ChaRM Job Roles

[Former Member]

Hi,

While testing configuration, we have provided our developer the following job roles:

1. SAP_CM_SMAN_DEVELOPER

2. SAP_SOCM_DEVELOPER

3. SAP_SOCM_REQUESTER

However, he is able to authorize/reject change document. What could be the reason?

Regards,

Nayab

[Former Member · Accepted solution]

In my last ChaRM implementation, we found there were lots of "opportunities" to improve on the standard delivered roles. What you are seeing is not uncommon, so make sure you continue to perform detailed security testing, ESPECIALLY if you deviate at all from the standard process.

Also follow SAP's recommendation and use copies of the delivered roles because you will make many, many updates to them.

I realize this doesn't provide a solution per se, but you need to understand that the delivered roles are not fully built out and require many changes based on your particular company's business process.

Regards,

Lori

[Former Member · Accepted solution]

Appreciate your reply Lori.

Can you please provide second level authorization of each job role that you used in your project, authorization object b_userstat. I'm confused of why sdcr_00 is provided in the standard developer's job roles.

Secondly, for urgentcorrections, we create document sdcr through slfn message. Where should the project team be defined, like who's the developer, tester, change manager etc. Each time the sdcr message is created, I've to manually assign business partners.

Regards,

Nayab

[Former Member · Accepted solution]

>

> Appreciate your reply Lori.
> 
> Can you please provide second level authorization of each job role that you used in your project, authorization object b_userstat. I'm confused of why sdcr_00 is provided in the standard developer's job roles.
> 
> Secondly, for urgentcorrections, we create document sdcr through slfn message. Where should the project team be defined, like who's the developer, tester, change manager etc. Each time the sdcr message is created, I've to manually assign business partners.
> 
> Regards,
> Nayab

I don't have the detailed authorizations with me because I'm working on another customer's computer at their site, and I'm not a security expert. However, I can tell you that SDCR_00 is provided in the standard developer's job roles because some developer actions in the correction impact the change request document. For example, if a developer executes the action Withdraw Correction, the change request status is set to To Be Approved. This requires implicit authorization for developer to set a status on a change request, even though the developer would never do this manually.

To your second question, the answer would be in 2 parts:

(1) Change Manager could be set up via a rule based on information you capture in the SLFN document, such as application component. This is a standard partner function on SDCR so this is relatively simple to set up, and the steps to execute it are well documented on this forum.

(2) The other roles - developer, tester, etc. - are standard only on the correction itself. If you know them at the time of creation of the SDCR, you could create a custom partner determination schema which includes them, and then populate them on the change request, and set the copy control to pull them into the correction document. If you don't know them at the time of creation of the SDCR, you can just populate them manually on the correction (which is typical) or set up rules to define them. Note: I've found that setting up rules at this level on the correction document is not worth the effort - it's just as easy to populate them manually - but that's up to you and your process requirements.

I didn't provide detailed instructions on how to do this, but there are multiple threads on this forum that discuss it.

Good luck!

Lori

[Former Member · Accepted solution]

Thanks Lori. Issue is resolved as explained/suggested