Solved: Mass maintenance of authorization objects

Former Member · ‎10-13-2009

Is there a SAP transaction available to mass maintain authorization objects?

Let's say that I have 120 roles, in all of which I want to change the value of field Y of authorization object X. For example, object S_TABU_DIS. I want to exclude an authorization group in all available roles. How can I do this for all roles which have this object?

Modifying each role separately in PFCG is rather time consuming (and pretty unpleasant).

fredrik_borlie · ‎10-13-2009

It is also why SAP have invented the Organizational level where you can define a "master" role which then inherits the organizational levels from their respective role.

I see them as the master role gives access to the function where the derived role restricts upon which organizations you are allowed to perform these activities.

And for one company I worked at we created a role maintenance tool. If that is of interest, we can recreate the tool and put it up for sales.

/fredrik

Former Member · ‎10-13-2009

> Modifying each role separately in PFCG is rather time consuming (and pretty unpleasant).

Exactly that is what the person who built the roles was thinking when they gave a * value to the auth group field each time.

The bugger with not doing it properly in the first place is that you get to do it many times over and over again.

The best thing which you could have done is change the SU24 proposals and do a mass merge on the roles. Had you maintained SU24 in the first place, you anyway wouldn't have this issue now - or at least not in the same magnitude.

Sorry, there is no quickfix available. You will need to go through each role individually this time and manually change to a set of ranges this time ,and next time as well..

Cheers,

Julius

fredrik_borlie · ‎10-13-2009

It is also why SAP have invented the Organizational level where you can define a "master" role which then inherits the organizational levels from their respective role.

I see them as the master role gives access to the function where the derived role restricts upon which organizations you are allowed to perform these activities.

And for one company I worked at we created a role maintenance tool. If that is of interest, we can recreate the tool and put it up for sales.

/fredrik

Former Member · ‎10-13-2009

Hi Fredrik,

Though take note that this is the authorization group of the table access (S_TABU_DIS). Not a natural candidate for an org. level combined with derived roles....

Though mind you, some folks promote S_RFC RFC_NAME to an org. level.

Some people also believe in aliens and spooks...

Anyway, what you might want to keep an eye out for is a new tool from SAP called the "Role Generator". It is an extention of PFCG designed exactly to ease this org.level problem and merge seperately built single roles into one big one.

Again here, I doubt it will help much for S_TABU_DIS.

Cheers,

Julius

Former Member · ‎10-13-2009

Julius, I understand your concerning and points concerning changing a lot of objects (not org level). But in my opinion the answer is not so straight.

When companies start they develop an authorizaiotn concept (lot's of times quite some years ago). In that concept they decide how it must work and there is no thought about maintaining proposals for objects etc. After a few years and, lots of roles in maintenance, the view of the organization changes concerning authorizations and the acces of some information (for example) tables. Another example is the Cost Center (KOSTL). Indeed you can "promote" it to an organizational level but SAP gives (what is already mentioned) no standard solution for organization level maintenance.

In my opinion don't create an org level of the S_TABU_DIS and maining the roles is the master of Authorization Group. I think an ABAP can help you a lot. What are your concerns about creating an ABAP except time?

Former Member · ‎10-13-2009

Actually, SAP does provide a solution to promote and demote fields to org. levels. There are reports for this (use them and not the table maintenance transactions!) because they automatically adjust your roles as well - otherwise you end up with inconsistencies.

But I agree with you, that org-levels is not a natural solution for this specific problem and although retrofitting security is the most expensive option, one cannot foresee all requirements from the start and Go-Live project pressure can be a factor as well to use * values for fields which on their own appear to be harmless...

You could try to write an adjustment tool for PFCG, but with "only" 120 roles I think you will be faster and safer with doing it manually. I think that less than 1 day's work should fix it. However, if you are willing to invest 2 or 3 days more, you can also consider restoring the values from the SU24 proposals. Particularly if one group of transactions are in many of the roles and you can isolate the common transaction (the "guilty one...) then you can do it more centrally in future as well.

