02-22-2010 11:45 AM
Hi all,
I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?
Regards,
02-22-2010 11:55 AM
>
> I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?
Hello,
If you can add auth. objects to the profile, then you should be able to change it as well. May be i am incorrect
BR,
Suhas
02-22-2010 12:22 PM
Before someone suggest you to delete it from SE38 or some Z function module or even worse that to delete from AGR_1250,AGR_1251,AGR_1252,AGR_1253 ,TOBC tables
Iu2019m requesting the modes to reside this Thread into Security. Because Iu2019m certainly convinced there would be further work needed after deleting the Authorization from SAP_ALL. Btw Did you tried with SU02/SU21?
Cheers
02-22-2010 12:26 PM
Hi,
If you want to change the assignment of SAP_ALL to the user, you can open the user in SU01 and remove the authorizations from the profiles tab. Also SAP_ALL is a profile not a role so you cannot change it through PFCG.
Thanks,
Anju
02-22-2010 12:46 PM
Moved to the security forum...
You can optionally exclude non-SAP authorization objects from SAP_ALL and then regenerate it. There are a few valid reasons for considering this, and some standard objects are automatically excluded from it as well.
The solution is in table PRGN_CUST if you press F4 in the ID-field.
But ideally you should be building a role for that which they do need, and not excluding that they should not have.
Cheers,
Julius
02-22-2010 12:50 PM
> I assigned an authorization object to the profile SAP_ALL. But now i want to delete the auth. object from SAP_ALL but i can not change SAP_ALL from PFCG. How can i do this?
I suspect you are talking about a custom (Z*) object. There is a customizing switch which decides wether custom objects should be included in SAP_ALL or not. Search SAP service marketplace for either SSM_CUST or PRGN_CUST in combination with SAP_ALL. Change the setting and regenerate SAP_ALL.
Looking for ways to remove it manually are futile as any regeneration of SAP_ALL will undo this without prior notice. This regenerating can be the result of someone hitting the appropriate button in SU21 or through incoming transports etc.
03-23-2010 6:12 AM