Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Copying SAP_ALL profile

Former Member
0 Kudos

Hello,

Our client want to have a SAP_ALL profile without VA01, VA02, ME21N and ME23N.

I have copied sap_all profile and the single profile that has the stcode with the &SAP_ALL authorization: &_SAP_ALL_13. Then I have changed the stcode to limit the access to these transactions. All Ok till here. The point is that when I try to save the copy of the &_SAP_ALL_13 profile the message is:

Cannot activate.

The following authorizations are missing or have the status generated

And the profile isn't active and the authorizations are missing.

I have given a look at the objects definition of this profile, and they have the status active version - type generated. It looks like if they were have been created with PFCG, but this is not the case, isn't it? Do you know what can I do to solve it?

I know this is the usual way: I want all except X, Y ans Z, but after a few days they don't want some transactions more, and so on, the tale of never ending...

Thanks and best regards,

Ana.

1 ACCEPTED SOLUTION

jurjen_heeck
Active Contributor
0 Kudos

> I know this is the usual way: I want all except X, Y ans Z, but after a few days they don't want some transactions more, and so on, the tale of never ending...

Nope, that is not the usual way. The usual way is to have people tell what they do need and build roles from that. The way you described is like building a house by excavating rooms from a big pile of building materials. It's bound to fail.

besides that, copying individual profiles is not the way to go.

If you insist on building a role based on SAP_ALL better go to PFCG, create a role and enter the profile. Here choose SAP_ALL as a template and work from there.

Disclaimer: This advice is not security related but only a way to get around the error messages.

2 REPLIES 2

jurjen_heeck
Active Contributor
0 Kudos

> I know this is the usual way: I want all except X, Y ans Z, but after a few days they don't want some transactions more, and so on, the tale of never ending...

Nope, that is not the usual way. The usual way is to have people tell what they do need and build roles from that. The way you described is like building a house by excavating rooms from a big pile of building materials. It's bound to fail.

besides that, copying individual profiles is not the way to go.

If you insist on building a role based on SAP_ALL better go to PFCG, create a role and enter the profile. Here choose SAP_ALL as a template and work from there.

Disclaimer: This advice is not security related but only a way to get around the error messages.

Former Member
0 Kudos

Hello Jurgen,

My usual way was a joke. I know it is not the usual way to do things, but it is the usual way we used to be ask to do, isn't it?

Thank you for your answer, very usefull. I wasn't able to remember and find how to do it.

Thanks and best regards,

Ana.