However if you have not used the "Read old merge new" function in PFCG's expert mode, then you should be carefull with this as other objects might "correct" themselves as well. Particularly if you have been deleting standard authorizations in roles! (Why that button even exists, I don't know. No good can come of it...

Cheers,

Julius

Former Member · ‎10-13-2009

Julius, I know there is a report to promote a field to an organization level. But the maintanance of organizational levels in roles is also time comsuming (maybe with the new tool you mentioned it is less work).

I totaly agree about deleting standard authorizations objects and the problems you get from it.

This sort of dissuccions are very entertaining and I think somethink like this must be mentioned in SAP Courses. But not the ADM940 the everybody will stop will SAP Authorizations

Edited by: Juul Beckers on Oct 13, 2009 2:19 PM

Former Member · ‎10-13-2009

There is no transaction available.

You could feasibly develop a tool to do it for you (ABAP based or possibly VB based working on downloaded roles .sap files) but to do it properly would take much, much longer than the 4 hours it will take to change 120 roles.

Former Member · ‎12-10-2009

Thank you all for your helpfull comments so far!

We are currently developing a tool for mass maintenance of organisational levels and authorization objects. Now we encounter a problem: whenever you enter a new authorization object into a role in PFCG, table AGR_1251 is updated with the corresponding records of that object. There are 2 fields in this table called "Authorization" (AUTH) and "ID" (Node). AUTH seems to be assigned to a specific instance of an object, NODE is related to the fields of one object. Does anyone know how PFCG assigns these numbers to a newly inserted object? Is this part of a specific function module or does it reside in the transaction itself? Any hints or tips to point our developer in the right direction would be great.

Former Member · ‎12-10-2009

> Let's say that I have 120 roles, in all of which I want to change the value of field Y of authorization object X.

If you had started on the 13th of October, then I am sure you would have been finished already...

> Is this part of a specific function module or does it reside in the transaction itself? Any hints or tips to point our developer in the right direction would be great.

I am not aware of any released function module for you to use in a stable way, but if you take a closer look at how some of SAP's own applications work to maintain role data from external applications (external to PFCG) then you will find the RFC function module.

Have you considered the "Role Generator" mentioned above yet? Efectively what it does is a role merge. If the field is not an org.level and you want it's value to be the same, you could maintain one central role for it and mass merge withthe 120 org.level roles to create 120 updated roles.

Cheers,

Julius

Former Member · ‎12-11-2009

Julius, I tried taking a look at the Role Generator, but I understand from SAP Help this is only available in a certain business add in (Defense Forces & Public Security)? Is there any other way to access this transaction?

Former Member · ‎12-11-2009

That is where I found the documentation as well (DFPS) but to my knowledge it was shipped to ECC 6.0 with one of the enhancement packs, but I don't have the details of which one.

I will try to find out as well...

Former Member · ‎12-11-2009

>


> We are currently developing a tool for mass maintenance of organisational levels and authorization objects.

Be very careful with this. I've seen (and used) a few of these tools and they can cause more trouble than they are worth. They can also save lots of time if developed well and used carefully. One example I can think of deleted entire table contents due to some sloppy code. Another example updated a field value but if the input file was too great for the field, it populated the values in the value fields for the next auth object in alphabetical series.

Volker-Lehnert · ‎12-14-2009

Hi,

Role Generator was developed for the Defense Solution but it is part of any ECC 6.0 but must be adapted before it can get used.

A running adaption is implemented at Kanton Zürich: A german presentation is to be found under http://www.innovationatwork.ch/landingpages/manager/uploads/41/14h15%20-%203%20-%20Lehnert%20Kt%20ZH...

Please refer also to my book: SAP Berechtigungswesen / SAP Press. An English version will be published soon.

Kind regards

Volker Lehnert