In "USER MAINTENANCE- SU01" --> in the "logon tab" there are 5 different "user type"
1. dialog
2. system
3. communication
4. service
5. reference
Kindly mention the function and role of all the above mentioned user types specifically and hows is one user type different from another.
These are as follows:-
1. Dialogue:-
For this kind of users:-
GUI login is possible.
Initial password and expiration of passowrd are checked.
Multi GUI logins are checked.
Usage:- These are used for GUI logins.
2. System
For this kind of users:-
GUI login is not possible.
Initial password and expiration of passowrd are not checked.
Usage:- These are used for internal use in system like background jobs.
3. Communication
For this kind of users:-
GUI login is not possible.
Users are allowed to change password through some software in middle tier.
Usage:- These are used for login to system through external systems like web application
4. Service
For this kind of users:-
GUI login is possible.
Initial password and expiration of passowrd are not checked.
Multiple logins are allowed.
Users are not allowed to change the password. Only admin can change the password
Usage:- These are used for anonymous users. This type of users should be given minimum authorization.
5. Reference
For this kind of users:-
GUI login is not ible.
Initial password and expiration of passowrd are not checked.
Usage:- These are special kind of users which are used to give authorization to other users.
Tips by : Rajeev Sharma
What are the functions of DDIC user in Production system?
There are many functions of DDIC user.
For E.g.. When you configure TMS you won't be able to configure it using sap*. For this you need a user who has access to Data dictionary and ABAP repository Object like DDIC user or user with sap_all and sap_new permission.
2) When we install R/3 in Landscape then we need to configure TMS. With the help of default user DDIC we can configure s_trnsprt and s_cts_admin. We cannot create new user for our client( Client of Company ) as creating new user gets charged. *-- Deepanshu Sharma
Function and Role of User Types and DDIC User
Hide the User Menu
Is there a way of masking or hiding the User Menus as we are using SAP Standard Menu instead of User Based Menus?
To put it simple, when the user logs on to the system he should have only the SAP Standard Menu.
You have two ways to control this :
1. Default hide for all the SAP users.
Goto SM30 and edit the table SSM_CUST and set ALL_USER_MENUS_OFF = YES and transport the same in production server.
or
2. Hide based on individual SAP users.
you can also try SM30 and maintain table USERS_SSM for individual users.
What are user groups and how can we use them?
Your auditer asked you to implement user groups in SAP, but you have no idea what are user group.
Transaction SUGR - have a look. Purpose for example is to give certain system admin rights to unlock / change password only to a given user group. You assign user group to an user id via SU01.
User group can be used for different reasons and in different way.
In the latest versions of SAP, actually two types of usergroup exist, the authorization user group and the general user groups.
Naturally the main reason of user groups is to categorize user into a common denominator.
The authorization user group is used in conjunction with S_USER_GROUP authorization object. It allows to create security management authorization by user group. e.g. you can have a local security administrator only able to manage users in his groups, Help-Desk to reset password for all users except users in group SUPER, etc...
The general user group can be used in conjunction with SUIM and SU10, to select all the users in a specific group. User can only be member of one authorization user group but several general user group.
One of the Primary uses of user groups is to sort users into logical groups.
This allows users to be categorised in a method that is not dependent on roles/AG's/Responsibilities/Profiles etc.
User Groups also allow segregation of user maintenance, this is especially useful in a large organisation as you can control who your user admin team can maintain - an example would be giving a team leader the authority to change passwords for users in their team.
The most important factor identified is that the lack of user groups is an indication that there may be problems with the user build process. This is very "fuzzy" but is a bit of a warning flag.
The Auditors job is to provide assurance that SAP is set up and administered in a way that minimises risks to the financial data produced. If the only thing they have picked up on is the lack of usergroups then you will be fine.
If you are in any doubt whatsoever ASK THE AUDITOR. They would have produced a report listing why they feel there is a risk by not having User Groups implemented. If you feel that the risk is mitigated by other measures then let them know. It works best as a 2 way process and both parties can learn something.
Do you have a SAP Basis Question?
How to delete expired roles?
ere are 3 notes you may want to review to see if there is any helpful info, plus some documentation that may be helpful for others....we are going from 40B to 47 and have had a few issues with role deletion
Notes: 312943 504412 & 313587
Additional info
First, the report PFCG_TIME_DEPENDENCY is functioning as designed. It was not designed to remove activity groups.
