How do I utilize SAP inspection plans and support packages? in sap

We are using an inspection plan for QM, SAP R3 4.6 and we are trying to restrict only particular users to release the created inspection plan, how we can achieve this? Also, is there a standard methodology available to do an impact analysis of SAP support packages?

The most fulfilling part of a security job is the research required to solve a particular problem and the rewards that come from continually expanding the breadth of one's understanding of SAP's delivered functionality.

I suggest that you consider turning on a trace while releasing an inspection plan and see if SAP provides an authorization check. You may also try to determine if SAP uses Status Management -- a cross-application functionality -- in relation to inspection plans.

There are authorization objects for status management that allow you to control who can change the status for an object. This may require that status management with user statuses be configured.

How do I link user IDs to positions in SAP?

What are the implications when using a position as a user ID and then linking that position to transactional roles?

A user ID and a position are always different entities in SAP. A user ID should always be tied to an individual who uses the SAP system. SAP allows you to link a user ID to a position as long as that user holds the position.

This linkage allows significant additional control opportunity through structural authorizations to control the scope of a user's actions in the HR system, including Personnel Administration and Organizational Management. It also allows you to assign roles for the rest of the SAP system to positions which are then subsequently assigned in a batch process to the user who holds the position. When the user (person) is transferred to another position the security associated with the previous position is removed.

What is the process for resetting a DDIC password? in sap

How I can reset the DDIC user's password? I have changed it from the delivered default.

DDIC can be handled like any other user id. Reset the password using SAP's user maintenance transactions.

What are the industry standards for SAP authentication?

What's the industry standard as far as SAP authentication is concerned? Do most organizations use the native SAP authentication, or do they integrate SAP with external authentication servers such as LDAP and AD?

What's your recommendation on SAP authentication -- and is integration with external authentication servers a major undertaking?

Most companies are using SAP's password security as delivered. A relatively small percentage of companies are using active directory integration to support single sign-on. Some companies are using third-party authentication tools that may be linked to the active directory or other identity management services.

The size of a single sign-on undertaking can vary significantly based on underlying technology. Companies that use Microsoft for their SAP application servers are at a decided advantage, as Microsoft has delivered SSO options that can be quickly integrated to SAP. Single sign-on is an increasingly important opportunity as enterprises expose more SAP functionality to Web-based interfaces and integrate more applications across various platforms.

Is there one conclusive report that lists all authorizations for one user ID? in sap

How can I display or print the activities to which a user is authorized? In other words, is there a report that will show what a user can do in the system?

Transaction SUIM is a general reporting solution for users and their authorizations. There are many reports there that will show which transactions a user can perform or which transactions can be performed by a role.

However, you need to be careful. This transaction will always tell you which transactions a user should be able to start, but it doesn't in one comprehensive way tell you what they can do within the transaction once it has started. Such a report is the "Holy Grail" of security reporting. I do not believe that developing a conclusive report describing everything someone can do is a realistic possibility.

How do I set up CRM structural authorizations? in sap

Have you ever set up structural authorizations (org restrictions) on CRM? How do I go about it?

I don't have any particular experience with structural authorizations on CRM; however, structural authorizations are a Basis component and all the same transactions that exist in a standard R/3 system are available in the CRM system.

How do I restrict transaction access based on user profile? in sap

I have a batch of users that are set up with profiles only that have too much access. I want to build roles that give them access to the transactions they need to do for their job. I have asked these users' managers to give me information on what these users need; my new manager says that is not the way to do it.

I don't want to get in between you and your manager but does he have another way? It is possible to extract data from the SAP system performance logs regarding users and the transactions they use. This probably will require that you obtain the RBE tools from SAP or use appropriate features of solution manager (or get programs from developer who have done this before.

It isn't a bad idea to get information from business managers on what their users do. Even if you get data from the system, you will have to discuss it with managers to actually build the roles correctly.

How do I fix user role problems in SAP security?

When I use SU01 to add a bunch of roles to user ID XX, a pop-up window appears and warns the maximum number of profiles has been exceeded for user XX. What can I do now?

A user's profiles (i.e., the objects generated by the profile generator) are all stored in one long field in table USR04. Once that field is filled up a user can have no more roles. I have never seen your problem before. It seems that you are working with a poor security design that should require so many roles. Ideally users shouldn't need more than three or four roles

How do I go about creating an authorization group? in sap

How do I go about creating an authorization group?

This all depends. In some cases authorization groups must exist in a custom table before they can be used. This is true for table authorization groups (authorization group in table TBRG assigned to tables in table TDDAT via transaction SE54) and user groups (created in transaction SUGR). In some cases authorization groups are merely created when they are assigned to the object in a standard maintenance transaction (e.g. vendor master data, customer master data, material master data etc.) In other cases the authorization group has an optional validation table that is used in search helps but no where else (ABAP programs in table TPGP and TPGPT, report writer authorization groups (via table TBRG) etc. Authorization groups are essentially labels that you assign to objects (tables, programs, master data etc.) that allow authorization checks for access to the objects with the label.