IMG tcodes

Question: Question:
Are all tcodes that begin with "O" related to the IMG. I noticed that there are 4720 tcodes that begin with "O", and 283 that begin with "OO" which are perdomenantly IMG tcodes, are they not?

Answer:
What is in a name?

Answer:
Tarryn,

Get real! Post useful information please

Answer:
Hi SECGirl,

Tarryn is right, whats in a name. You could make a broad assumption that IMG transactions start with O, however, in a production environment transaction that are considered config in Dev are actually used in production as part of standard business processes, and they start with O e.g OOSB.

There are many ways to access IMG transactions, perhaps if you clarify what the specific issues / requirements are a better answer can be given.

Regards

Peter

Answer:
When I first started asking questions here (with an guest account), someone told me not to shoot the messenger...

Tarr

Answer:
most all 'O' tcodes are IMG so are are '0', 1's, 2's, K's, F's, S_ALR_xxx etc. You will also find 'O' tcodes that become application tcodes when the system is set to PRODUCTION (example OB52).

The majority of the IMG tcode are in talbe CUS_ACTH (sp? listed here before in an other post) and CUS_ACTOBJ and a few others.

IMG FULL ACCESS

Question: I need to create an role with full SPRO and IMG access. What does one have to do to create this role?

Any help would be much appriceated.

Regards



Answer:
Only Add SAP_ALL

Answer:
SAP_ALL will provide the users with everythign including FI transactions which is what we do not want to do.

I found a way. When in pfcg if you select on " transactions from menu" under the menu tree. Look under Tools > IMG.... thats the cookie..

IMG display rights

Question: Hi Gurus


we are having a problem , for the New Trainees and joinees in SAP ,we have created a profile with selected T-codes of their areas of specialisation apart from it we also wanted to give the display rights of IMG to all


Presently we have to select each object one by one and give display rights

Can u pls tell us what is the specified role or profile we have to choose or any other easy way which can solve the problem

IMG display only?

Question: Is there a way to grant display only access to IMG easily? I realize it is made up of many different transactions and would like to avoid securing hundreds of different objects individually if i can.

Thanks in advance

Answer:
This is probably the single most frequent topic here. You ought to use the search feature to see what has been said. There isn't one simple trivial answer.

You have to face some trade-offs. For my money I would rely on display authority for objects such as S_TABU_DIS, S_NUMBER, S_CALENDAR and many other objects and not rely too heavily on transaction code authority. I would certainly grant access to SM30 and SM34 (with aforesaid display authority) and I would encourage use of cross system table compare utilities.
_________________
bwSecurity

Answer:
Search this forum for "DIsplay IMG" and look for my reply dated 25th May'06.

img display

Question: hi all,

i like to know whether we can create a role that gives just img display ?

i built a role with stcode and gave '*' to bring all tcodes and s_tabu_dis with '03' for display . But my role doesn't allow to execute certain tcodes , is there anyother way where you can bring all tcodes(img) with display access only?

Thanks
newone

Answer:
Tcodes are what they are. some config tcodes (direct table maintenance, 'O' tcodes) will convert to display if that is all you have.
The IMG tcodes are in CUS_ACTH (sp?) so you can find the tcodes without using an asterisk, which you shoould not.

You can also use the "create role from project" in pfcg but if it is based on all tcode it can run for a while.

You will still need to change the tcodes to their display companion ( usually the same tcode but with a '3' at the end like VA01 to VA03

There is no Majic-make-it-display-but-it-is-not-a-display-tcode

Generally they display tcode is accesable in the pull-down of the create-change

IMG auth question

Question: Though the question was discussed many times in this forum but I still want to know:

Question 1): First of all, Config Only W/O Application should be set for consultant in Golden Client. If we only assing SPRO, SM30 t_code to a role, many config lines in SPRO can not be excuted due to lack of authorization. Must we create a roll and pull all T_Codes from table cus_actobj & cus_acth?

Assign * to S_TOCDE is not acceptable. We also have no experience in restricting S_TCODE and other object value for SAP_ALL.

Question 2): Project team want to restrict the authorization by module, example, MM consultant can not config SD module, how to do it?

Question 3): Can we generate a suitable authorization profile from a IMG project? Example, if we create a IMG project just with SD module, can system generate a profile which is suitable for this project?

Answer:
I found /forums/viewtopic.php?t=113853&highlight=img, is this the best solution for question 3?

If we create MM IMG project & SD IMG project, it seems it can also be used for question 2. But for many config, I am sure only SM30 is required no matter in MM or SD module. Is there an object which can control it?

For question 1, I think we can import all T_code from entire IMG like this. Or we can insert all T_code from talbe cus_actobj & cus_acth and generate the profile, which one is better in general?

Thanks for advice.

Answer:
You should create a SPRO role based on all the nodes and remove all the basis and Security authorizaitons. While you can create a module specific role in the IMG you will end up with a poor quality configuration. SAP is too highly integrated to limit access to only one module. You will end up with the configuration team finding a way to make it work rather then iplementing the correct was to make the system work.

Load the tcode from the two tables, S_TABU_DIS and SM30 is not enough to configure the system correctly