XI Authorizations

[Former Member]

Hi

I want to create 4 roles for access to:

1.SLD

2.Integration Repository

3.Integration Directory

4.Runtime Workbench

What should be the approach.This is different from normal R/3 roles.Infact I could not see su53 dump for missing authorizations when any of these componenet authorization is missing e.g.like no access for SLD.

Is there any SAP document.There is nothing good in SAP Help.

thanks

asad

[Former Member]

Hi Christine and Udo.

Christine Can you please give some link or some hint as to how to handle UME groups in Java.

Is it done through the visual admin..If possible please explain as you have done in previous message....

Actually I gave standard role for Integration Dir to a test user but it gives access to Integration Rep also and vice-versa.

Thanks

Asad

[Former Member]

Hi Asad,

the thing is, that if you are supposed to configure you might need to check the development objects and vice versa, so you also have access to the other tool. However it is possible to create roles in the repository and directory that restrict access to the components in there.

Have a look here /people/michal.krawczyk2/blog/2005/05/25/xi-how-to-add-authorizations-to-repository-objects for restricting access to repository components. This allows you to grant read only access to the repository. It works similar for the directory.

A general overview on roles and tool access can be found here: http://help.sap.com/saphelp_nw04/helpdata/en/89/05793c05f0807be10000000a11405a/content.htm

On overview on the UME can be found here: http://help.sap.com/saphelp_nw04/helpdata/en/5b/5d2706ebc04e4d98036f2e1dcfd47d/content.htm

More detailed information is in this link: http://help.sap.com/saphelp_nw04/helpdata/en/c2/f4e73ee7442e5ae10000000a114084/content.htm, the scenario used with XI is UME with ABAP.

Anyway i would try to use the standard functionality XI offers before going fo custom built roles in the UME.

Regards

Christine

[udo_martens]

Hi Asad,

1. SAP_SLD_CONFIGURATOR and SAP_SLD_ADMINISTRATOR

2. SAP_XI_DEVELOPER

3. SAP_XI_CONFIGURATOR

4. SAP_XI_MONITOR

Look in transaction PFCG for details.

Plz have look to the <a href="https://websmp106.sap-ag.de/nw04installation">SAP Service Market Place Netweaver Installaton</a> where you can download the Configuration Guide, chapter 14.

Regards,

Udo

[Former Member]

Asad,

all applications you mention reside on the Java Stack of the WAS (except some of the RWB functionality). Therefore not the "normal" kind of authorizations on ABAP side are used but rather the UME on the Java Stack. There are predefined roles in SAP XI like SAP_XI_ADMINISTRATOR. You might have noticed that these are composite roles which consist of single roles which are postfixed with _J2EE and _ABAP. Where the ABAP role contains normal abap authorization objects, the j2ee roles are mainly empty. They are used for security mapping in the UME, that is each of this roles corresponds to a group on the UME and the group has specific J2EE authorizations.

So there is not a simple way to create such roles as you want to have, then getting familiar with the UME and building roles there.

Anyway, i think that you could pretty much live with the standard roles for what you want to achieve. SLD access is granted by SAP_SLD_ADMINISTRATOR, IR access by SAP_XI_DEVELOPER, ID by SAP_XI_CONFIGURATOR and RWB by SAP_XI_MONITOR. These roles contain a little bit more than what you stated, but should be ok for a starting point.

Regards

Christine

[moorthy]

Hi ,

You need to give Developer/Monitoring roles to access these.

You can also check different roles like this- Go to SU01 of Integration Server(XI ABAP stack)- give any user Id ->Go to Roles Tab-> Click Help(F4) on first column : this will display different roles.

Some roles are -

SAP_XI_BPE_CONFIGURATOR_ABAP

SAP_XI_BPE_MONITOR_ABAP

SAP_XI_CONTENT_ORGANIZER_J2EE

SAP_XI_DISPLAY_USER_ABAP

SAP_XI_DISPLAY_USER_J2EE

SAP_XI_ID_SERV_USER

SAP_XI_IR_SERV_USER

SAP_XI_IS_SERV_USER

SAP_XI_MONITOR_ABAP

SAP_XI_MONITOR_J2EE

SAP_XI_RWB_SERV_USER

Here it goes-

To check this link-

http://help.sap.com/saphelp_nw04/helpdata/en/f4/67b340be3dff5fe10000000a155106/frameset.htm

Hope this helps.

Regards,

Moorthy