give '*' to all new objects' fields in an upgrade for roles

[Former Member]

hello,

i want to enter value '*' for all new objects within roles.

there is more than 4000 roles in the system.

do i have to do it manually in tcode su25.step 2c or is there any mass-way to do it?

thank you,

javier rubio

[Former Member]

Moved to security forum...

There is no standard mass-way to update roles which I know of.

As there will not only be new objects, but also new check indicators (SU24) introduced with the upgrade, it makes sense to go through them one by one anyway to only add the access you want.

Perhaps you want to use the upgrade as an opportunity to re-think your role design - and in particular the number of them - if that is feasible and time allows?

Cheers,

Julius

Edited by: Julius Bussche on Aug 19, 2008 8:05 PM

[Former Member]

If you aren't going to take the time to go through the new objects one by one and see the effects on your roles, you me be better off, just using the SAP_NEW profile to build a temporary "upgrade" role containing the objects that are new to your environment. You'll have to have a look at SAP_NEW and pull out the objects that are really new (the delta between your existing version and the version you are upgrading to) as I believe SAP_NEW just gets objects added to it cumulatively as each release occurs so it may contain objects that you have already accounted for in your current environment.

[Former Member]

The problem I often see with using SAP_NEW in this manner is that often you get to a situation where it gets left in and forgotten post-upgrade.

As security is (nominally) functioning, there is little appetite for the business to support the work required to fix it properly which should have been planned in as part of the upgrade work.

The contents of SAP_NEW are also rather concerning from a security point of view as there is no distinction between the functional & system objects that you add to the users.

Javier - there is no practical way of adding a * into new objects and to be honest it would be very bad practice to indiscriminately start adding * values without understanding the impact to each role that you are applying it. Upgrades come at a cost and one of those costs is performing due diligence with regard to the security upgrade steps.

[Former Member]

Hi,

I am with Julius and Alex, although number of roles are more however, it would be a good idea if you go through the impact of having the values as "" and then update the values accordingly rather than having "" maintained for everything that came new in upgrade.

Regards,

Zaheer

[Former Member]

Hi,

I think there are no standard menthod for adding * value to all new objects while upgrading to new system. You have to rethink about giving * value to all new authorization objects becuase it contains lots of business risk.

Sometime in upgrade it is also giving the old authorization objects as new , if we have deleted these authorization objects in old systems( not maintained in new). Giving * value can give all access( create , change, delete ) to users. If you want to give all accesses temporarily , then u can remove all profiles from users and add SAP_NEW profile. After that u can upgrade the roles as per business approval for all fields of authorization objects.

Giving * value is not advisable in any case.

If anyway u want to give * value to unmaintained fields, then by just clicking one option u can give it. Just go one by one role and in the authorizations tab , if you got to the expert tab and on the top of the all authorization objects after the role name where it shows the all signals (red, green,yellow) if you click on that , then for all new authorization tabs * value get added.

I think this is the only way to do it.

Do let me know if you need any further help.

[Former Member]

I guess I'll clarify my point. I'm not saying that SAP_NEW is the way to go. Obviously, in an ideal world, you'll do an analysis and testing of your roles during the upgrade testing phase, identify the objects/values that are needed in your environment and deal with them then. I was just pointing out that instead of going through all 4000 of your roles and just adding *'s everywhere, it's probably much easier to use SAP_NEW. You can do some pretty quick and easy analysis of the objects in your pre-upgrade roles vs what's in SAP_NEW and create a new role with the delta.This should ensure that you don't knowingly break any of your pre-upgrade security concept, but does open you up for the unknown. I think it's probably a bit easier to go through the objects in this one role and merge them into your security concept post-upgrade then it is to put *'s in all of your existing roles, then go back and change all 4000 of them.