conversion of Authorization roles

[Former Member]

We are doing Upgrade from 4.6C to ECC 6.0.

After Upgrade need to maintain currently 14.736 roles in our development system

12.336 of these roles are derived roles

10600 are assigned in the ERP system,

All roles are created with the standard Profile Generator.

I would like to convert these roles in the new release (ECC 6.0) .Is there any tools, best practices and expertise which anybody can give suggestion will be really helpful.

[Former Member]

Best practice in my books is keeping the number of roles down and building them at a higher level - to match a "role" or "position" in the company, and not a "task" or "process step".

But I guess it is a bit too late for that to help you now if you want to keep these thousands of roles....

What is possible but generally does not belong to best practices... would be to download the lot and use Excel functions to do mass updates to them for the upgrade and then upload them again.

If you have a bit of time and inclination, this (the upgrade) is also your opportunity to start over and clean-up the concept and mass maintenance problems.

Cheers,

Julius

[Former Member]

Hi,

We are now only in planning Phase of the Upgrade . We need Strategy or solution how to approach this challenge.

Kindly provide me some strategy and solution for this task.

[RainerKunert]

The change from 4.6C to ECC 6.0 comes with a lot of new authorization objects. You can check with transaction SU25 (steps 2x) which roles must be upgraded. SU25 is well documented.

Prerequisite for SU25 is that the roles are maintained in the right way, that means

- transactions are assigned only in the menu

- only a few authorizations are in status "manually" or "changed"

- menu and authorizations are not splitted into two roles (one contains the menu, the other contains only authorizations buit no menu)

Regards

Rainer

[Former Member]

I would be tempted to suggest a re-implementation of authorisations based on an activity based concept.

Look at the activities which are required by different positions within the business and re-design the roles accordingly.

Be aware of SoD issues though as if you are re-implementing, you may as well try to get it right first time!

Simon

[Former Member]

su25 steps will guide you thru the whole process.

The count of your all derived roles is 14,000, I would expect the count of master(parent) roles will be around 700 to 1000. I don't think its a big issue. your maintainence window for adjusting everything in your development system might take a while. but you will be fine once its done.

SU25 2b--if you have good amount custom checks, make sure you keep your old entries and accept the SAP defaults for new entries which came in with ECC6.0.

SU25 2c-- In this step, start adjusting the master roles first. this will automatically adjust the derived roles. ofcourse that's how the SU25 will push you.

one exception thou:-- if your master role has the t.codes which got any org.value related new objects, then you have to go thru all derived roles for that master. which you won't see happening for many roles.

SU25D,-- for this It would be better to just select to include new t.codes in the same role where you have the old ones. I guess it would be better if you decide this with your functional guys.

and don't forget to keep a copy of your customer tables.

[Former Member]

Just an FYI--> There is a post on 46 C to ECC6.0 upgrade. It may be of interest to you.

[Former Member]

George,

I tried to find that post you mentioned but couldn't find it. Could you please post the link to that post here, if you have it?

Thanks,

Santosh