SAP BW Production support role - Tcodes

[Former Member]

Hello Security Experts,

I am looking for a list for Tcodes for SAP BW production support / sustain role. This is for the developers who will be supporting the production issues. If anyone has the list of Tcodes please do post. If there is already a note or blog please do post the link.

Regards,

BWer

[Former Member]

Hi BWer,

Total Questions: 497 (363 unresolved) ???

There is no standard SAP BW production support role. Role creation strategy is totally client dependent/ security architecture. Request you to get in touch with the technical BW team - identify the SODs and then create the roles as per the requirement.

[Former Member]

It is beyond me how someone with BW experience from 2005 or before can ask such a question at S_TCODE level, and without even mentioning the release and authorization concept being used....

BWer... please rephrase your question properly, give us the information about the context, and what you have found out on your own already.

Otherwise the thread will be locked.

Cheers,

Julius

[Former Member]

Hi Security Experts,

thanks for responding.

Here is the situation:

Need a starting point for creating a Role for production support BW resources in BW production system and Development system. List of activities / objects or tcodes is ok to start with.

BW system is BI 7.0 release 701 support pack SAPKW70105 . BI content release 704 level 0003 support pack SAPK-70403INBICONT

As a BI person, I had exposure to creating custom roles, auth objects, generating profiles, auth relavant infobjects, however did not get a chance to develop a role from scratch.

Appreciate your input.

Regards,

BWer

[Former Member]

Thank you for responding.

Actually it is a very good question if the context of known, as well as the release.

I will take a look into it to see what is generically usable. BW developers are a class of their own

Cheers,

Julius

[Former Member]

Have you migrated to the new BI authorization concept yet?

Can developers have access to all data in PROD support?

Do you have any data in BW which is "leading" and written back to transactional systems or subsequently used by them for postings? Do adjustements from BW queries qualify for this?

Cheers,

Julius

[Former Member]

Have you migrated to the new BI authorization concept yet?

- Yes migrated

Can developers have access to all data in PROD support?

- Yes they could have. Just the display not modify or delete

Do you have any data in BW which is "leading" and written back to transactional systems or subsequently used by them for postings?

- Data is not written back to Transaction system

Do adjustements from BW queries qualify for this?

- Queries are used in display mode only. No BPS

- production support may not create new queries in production system

Thanks,

BWer

[Former Member]

I was going to suggest that you use SAP_BW_DEVELOPER and SAP_BW_ANZEIGER as a template role and copy it into your own namespace to build from there, but it appears that SAP did not get very far with developing those standard roles either...

There is also a [Security Guide|https://websmp202.sap-ag.de/~form/sapnet?_SHORTKEY=01100035870000401180] in the SMP but a fews years old already.

So it looks as if you have to go to the developers and talk to them about what they use and need. For example, do they always transport queries?

Specifically for queries, it works like this:

*----------------------------------------------------------------------*
*       FORM check_user_authority
*----------------------------------------------------------------------*
*       text
*----------------------------------------------------------------------*
*  <--  p_superuser X = Superuser (all authorizations)
*       p_edit      X = Change authority
*----------------------------------------------------------------------*

form check_user_authority using p_superuser type flag
                                p_edit      type flag.

  p_superuser = c_false.
  p_edit      = c_false.
  authority-check object 'S_QUERY' id 'ACTVT' field '02'.
  if sy-subrc = 0.
    p_edit = c_true.
    authority-check object 'S_QUERY' id 'ACTVT' field '23'.
    if sy-subrc = 0.
      p_superuser = c_true.
    endif.
  endif.

endform.                               "check_user_authority

Cheers,

Julius

[Former Member]

Hi BWer,

The list of activities handled by BW developer in production system depend on your client policy and SOD defined.

In general BW developer should have below list of T-codes in BI production environment. Make sure that they should not have DSO, Infoobject,Query delete access.