Second, in transaction SU10 you must have the valid from and valid to fields filled in with the actual dates, 04/08/2002, in order to remove the invalid activity group. You need to be sure that the remove user radio button set in the role tab. But in the profile tab, the add user radio button is selected by default. What you have to do is go to profile tab and select the remove user radio button. You have to make sure both role and profile has the same radio button selected, i.e. remove from users. Only then when you click save, it will allow you to delete the role from user.
In transaction SU10, you need to complete the following steps:
1. Click on the Authorization data button.
2. Entry the users name, latimerc
3. Click on the execute button.
4. Put a check in front of the users name.
5. Click on the transfer button.
6. Now highlight the user.
7. Click on the pencil button.
8. Click on the Activity Groups tab.
9. Enter the profile name (PM_NOTIFICATION_PROCESSOR).
10. Enter the valid from and valid to dates (04/08/2002).
11. Change the radio buttons to remove user from both the Activity Group and Profile Tabs.
12. Click on the trash can.
In another customer message the following was provided by developement:
We don't have a regular functionality for mass deletion of roles. But if you want to avoid the deletion by hand or with an own created report, I would suggest the following:
The attached note 324962 includes the report ZDELETE_RY_T_AGRS which could delete all roles with names like 'T_....' or 'RY....'. The report gives you a list of all these roles and deletes then the selected ones. You can modify the report to get all your roles in the selection list. Therefore you have to change the following:
SELECT * FROM AGR_FLAGS INTO TABLE L_AGR_FLAGS
WHERE FLAG_TYPE = 'COLL_AGR'
AND FLAG_VALUE = 'X'.
SORT L_AGR_FLAGS BY AGR_NAME.
LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE AND <<< delete
( AGR_NAME(2) = 'T_' OR AGR_NAME(2) = 'RY' ). <<< delete
LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE. <<< insert
READ TABLE L_AGR_FLAGS WITH KEY AGR_NAME = SINGLE_ACTGROUPS-AGR_NAME
BINARY SEARCH.
Text from an additional customer message as further help:
- go on role tab
- select remove from user
- enter ZR.PRD.GENERIC and date : 06/04/2002 12/31/9999
- go to profile tab
- select remove from user
- save
- do the same for ZR:HR:ESS from 01/01/2002 to 12/31/9999 and worked
from date for testid was 01/01/2002 and testid2 02/01/2002 and the 2 assignement were deleted And the roles were
removed from the 2 UMR.
So it works as designed.
Changing the default password for sap* user
You are trying to change the password for sap* user, however when you go into su01 and enter sap* as the user name, the following message is displayed, user sap* does not exist.
You can delete the SAP* user using ABAP code :-
Delete from usr02 where bname = 'SAP*' and mandt = '***';
Where '***' means your client no.
Then login to your client using password SAP* and password PASS
However, if you delete it, then it will automatically created once again with password PASS
The userid, SAP*, is delivered with SAP and is available in clients 000 and 001 after the initial installation. In these 2 clients, the default password is 07061992 (which is, by the way, the initial date when R/3 came into being...). It is given the SAP_ALL user profile and is assigned to the Super user group. When I say it is "delivered" with SAP, I mean that the userid resides in the SAP database; there are actually rows in the user tables used to define userids.
If you delete the userid, SAP*, from the database, SAP has this userid defined in its kernel (the SAP executable code that sits at the operating system level, i.e., disp+work). When this situation exists, the password defined in the SAP code for SAP* is PASS. This is necessary when you are performing client copies for example, as the user information is copied at the end of the process. You can sign into the client you are creating while a client copy is processing using SAP* with password PASS (but you should have a good reason to do this - don't change anything while it's running).
Anyway, if the SAP* userid is missing, you can sign in to the client you want and simply define it using transaction SU01 and, as I stated above, assign it to the SUPER user group and give it the SAP_ALL profile. You define its initial password at this point. If you've forgotten its password and don't have a userid with sufficient authorization to create/change/delete userid,
then you can use the SQL statements to delete it from the database and then you can use SAP* with PASS to sign back into the client you want to define it in and recreate it.
There is also a profile parameter which can override the use of SAP* with PASS to close this security hole in SAP (login/no_automatic_user_sapstar). When this parameter is defined either in your DEFAULT.PFL profile or the instance-specific profile and is set to a value of '1', then the automatic use of SAP* is deactivated. The only way to reactivate the kernel-defined SAP* userid at this point would be to stop SAP, change this parameter to a value of 0 (zero), and then
restart SAP.
The default password for SAP* is 06071992. (DDIC has 19920706)
