PFCG and transports

[Former Member]

Hello,

Is it possible to configure the system to create a request for every role change?

I know how to transport roles between the systems.

Thank you,

Amir

[jurjen_heeck]

> Is it possible to configure the system to create a request for every role change?

Maybe if you change the delivery class of the tables holding the role data but I don't know what unwanted side-effects that would bring along........

Jurjen

[RainerKunert]

Hi,

I would recommend not to change the standard behaviour due to unknown side effects as mentioned by Jurjen.

But you can find changed roles with the authorization info system (AUTH, SUIM --> change documents) and transport these roles with report PFCG_MASS_TRANSPORT. This report is also used in transaction PFCG (mass transport).

You may write your own program to detect role changes and add them to a transport with PFCG_MASS_TRANSPORT. Such a program can run once a day.

But it is also possible to use a user exit in PFCG to add the role to a transport.

O sorry, I forgot one important thing: please check, whether PFCG_MASS_TRANSPORT can run in batch. There are some dynpros that have to be filled, may be you can do that only in dialog mode. So the best way is to use a user exit and to perform "transport_activity_group".

regards

Rainer

[Former Member]

Hi,

Jurjen is right, you may have to change the delivery class for the tables AGR_1251 & AGR_1252 to 'C' Customizing table using SE11.

[RainerKunert]

I assume that isn't all. There is a special transport object "Role" with a lot of tables behind (AGR_, USR). If you only change AGR_1251 and AGR_1252 the transport order might be uncomplete and therefore unusable.

[jurjen_heeck]

> I assume that isn't all. There is a special transport object "Role" with a lot of tables behind (AGR_, USR). If you only change AGR_1251 and AGR_1252 the transport order might be uncomplete and therefore unusable.

I think changing the delivery class will trigger the transport, not decide what's to be taken into the transport. I'd still not want to follow this road....

[Former Member]

back to step one!

Why should one want an automatic transport?

the number of people that can change roles should be limited to one team only and they should be informed that they always have to transport!

If others are capable of changing role that is far too dangerous to automate the transports, so please focus on taking that excessive access away!

[hummel_christian]

Just to update for others.

In SM30 edit tables

PRGN_CUST

and add

CLIENT_SET_FOR_ROLES - YES

NO (default), YES - Use the setting for client-dependent objects (SCC4) in role maintenance (Note 1723881)