Organization if You Are Using the Profile Generator

If you are using the profile generator and role maintenance, you can distribute the administration tasks within an area (such as a department, cost center, or other organizational unit) to the following administrator types:

· Authorization data administrator, who creates roles (transaction selection and authorization data), selects transactions, and maintains authorization data. However the authorization data administrator can only save data in the Profile Generator, since he or she is not authorized to generate the profile, He or she accepts the default profile name T_.... when doing this.

· Authorization profile administrator, who checks and approves the data, and generates the authorization profile. To do this, he or she choose ® All Roles in transaction SUPC, and then specifies the abbreviation of the role to be edited. On the following screen, he or she checks the data by choosing Display Profile.

· User administrator, who maintains the user data with the user maintenance transaction (SU01) and assigns roles to the users. This enters the approved profiles in the master records of the users.

These administrators of one or more areas are administered by superusers who set up their user master records, profiles, and authorizations. We recommend that you assign the superuser, the user administrator, and the authorization administrator the SUPER group. If you are using predefined user maintenance authorizations, this group assignment ensures that user administrators cannot change their own user master records or those of other administrators. Only administrators with the predefined profile S_A.SYSTEM can maintain users of the group SUPER.

The table in the section Setting Up Administrators shows the tasks that you should assign to individual administrators, tasks that you should not assign, and the templates that we have predefined for these tasks.

No authorization profile beginning with “T” may contain critical (S_USER* objects) authorization objects.

Organizing Authorization Administration

The authorization system allows you great flexibility in organizing and authorizing the maintenance of user master records and roles:

· If your company is small and centralized, you can have all maintenance of user master records and authorization components executed by a single superuser.

For more information on setting up superusers.

· Depending on the size and organization of your company, you should, however, distribute the maintenance of user master records and authorizations among multiple administrators, each with limited areas of responsibility. This applies in particular in a decentralized environment, in which different time zones might apply. This also helps to achieve maximum system security.

Each administrator should only be able to perform certain tasks. By dividing the tasks, you avoid a situation where a single superuser has absolute control over your user authorizations. You also ensure that not only one person approves all authorizations and profiles. You should also define standard procedures for creating and assigning authorizations.

Since you can precisely restrict authorizations for user and authorization maintenance, the administrators do not have to be privileged users in your data processing organization. You can assign user and authorization maintenance to ordinary users.

We recommend that you use the role maintenance functions and the profile generator (transaction PFCG) to maintain your roles, authorizations, and profiles. The role maintenance functions support you in performing your task by automating various processes and allowing you more flexibility in your authorization plan. You can also use the central user administration functions to centrally maintain the roles delivered by SAP or your own, new roles, and to assign the roles to any number of users.

SAP Authorization Concept

The SAP authorization concept protects transactions, programs, and services in SAP systems from unauthorized access. On the basis of the authorization concept, the administrator assigns authorizations to the users that determine which actions a user can execute in the SAP System, after he or she has logged on to the system and authenticated himself or herself.

To access business objects or execute SAP transactions, a user requires corresponding authorizations, as business objects or transactions are protected by authorization objects. The authorizations represent instances of generic authorization objects and are defined depending on the activity and responsibilities of the employee. The authorizations are combined in an authorization profile that is associated with a role. The user administrators then assign the corresponding roles using the user master record, so that the user can use the appropriate transactions for his or her tasks.

The following graphic shows the authorization components and their relationships.

Explanation of the Graphic

Term	Comment
User master record	These enable the user to log onto the SAP System and allow access to the functions and objects in it within the limits of the authorization profiles specified in the role. The user master record contains all information about the corresponding user, including the authorizations. Changes only take effect when the user next logs on to the system. Users who are logged on when the change takes place are not affected in their current session.
Single role	Is created with the profile generator and allows the automatic generation of an authorization profile. The role contains the authorization data and the logon menu for the user.
Composite role	Consists of any number of single roles.
Generated authorization profile	Is generated in role maintenance from the role data.
Manual authorization profile	To minimize the maintenance effort if you are using authorization profiles, do not usually enter single authorizations in the user master record, but rather authorizations combined into authorization profiles. Changes to the authorization rights take effect for all users whose user master record contains the profile the next time they log on to the system. Users who are already logged on are not immediately affected by the changes. We strongly recommend that you do not assign profiles manually, but rather do so automatically with the profile generator.
Composite profile	Consists of any number of authorization profiles.
Authorization	Definition of an authorization object, that is, a combination of permissible values in each authorization field of an authorization object. An authorization enables you to perform a particular activity in the SAP System, based on a set of authorization object field values. Authorizations allow you to specify any number of single values or value ranges for a field of an authorization object. You can also allow all values, or allow an empty field as a permissible value. If you change authorizations, all users whose authorization profile contains these authorizations are affected. As a system administrator, you can change authorizations in the following ways: · You can extend and change the SAP defaults with role maintenance. · You can change authorizations manually. These changes take effect for the relevant users as soon as you activate the authorization. The programmer of a function decides whether, where and how authorizations are to be checked. The program determines whether the user has sufficient authorization for a particular activity. To do this, it compares the field values specified in the program with the values contained in the authorizations of the user master record. The line of the authorization is colored yellow in the profile generator.
Authorization Object	An authorization object groups up to ten fields that are related by AND. An authorization object allows complex tests of an authorization for multiple conditions. Authorizations allow users to execute actions within the system. For an authorization check to be successful, all field values of the authorization object must be appropriately maintained in the user master. Authorization objects are divided into classes for comprehensibility. An object class is a logical combination of authorization objects and corresponds, for example, to an application (financial accounting, human resources, and so on). The line of the authorization object class is colored orange in the profile generator. For information about maintaining the authorization values, double click an authorization object. The line of the authorization object is colored green in the profile generator.
Authorization fields	Contains the value that you defined. It is connected to the data elements stored with the ABAP Dictionary.

The objects (such as authorizations, profiles, user master records, or roles) are assigned per client. For more information about transporting these objects from one client to another, or from one system to another, see the SAP Library, in the in sections Transporting Authorization Components and Change and Transport System (BC-CTS).

If you develop your own transactions or programs, you must add authorizations to your developments yourself (see Authorization Checks in Your Own Developments).

To be able to successfully implement the authorization strategy, you need a reliable authorization plan. To produce a plan, you must first decide which users may perform which tasks in the SAP system. You then need to assign the authorizations required for these tasks in the SAP system to each user.

The working out of a solid and reliable authorization plan is a constant process. We recommend that you regularly revise the authorization plan so that it always corresponds to your requirements. Define standard roles and procedures for creating and assigning roles, profiles, and authorizations.