Generation of roles from profiles on migration from R/3 4.6c to ECC6.0

[Former Member]

Dear All

We have a client who was running R.3 4.6c. He has recently migrated to ECC6.0. The issue is that in 4.6c, they had created profiles and attached to the concerned users without generating roles (guess 4.6c allowed that). Now, the issue is in ECC6.0 we need to have roles corresponding to the profiles consisting of the authorizations of the profile.

Any ideas, how we can generate the roles from these profiles in ECC6.0 without losing the authorizations specified.

Regards

Lokesh Gupta

[mvoros]

Hi,

in PFCG you can insert authorizations from authorization profile. If you go to authorization data then it's under Edit -> Insert authorizations -> From profile.

Cheers

[Former Member]

Martin, in your suggestion, will it work if the profiles were created in 4.6c version. I had thought of this option but then came to hear that for this option to work, the profiles should be of the relevant version and should be consistent with the importing version(ECC6.0). Please confirm

Lokesh

[mvoros]

Hi,

it should work but I haven't tested it. The profile is just set of authorization objects with values. Hence only problem I can think of is if some authorization objects ware removed from ECC6. I doubt it. The note 518540 mentions that if one authorization object is not valid then it will reject whole profile.

Cheers

[Former Member]

Hi,

There is a standard tool which is provided by SAP, through transaction SU25, for the purpose of conversion of manually created profiles to roles. This tool also helps in identifying transactions which are new and replacements that are to be added to roles.

Regards,

Chaitanya

[Bernhard_SAP]

...it is point 6 in SU25....

[Bernhard_SAP]

the first question is : 1.) are that generated profiles (created in PFCG) or 2.) manually created profiles (created in SU02)?

if 1.)=true, then the roles should still exist in the system and can be assigned to users (if the roles don't exist anymore, you have to proceed as per 2.)....)

if 2.)=true, then the above mentioned suggestions will work

You can identify the profiles type by checking table usr10-->field 'Typ'

b.rgds, Bernhard

[Former Member]

Hi

I am trying to convert the profiles to roles using SU25 method as profiles have been created using SU02 ( i guess).

Now my dilemma is when i use this option, i am faced with two alternatives - optimized and identical. When i use the option optimized, it creates a role (appended with funny numbers, want to remove that too) but lots of objects become yello and red. Even the organization level has certain blank values. Though on adjusting them (just made them star for testing), it creates a user menu but wola.........the users list is blank. All users assigned to the profile are not there in role.

I then tried using option identical.This seemed nice one with the role being generated with all green lights and no adjustments were required. Even the user assignment was preserved. However, the user menu did not get generated. Could not even find S_TCODE object.Also, i felt certain objects have gone missing (this is just my thought). It also does let me edit the role (though SAP says u cannot)

I need help now to know which option is better to use and what happens in these options. Also, if I use the identical option, is there any way i can generate the user menu

Guys, please advice

Lokesh.

[Former Member]

This is what SAP says.

If the profiles contain authorizations for authorization object S_TCODE, the corresponding user menu can be created automatically. However, The menu can only be created automatically if authorizations for S_TCODE are included in the profile and the transactions are listed as single values. Areas cannot be resolved, such as VA*.

From your post it is understood that S_TCODE doesn't exist. It means you need to create Menu on your own and adjust subsequent authorizations.

[Former Member]

Hi Lokesh

Not sure if this is the best method of copying the profile into roles as you are compromising on the naming convention. Once you are done please check note 156196 for renaming the roles.

Please refer to the following link for some details on Step 6.

http://help.sap.com/SAPHELP_nwmobile71/helpdata/EN/e3/3b9e583bc311d5b3cb0050dae02d7c/frameset.htm

The other option could be creating CATT scripts to create new roles and inserting authorizations from authorization profile.

Thanks.

Anjan Pandey

[Former Member]

Used SU25, option 6 and then create role identical to profile. Though it did not create a role menu, the roles generated had all objects adjusted and all users listed. Had to though copy the roles for our naming convention as SAP gave some strange name to the roles.

Closing message and Thanking all

Lokesh