Health Report for existing role in support and upgrade documentation

[arpan_paik]

Hi Experts,

I am looking for create a report or using existing report/FM (if any) which will show new objects been thrown for a role with there SAP suggested values when we use PFCG expert mode merge option. I think this will be very helpful for support person to health check for roles and during upgrade in step 2C documentation people can save a hell lot of time. I do not have ABAP knowledge. Can anyone help me on this?

Regards,

Arpan Paik

[OttoGold]

Hi,

for sure you need: USOBT_C customer SU24 data. So if you want to simulate that you add a transaction, you can check which SU24 entries will be pushed in. I am also considering building something to see how big data is there to be upgraded or what would be the impact (so something like being able to "simulate" the upgrade steps independent from each other...). Unfortunatelly this is not so easy even for me (being an ABAPer), I haven`t even started, so there is very little I can share on this. If I start/ when I start and still remember this thread, I will update it. On the other hand I don`t posses any special knowledge or skills and anybody can do what I am up to do - debug SU25 and rip off the standard code.

Cheers Otto

[Former Member]

You must always put careful thought into step 2b. There is no easy automation of that without making it very error prone...

Then follow this wiki description --> https://wiki.sdn.sap.com/wiki/display/Security/BestPractices-HowtofindTCodeschangedafterupgraderegarding+SU24-data

Knowing the tcodes from table TCODE_MOD, you can easily work out the affected roles from AGR_TCODES IF the roles are built from the menu.

Cheers,

Julius

[arpan_paik]

Hi Julius,

I have been to that wiki before and one by you as well (regarding upgrade steps). For current upgrade I have also noticed that SU25 step2B is not only left with customer related changes only. Where USOBT_C/USOBX_C has same values as of USOBT/USOBX there update to customer table automatically happened in step2A. So 2B left with very less changes where customer prefer the standard way!!!

What I am looking for is actual authorization change delta. Step2C gives us only list of roles get affected. I am lookimg for what change actually can happen to a single piece of role due to upgrade.

I have followed below method.

1. Join table USOBT_CD and USOBT_C to see actual proposal for changed transaction and corresponding auth object. Here I had to perform few excel work to remove data repetation

2. Then take old data for roles from AGR_1251

3. Put together above 2 data and after proper sorting by object manually remove the data which SAP does by expert mode merge function.

Can this step be automated by some ABAP code? or function module?

Otto wrote :

 If I start/ when I start and still remember this thread, I will update it 

Please do so and thanks for sharing thoughts.

Regards,

Arpan Paik

[Former Member]

Hi Arpan,

That is why I suggest using table TCODE_MOD. From the list of tcodes which have changes regardless of the origin, you can easily find two things:

1) List of roles with the tcode in the menu.

2) List of change documents from the CD tables.

That is what will change. That is also an indication for you how long the list will be in step 2C (list 1) and how quickly and confidently you can work through them (knowing what is on list 2).

Cheers,

Julius