disable/enable status in permissions tab

[Former Member]

We've fresh RAR 5.3 installed and configured.

I'm running role level risk analysis in informer tab.

When I click on on of the risk ids it gives me 2 functions and in each function there are a set of actions(tcodes)

My query is when I click the permissions tab and open one of the objects it shows values with status "disable" or "enable". When I check the same object in R/3 backend system it is having different values.I could not understand what this means.

[Former Member · Accepted solution]

Hi Prashant,

The Enable/Disable in the functions (RAR) is to indicate whether the conditions (values) given are to be considered or not while performing risk analysis. Which has nothing to do with the R/3 back end object status... that is completely different and is used in role generation.

Cheers !!

Zaheer

[Former Member · Accepted solution]

Hi,

Where exactly in the back-end system you are checking the values for the object? If you are checking in PFCG then those values are defined for that particular role. In RAR, by enabling/disabling those activity values you are instructing RAR to consider them or not. If they are disabled, RAR will not conside them as risk and if they are enabled, RAR will consider them as risks while checking SoD violations.

Regards,

Alpesh

[Former Member]

thanks

[Former Member]

If Zaheer and Alpesh's explanations are okay for you (I agree with them) then you should also conclude from this that maintaining SU24 in a ballistic way is not a good approach either.

You need to choose your transactions carefully, and understand what SU24 and SE97 mean to PFCG.

If you take a read through SAP Note 113290 then it should be clear to you. I had to read it a few times and test it before it made sense, but then it is clear sailing afterwards (until a developer rocks up on site and messes it up again..).

Cheers,

Julius