Check the user authorizations concerning
S_RFCACL Authorization check for RFC user (Class Cross application authority objects)
Use this authorization object to restrict RFC calls to proved function groups:
S_RFC Authorization check at RFC access (Class Cross application authority objects)
Define the extended assignment between SNC-names and R/3-users.
There exist some scenarios where the simple assingement is not sufficent. Every R/3-user can only belong to one SNC-name. In case of shared userids like the SAP standard users SAP*, SAPCPIC, DDIC and EARLYWATCH you need multiple assignments.
You can enter a "*" for the user or the SNC-name to allow everybody to work but in this case the access control list is degenerated:
Userid SNC-name Conclusion
defined * Everybody can work with this R/3-user.
* defined This master user can work with all R/3-user.
* * No access control at all
The extended SNC-information for the user is entered using transaction SM30 with table USRACLEXT.
Don't use *-entries. They can lead to a security leak.
1. Choose the entry you wish to modify or choose New Entries.
2. On the following screen, enter the data:
Define the assignment between SNC-names and R/3-users.
After you are loged on the external security systen your proved identification, the SNC-name, ist used to logon to the R/3 without asking you for an userid or password (So called Single Sign On). In case of multiple assignements between your SNC-name and R/3-users in one or multiple clients you have to select one of them during the SAP logon process.
The SNC-information for the user is entered using transaction SM30 with table USRACL.
1. Choose the entry you wish to modify or choose New Entries.
2. On the following screen, enter the data:
An SNC name is created for the user specified if he or she does not have one. The SNC name comprises the prefix, user ID and suffix.
Call to the usual user maintenance transaction. You can maintain the SNC-information of users if SNC is active.
