Objects missing when creating new role

[Former Member]

Hi

I am creating a new role A by copying profiles of role B. But the new role A donot contain few of the objects that are present in the role A from which the profile is copied.

Please let me know what is the reason for such a strange issue.

Thanks and Regards,

Rajesh

[Former Member]

hi Rajesh Nanda

this is common in sap.u goto su53 respective user.check what are the objects missing.if u wont find su53 u can do with st0.by activating trace we can know why that objects are missed.i think st01 will help to u.

[Former Member]

HI ,

I have compared the set of roles and found the set of objects missing by comparing the AGR_1251 table.

What i want to know is why those objects are missing when i have created the role from same profile.

Role one has 30 objects and i have taken its profile and created Role 2. But in role 2 only 27 or less are copied.

Need to know reason for why these objects are missing from new role.

thanks and regards

Rajesh Nanda

[Former Member]

Rajesh,

When the role A was built the objects are bought. You said you have copied the Role A to Role B and you find the objects missing because of SU24 changes that were maid meanwhile. You can go to those objects and find if they were changed in SU24.

Let me know if you are not cleared.

Thanks,

Saga

[Former Member]

Give us an example or two of the names of these objects, and which release you are on.

=> Role A might be a really old one, and some object are now obsolete.

Cheers,

Julius

[Former Member]

Hi Rajesh,

The reason why the auth objs are missing is that : The auth objs may be manually entered in the parent role.

Normally when you create a role you add tcodes in menu tab, so automatically the auth objects will be added. In case you add auth objects manually then these need to be added manually in the child role and are normally not copied in the child role when you copy the role.

Best,

Suchitra.

[Former Member]

I don't see any mention of this being a derived (child) role. The OP said "copied".

Cheers,

Julius

[Former Member]

Hi All,

I am thankful for your time.

All of you have got some bits of information i have said I feel i have missed something to explain. Let me do it again.

There is a role A with 30 objects( mix of manually added and standard objects). This role contains custom Tcodes and also few of the custom objects.

Now i am creating Role B by taking the profile of Role A and copying auuthorizations into role B. Let e,m know if you all have got this particular point. ( I have not copied a role but taken the profile of role A and copied authorizations in that profile into new role B) . this is done by first creating a role B and then going into change authorizations tab, goto then edit option and choose the second option in the list and then choose "From Profile".You enter profile here and all the authorizations are copied into this new role.

Now some of the custom objects are missing from the new role B also there are also some standard objects missing from this role B.

Now if you all could put some light.

thansk a lot for all your help ,,,,,

Rajesh Nanda

[Former Member]

Sounds like a mess...

> Now i am creating Role B by taking the profile of Role A and copying auuthorizations into role B.

Are you sure? I understood that you either copied role A => role B, or (as later described) that you created role B and manually inserted the profiles of role A via the menu option to do this.

Possibly you have not considered the fact that profiles have extended-profiles as well once they reach their (original) limits. From which table did you find the names of the profiles of role A?

In my opinion, you got what you deserved whatever the cause may be...

Cheers,

Julius

[Former Member]

My Advice would be make sure you copied all profiles.

when you generate the profile in PFCG (in your case in role A), it creates profile name identical to first 10 character and than after 1-99 number assigned (SAP note 16466), more than one profile possible as one profile can contain only certain number of authorisation.

Hence it is possible in your case that you miss some of them. That is why it is always best to copy role and not the profile and customized according to your need.

[Former Member]

Hi Kinjar/Julius,

I have taken the profiles form agr_prof table and i think when you refer taht profile in the same system the system can automatically refer or caopy authorizations in all the remaining profiles.

The point is if you go through the list of steps how I created a role you will find the option to copy authorizations by copying profile. Its not copying a role.

1. Goto PFCG and you create a role B.

2. Now go inside this role and enter DESC.

3. Now go to authorizations tab and click on " change authorizations data".

4. Now it will ask to copy authorizations from template say no to it.

5. Now click on "EDIT" in menu bar and then goto to "INSERT authorizations" and in it goto "From Profile" .

6. It will pop-up window for profile. Now enter here the profile of the Role A from which you need to copy authorizations.

and now i am facing issssues here.....Perform these steps and let me know if you find anything.

Thanks and Regards,

Rajesh Nanda

[Former Member]

> I have taken the profiles form agr_prof table...

Compare what you see in PFCG for role A to what you see in SUIM for it.

It sounds like someone had "hacked" a profile into USR10...

Cheers,

Julius

[Former Member]

Okay... here is another possible explanation (I hope you have not given up yet to understand why this is happening):

You are authorized to Display and Copy role A, but you are missing authority for object S_USER_VAL for those objects which are not included in role B.

Check your own authority.

Note that it might be that these objects (or specific values for them) have been restricted as there is no intention that they be used "just because they are copied" or "just because the trace said so"...

There are some object like this, where it make sense in the authorization concept to prevent folks from making easy mistakes with objects they might not be familiar with but are important to keep the concept intact.

Some examples are S_DEVELOP, S_ADMI_FCD, S_PATH, S_USER_GRP, etc etc... but there might also be very specific business objects like F_BKPF_KOA or P_ABAP or the "BI-all" objects, etc etc where this is a reasonable approach to take.

Please tell us which objects are not copied accross. This will help to understand what the problem is, and advise about who to talk to (on your side) to understand what is going on with this role copy procedure.

Cheers,

Julius

[Former Member]

its becoz SU24 was chaged after role A was build, u need to inactivate the extra obj's or manually insert missing obj's