RRMX,RSA1,RSA11,RSA12,RSA13,RSA14,RSATTR,RSBBS,RSCUR,RSD1,RSDS,RSH1,RSKC,RSMO,RSMON,RSPC,RSPCM,RSRQ,

RSU3,RSU3O,RSUOM

Best Regards

Imran

Edited by: Imran Mulani on Jan 11, 2010 6:30 AM

[Former Member]

Hi,

If you haven't an idea for the roles you want, look at the template roles SAP gives you. You can reach them through menu options but also make a new role with transaction PFCG with no further entrances and hit the button authorizations. Be critical of the contents of those templates, they mostly give you more then you need. They are certainly not all specific for BI 7.x so sometimes you need to add or delete something, but I am sure you will find that for yourselves.

Have fun.

Bye Jan van Roest

[KulDeepJain]

Yes developers have access to all data in PROD support.(only Read no Write)

Edited by: damawat on Feb 21, 2011 10:48 AM

[KulDeepJain]

TSTC table will contain all the Tcodes and

TSTCT table will contain all the Tcodes with Texts.

DD02L : ALL SAP TABLE NAMES

DD02T : DESCRIPTION OF TABLE NAMES

DD03L : FIELDS IN A TABLE.

RSRREPDIR cube wise/module wise reports.

Transactions codes

SM01 T-code for lock unlock t-codes.

Search_SAP_Menu T-code for menu path.

RSA1 Administrator Work Bench

RSA2 OLTP Metadata Repository

RSA3 Extractor Checker

RSA5 Install Business Content

RSA6 Maintain DataSources

RSA7 BW Delta Queue Monitor

RSA8 DataSource Repository

RSA9 Transfer Application Components

RSD1 Characteristic maintenance

RSD2 Maintenance of key figures

RSD3 Maintenance of units

RSD4 Maintenance of time characteristics

RSBBS Maintain Query Jumps (RRI Interface)

RSDCUBE(D)(M) Start: InfoCube editing

RSDDV Maintaining

RSDIOBC(D)(M) Start: InfoObject catalog editing

RSDL DB Connect - Test Program

RSDMD Master Data Maintenance w.Prev. Sel.

RSDMD_TEST Master Data Test

RSDMPRO(D)(M) Initial Screen: MultiProvider Proc.

RSDODS Initial Screen: ODS Object Processng

RSIMPCUR Load Exchange Rates from File

RSINPUT Manual Data Entry

RSISET Maintain InfoSets

RSKC Maintaining the Permittd Extra Chars

RSMO Data Load Monitor Start

RSMON BW Administrator Workbench

RSOR BW Metadata Repository

RSORBCT BI Business Content Transfer

RSORMDR BW Metadata Repository

RSPC Process Chain Maintenance

RSPC1 Process Chain Display

RSPCM Monitor daily process chains

RSRT Start of the report monitor

RSRTRACE Set trace configuration

RSRV Analysis and Repair of BW Objects

SE03 Transport Organizer Tools

SE06 Set Up Transport Organizer

SE07 CTS Status Display

SE09 Transport Organizer

SE10 Transport Organizer

SE11 ABAP Dictionary

RSDS Data Source Repository

SE21 Package Builder

SE80 Object Navigator

RSSM Authorizations for Reporting

SM12 Display and Delete Locks

SM04 User List

SM37 Overview of job selection

SM50 Work Process Overview

SM51 List of SAP Systems

SM58 Asynchronous RFC Error Log

SM59 RFC Destinations (Display/Maintain)

LISTCUBE List viewer for InfoCubes

LISTSCHEMA Show InfoCube schema

WE02 Display IDoc

WE05 IDoc Lists

WE06 Active IDoc monitoring

WE20 Partner Profiles

DB02 Tables and Indexes Monitor

KEB0

KEB2 DISPLAY DETAILED INFO ON CO-PA DATA SOURCE R3

SM66 Global work process Monitor

SMQ1 qRFC Monitor (Outbound Queue)