Grant Table Maintenance Authorizations

You can specify which types of tables may be maintained by which employees.

Choose Edit -> Insert auth. -> Manual entry in the Profile Generator authorization maintenance (transaction PFCG, Authorization tab, "Change authorization data" key) and enter the object "S_TABU_DIS".

The selected object, with authorization and fields (activity and authorization group) is inserted into the authorization maintenance structure.

You can assign any table or view to an authorization group.

Standard Settings

SAP provides both authorization groups and assignments of the tables/views to groups.

Activities

1. Set up authorization groups for table maintenance, if required.

2. Assign tables/views to the authorization groups.

Execute

Switch off authorization checks globally (optional)

Activities

You can switch off the check on individual authorization objects globally (Transaction code auth_switch_objects).

See the transaction for information on how you do this.

You should only do this if you do not want to use all the functions for authorization checks in your R/3 System.

Further Notes

Excluding authorization objects from the check depends on the client.

The current status of globally deactivated authorization objects is saved in the application log (Transaction SLG1) under the object name PRGN_LOG_OBJ.

For authorization objects that are switched off, no authorization data is created in the Profile Generator.

Note that when you switch on authorization objects that have been switched off, you may have to reprocess the authorization data of many activity groups and regenerate profiles.

Basis and HR authorization objects (beginning with S_... and P_...) cannot be excluded from the check.

You can display the authorization objects that are excluded from the check using transaction code auth_display_objects.

Update Profile Validities in User Master Record

n this section you can schedule background job PFCG_TIME_DEPENDENCY that updates authorization profiles in the user master record. This is necessary only if are assigning users to activity groups indirectly using Organizational Management (HR-Org) or temporarily.

Activities

You cannot time-limit authorization profiles in a user master record.

You can time-limit activity group to user master assignments.

To ensure the profiles in the user master record are current, you should check them against the activity groups periodically. Use background report PFCG_TIME_DEPENDENCY.

Administrators should regularly check the job log to see if any background job errors have occurred.

Correct any errors manually.

Generate role/profile and assign users

his step is used to createActivity groups an generate authorization profiles using the Profile Generator.

Activities

To assign an authorization profile to a user, do the following:

1. Create an activity group

2. Enter a description

3. Select transactions

4. Create and edit authorizations

5. Assigns users and compare the user master (in doing so, the profile is entered in the user's master record)

6. Transport activity groups, if desired

Detailed documentation

For more information about the procedures, see transaction documentation

Note

You can also use authorization profiles you created manually or were delivered by SAP, in activity groups. You can create an activity group without a menu and include the corresponding profile in the authorization data of the activity group.

In the fourth step, choose "Edit -> Add authorization -> From profile" to add the authorization profile data to the activity group.

Work on SAP Check Indicators and Field Values

In this section you prepare for using the Profile Generator.

With the Profile Generator activated, authorization checks are carried out only if they are programmed into the source code of the transaction and are not explicitly excluded.

The delivery system includes SAP defaults for check indicators and authorization field values. You must copy these before you edit them (optional step).

Recommendation

Work on the copied default settings after the authorization concept for your enterprise has been defined.

Activities

Work through the following activities:

1. Copy SAP check indicators and authorization field values (mandatory)

2. Change check indicators (optional)
The check indicators determine which objects are not checked, which objects are presented by the profile generator, and which field values are consequently presented for amendment before automatic profile generating.

Activate Profile Generator

In this section you activate the Profile Generator.

Standard Settings

In new installations, the Profile Generator is activated (default setting). In this case, no special action is necessary. You just need to check whether the system profile parameter is set correctly.

The Profile Generator is usually not activated during a release upgrade.

Activities

• To activate the Profile Generator, set auth/no_check_in_some_cases=Y in system profile maintenance.
  This means:

• When any transaction is run, there is always a check whether authorization checks in it need to be suppressed.

• The authorization Profile Generator is activated on the initial screen for activity group maintenance ("Authorizations" tab appears)