security in live system

[Former Member]

hi frds,

i am new to security in HR.

i have a few questions............

1. how r roles transported? like if created in dev ,then it has to go to test and then to live?

2. how r the users assigend the roles? do we need to assign them in each client seperately? r if assigned in dev, can transport them to test and the to live?

Thanks

[jurjen_heeck]

> i am new to security in HR.

We all once were new to everything ...

> 1. how r roles transported? like if created in dev ,then it has to go to test and then to live?

That's the way it's supposed to work

> 2. how r the users assigend the roles? do we need to assign them in each client seperately? r if assigned in dev, can transport them to test and the to live?

You can transport user assignments but that is hardly ever done. User/role assignments often differ per system type. I've never transported user assignments but always assigned per client. To ease this process have a look at/do a search on CUA or Central User Adminnistration.

[Former Member]

1. how r roles transported? like if created in dev ,then it has to go to test and then to live?

Why are you going for transportatin?Rather download the role from the test system and then upload that on the test and live system.

2.how r the users assigend the roles? do we need to assign them in each client seperately? r if assigned in dev, can transport them to test and the to live?

Go to tcode PFCG> give role name> click on change and display> under user tab give user name>then user comparison-->then save and back.

Yes you havec to assign it on each client seperatly..

r if assigned in dev, can transport them to test and the to live?

Dont go for role transport.Download and upload is a better option.

Regards,

ashutosh

[Bernhard_SAP]

Hi Ashutosh,

uploading has, as already mentioned some disadvantages....

Beside for instance missing documentation of the upload (it is not recorded anywhere), it is not possible to upload user assignements....

the standard way of moving roles from one system (/client) to another is still the transport....

b.rgds, Bernhard

[Former Member]

I am agree with Jurjen Heeck

Uploading will require to generate the profile again, you may also want to keep track of all you changes which is hard in uploading downloading methods.

More over, if organization following strict transport approval methods which I have seen most of the organization where I worked, Implementing in DEV, testing in TST and QA if applicable than transport to your live system is standard procedure.

Regarding the CUA, you can maintain your use Master in one system/client and make your life much easy.

As you mention that you are new to HR security, you might also want to consider that whether are you following position based security, where you do not need to assign users directly in PFCG.

Regards,

Kinjar