Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Changes to standard role overwritten

Former Member
0 Kudos

Hi Security experts,

We are currently facing an issue where we have changed a sap standard role and added a custom t-code to it then transported to Production, a week or couple of weeks after, the changes that we did in Production were overwritten and the standard role shows up the date of change was the previous one before ours which was last year.

We believe there is a SAP standard background job that runs and checks standard roles and then cleans them up. Please help. Thanks.

Regards,

jG

5 REPLIES 5

martin_voros
Active Contributor
0 Kudos

There is no such a background job that returns roles in SAP name space to original version. Somebody had do re-import old version. Anyway, it's not a good practice to modify SAP roles. Why didn't you just copy SAP role into custom role and do modifications there?

Cheers

0 Kudos

HI Martin,

We currently do not have any custom role to add the custom transaction. The way the security roles were setup here is using a lot composite roles to assign to users specific business responsibilities, and the custom transaction code needs to be assigned is on of the basic roles which is present in every composite role, so I will have to assign the custom role to every composite role which is a bigger task. Can you recommend a better and faster way of doiing this?

Thanks.

jG

0 Kudos

Check if the changes that you've done still exists in the DEV system. If so, then re-transport.

But, as mentioned in the prevoius response, its a good practice to copy the standard SAP role and customize it.

-- Dipesh

0 Kudos

Preparing SECAT script might automatize adding new role to composite role.

Cheers

Former Member
0 Kudos

What is the name of the role?

Did you check change documents for the role? Someone might have (re)imported it to add some personalizations.

Generating the profiles of SAP* namespace roles is one of the favourite hobbies of SAP Support. The authorizations are all manual in the AGR* tables, so they are independent of your Su24 efforts.

A warning popup will appear.

In double-stack systems (which SAP only supports for Solman and PI) you are forced to accept it, because they are needed to start WDA applications from the workbench and access the Java stack, and other ports.

Anyway, you should NOT change a standard role. You must copy it if tcide and profile relations are needed. You will also have seen a popup warning! Perhaps you did not read it?

Cheers,

Julius