SU25 - Security Upgrade Issue

[Former Member]

As part of ECC Upgrade, we started updating all our roles using SU25 steps 2a,2b and now 2c later to 2d.

In Step 2a/2b SAP has not suggested any changes to VF02 tcode, but in Step 2c for a role we noticed that we lost very important authorizations as stated below

Tcode VF02

-

---

4.6C - SU24 --->>

F_BKPF_BUK

G_GLTP

K_KEA_ERG

K_KEI_TC

K_PCAR_REP

and other objects

But in ECC 6.0 SU24 of VF02, We donot see above authorization objects set to proposal "Yes" and due to which our roles are loosing organizational values like Company Code/Profit Center etc and SAP does not show any changes to this tcodes in Step 2B and SAP default says 'NO" to Proposal for above five objects

Do you think, i should change the SU24 of VF02 manually Or Are we missing any here?

There are lots other tcodes like VF02, where SAP changed in ECC and do not comeup in Step 2B

Appreciate all your tips and recommendations

Thanks

[Former Member]

Check whether the transaction appears as an S_TCODE proposal value for other transactions in SU24 (USOBT_C).

Some transaction might no longer be considered generically (SU22) as menu transactions, or not the intended transaction to pull in all authorizations to complete a process for which it (on it's own) was not indended by it's designers.

If you disagree with that, you can change it for your own implementation in SU24.

Cheers,

Julius

[Former Member]

Julius Thanks for your quick response.

No i dont see any other transactions having S_TCODE=VF02(in my case) in USOBT_C

I see with the technical upgrade, lot of transaction's SU24 got changed and the entries in USOBT_C and USOBX_C got changed too. Instead of changing every transaction in ECC SU24, Can we bring these two tables (USOBX_C and USOBT_C) from 4.6C and regenerate all our roles.

(Example : VF01, VF02, MMBE etc)

Now after regeneration of all roles, then we will consider new authorization objects from USOBT and USOBX SAP delivered tables and adjust the roles accordingly if required.

Really Appreciate your kind response.

Thanks

[Former Member]

Hi Sreenivas,

We just completed our security upgrade from 4.6C to ECC6.0. For your information , I never faced this problem. After 2A and 2B step , I just found the addition of new authorization objects , the SAP default values are same as in old 4.6 C system.

In Su25 2C step :-

If you go to one by one role , there are some authorization objects that are got affected during upgrade. We can categorize these authorization objects as below:-

1. Standard New u2013 These are new authorization objects that are introduced in new system for corresponding tcode.

2. Manually new - It shows the authorization objects which were manually added in old system. Some of the values got updated for this also.

3. Standard Updated - Updated means, in old system if you have kept the standard values as it is, SAP has updated these standard values( u can check this one in SU24 check indicators).

4. Maintained New- Some of the organizational values introduced as field in authorization object.

I haven't faced any check indicator changes in new system.

Regards,

Sneha

[Former Member]

Sneha, Thanks for the response.

With our upgrade i am not seeing just one or two, i am seeing lots of tcodes where there SU24 default values got changed in ECC6.0, due to which some of the roles are loosing the organizational values and some of the objects are lost(F_BKPF_BUK) in the profile with Step 2C. These tcodes have not even appeared in step 2B

Examples of tcodes are VF01, VF02, VF05, MMBE etc

Appreciate if you can look at your system and tell us if find the same differences in SU24 default values for the above tcodes.

Thanks again

Sreenivas

[Former Member]

Hi Sreenivas,

Please check weather SU25 2A and 2B steps are successfully completed. Also there is possibility of basis side error. Becuase I haven't get any kind of changes in SU24 while upgrading from 4.6C to ECC6.0.

Please consult with basis consultants.

Regards,

Sneha

[Former Member]

Hi,

We are facing the same issue in our project.

Lots of tcodes where there SU24 default values got changed in ECC6.0 These tcodes have not  appeared in step 2B

[Former Member]

Hello

This is an old thread to re-open 🙂

Have you tried looking at the modified flags in USOBT_C to see if a mass upload was done (lots of changes to different transactions/objects at the same time)?

We've had that problem and you may find blank fields before populated fields which seem to confuse PFCG when it goes into edit old and merge new. This may not be the real problem but it's we can think of. Remove the blanks if that is the case but watch out for maintained/standard objects being changed...

Cheers

David