how to perform a single change in multiple roles

[Former Member]

Experts,

Please let me know if there is a way to perform a common change in multiple roles(other than updating each individual role)

Ex: Deleting a particular tcode from 50 roles at a time along with profile generation and pushing the changes to the derived roles.

Sujana

[Former Member]

Hi Sujana,

If you are having master and derive role concept then you can manage the derived roles from master role and also you can genearate the profile for child roles from the master only from option generate derived role.

But for this you also need to aware of the effects. Also organizational values you have to maintain localy in child system as thos are specific to derived company.

This is common basics of authoriztion, better go through some guide avilable on help.sap etc.

Hope this helps

[jurjen_heeck]

> Ex: Deleting a particular tcode from 50 roles at a time along with profile generation and pushing the changes to the derived roles.

If these 50 are parent roles then the answer unfortunately is 'no'.

[Former Member]

As per standard process no,

I have not tried, but CATT Script will help you.

Thanks,

Prasant K Paichha

[jurjen_heeck]

> I have not tried, but CATT Script will help you.

I must state I doubt that. Removing transactions from roles can have serious implictions on the authorization side of things and those are difficult if not impossible to automate. For 50 odd roles I wouldn't even try it as the manual operation shouldn't taken more than one day for an experienced administrator......

[Former Member]

yes i agree with you .. hardly 50 role will take very less time..

i would say writing recording CATT may to 15-20 mins and setting files others etc will take more 45 mins,

As you said, but consume same amount of time, fixing role manually is risk free.

Thanks,

Prasant K paichha

[jurjen_heeck]

> i would say writing recording CATT may to 15-20 mins and setting files others etc will take more 45 mins,

For deleting a transaction which can reside anywhere in a roles' menu and coping with the role-dependent authorization changes? I think we have a bet

[Former Member]

>

>coping with the role-dependent authorization changes? I think we have a  bet 

If it can do that then I'll offer to buy the CATT......

[Former Member]

i am giving a try this weekend...

as said earlier never tried this.. will have a go and update...

Thanks,

prasant K paichha

[Former Member]

Hi Prasant, I shouldn't think the removal of the transaction is difficult, it's the assessment of & processing changes in the auth tab that come about due to the removal of the transaction. Of course, if SU24 is maintained well, the impact will be much less.

Have fun! If you can do the above then I think you will put us all out of a job. You will find Julius and Jurjen wearing ninja outfits sneaking up to your window in the night

[Former Member]

Did I hear the word "hat"...?

I think it can be done quite easily if there is still an intact relationship between the transaction being removed and the authorization objects /values to be removed, assuming that the role can be opened in expert mode to read the old data and merge with the data proposed from the remaining menu entries.

5 mouse-clicks without any scrolling and searching. You might need to tune SU24 before hand a little bit if it isn't a perfect match, but only need to do that once (probably).

Of course... a big assumption is being made here about the role design but IMO it is a valid one and should encourage people to build standard and maintained authorizations only so that this option can be used.

Anything less than 100 roles is still worth doing in SUPC instead of building and testing a CATT.

Cheers,

Julius

[former_member195397]

Hi Prashant,

You can use SU24 as suggested above and go change to default value, how ever there is risk it may populate some of other default values you should have removed or changes. I suggest you to create an ABAP program quite easy or better to create LSMW but LSMW you can not record this case. You can ask abaper to you condition in the codding of LSMW at step"Maintain field mapping and conversion rules". It is quite easy, but you need tricky abaper.

Arul

[Former Member]

Which tcode is it?