ERM Security and PFCG

[Former Member]

I'm curious if anyone has thought about the following and how to design around it. Our client is planning on using ERM full functionality and plans to allow role editing via PFCG within ERM. The problem is that those users need to have PFCG authorization to do this within the back end system. So my question is what is to prevent that user from just directly editing the role within the back-end system?

Additionally even if we find a way to take away securities backend PFCG access they will still need it to design roles for the on going future releases.

Any ideas would be appreciated.

[Former Member]

>

> Additionally even if we find a way to take away securities backend PFCG access they will still need it to design roles for the on going future releases. 
> 
> Any ideas would be appreciated.

Why would they need PFCG for ongoing projects? You can migrate your exisitng roles into ERM as it is. Although I would go with the idea given by Surpreet using firefighter for using PFCG roles if there is a reall need for it.

Thanks!

Chinmaya

[Former Member]

another way ....... may be........ Lock PFCG in backend.

it can't be used directly in backend.

For design purpose have ZPFCG.

Regards,

Surpreet

[Former Member]

Yes this is possible.

In backend you must be having VIRSANH, means you have Firefighter (SPM) in backend (ABAP system)

please maintain all those users in Firefighters Owner table and make sure you had implemented SAP note 992200.

then those users can't login to SAP system in backend.............

however if this you think is not possible....... then create few User Ids and give them required access and maintain thos in Firefighter.

regards,

Surpreet