authorization object is not in the scope of ABAP developer. It will
be taken care by SAP BASIS team.

This is a preview of Authorization Check:

Listing TCODE transactions used to view what users are logged in to SAP

I want to get a list of all transactions used per user in a specific time period. Basically I’m looking for a list of all users logged in SAP and the details of the tcodes they used. Is there any standard report or tcode available to view this info?

EXPERT RESPONSE

There is no standard transaction. The information is available for configurable time periods using transaction ST05N but it is not organized to readily provide a report of users and transactions. Also the information available summarizes a user’s use of a transaction. There will be one entry (with count data) per user per time period. Daily, weekly and monthly summaries can be created and they are stored for configurable durations.
The information is summarized into a cluster table called MONI based on the STAT files that are written in the file system and regularly refreshed. MONI cannot be queried via SE16 etc., but SAP delivers a number of function modules that retrieve data from these tables.

It is also possible to configure audit logging via SM19 and read the log files via SM20. This will provide more detail but it also introduces new file management issues and requires a change to system settings.

SAP’s TCODE checks with the authorization tool

What are the checks that the SAP authorization tool performs when a TCODE is executed in order to ensure authorization of that user?

EXPERT RESPONSE

When initiating a transaction, a system program performs a series of checks to ensure the user is authorized.

1. The program checks whether the transaction code exists in table TSTC.

2. The program checks whether the transaction code is locked by the administrator (transaction code SM01).

3. The program checks whether the user has the authority to start the transaction. Authorization object S_TCODE (transaction start) contains the authorization field TCD (transaction code). The user must have the appropriate authorization for the transaction code to be started (for example, FK01, Create Vendor).

4. The program checks whether an authorization object is assigned to the transaction code. If this is the case, the program checks whether the user has an authorization for this authorization object. The transaction code/authorization object assignment is stored in table TSTCA.
Note: An SAP program controls steps 1 through 4. It displays an automatic message to the user if an authorization attempt fails in the step.

5. The system performs authorization checks in the ABAP program using the ABAP statement AUTHORITY-CHECK.