Is it SAP recommendation to have MII Production workbench access to all developers???

[Former Member]

Hi All,

Recently developers comes at me, and ask for MII workbench access in production system. As far as i know only Basis consultant should have access to MII workbench as they are administrators.

And reason behind this,developers said,

1. They need to run transactions manually in production.

2. They need to check transports or objects in production. 

3. Workbench access helps them to debug codes.

I really don't understand these logic. All codes are in sync in all systems then also they wanted to check codes in production, And more over manual execution in production is something which i cant digest.

Kindly help me what things i needs to do now.

If its recommended by SAP, Then can anybody tell me about particular role to assign to all developers in production system.

Thank you so much in advanced.

[agentry_src · Accepted solution]

Hi Mahesh,

Unless there is an issue with having similiar data in the development systems, I don't know that they need access for those reasons.  I would think they could work with the Basis folks for that purpose.  There may be valid reasons for them to have access to production, but I don't see them from your post.

Regards, Mike

[Former Member · Accepted solution]

Hi Michael,

Thanks for your reply. Excatly my question was for them.... already all developed objects are in sync wuith all system. as I am SAP MII BASIS Consulatant, i understand what they need. but production system MII workbech access is something which i cant digest.

I have been working since last 2 years in BASIS, but i never heard about to have developer access in production system.

To debugg on high priority, developers can request BASIS(us) to give access on timely basis. But unfortunetly they are demanding production access for lifetime.

moreover today, they again came and ask for database access for all developers as well. . I am in shock now. Truley cant understand the logic now behind database access...!!!!  

Can you suggest now database access for all developers including production system, is that recommend?????

Please guide us....Thank you so much for your quick responce.

[agentry_src · Accepted solution]

Hi Mahesh,

I do not believe they have justified having such access to production from what you have told me.  If a rare case comes up when they do need the access, they should work with you as the Basis person.  They should not need database access either.  If you Direct Message me (do mouse over my name) or send an email, perhaps you can provide some details of your situation. 

Many consultants (not limited to MII) do not understand that there are restrictions on changes to production systems and don't understand why they can't make changes anytime they think it should be done.  Not a new problem, but stick to your principles and force them to justify their request in business/operational terms.  So far, they have not done so.

Regards, Mike

[Former Member · Accepted solution]

Hi Michael

Thanks for your quick responce.

They have asked for read only access to non-sap database here non-sap database is one where all production transaction processed data is stored.

I am ok with read only access, but is it good practice to have read only access to all developers in production?? i am just worrying about system and database performance. Individual developer may do testing like scenario, read data, condition queries, select query for linked servers, like that which may affect system performance.

I have suggested them one better solution,

If they want to read production data i can connect you all from development workbench to production database through data servers, with read only user. by this way you can read prod data.

But they are stick with below mentioned point only,

1. They need scheduler full access in production for all 15 developers

2. They need read only access in prod database for all 15 developers

3. They need workbench access to look the code in production system for all 15 developers.

Its seems i cant see any choice now. is there any SAP MII documentation regarding with this.

Please advice.

[agentry_src · Accepted solution]

Hi Mahesh,

I suspect that there is no documentation on the subject of production access as that is something determined by each individual customer.  Some customers (a relative few) will allow such access, but most have either learned from bad experiences or from general security guidelines to limit production access to a limited group (generally BASIS or NW administrators).

Read access to the prod database is not as big an issue, but even Read queries can affect database performance. 

I have not heard a good argument for having production access in the workbench or for the scheduler.  Have they provided any rationale for why they need such access? 

Regards, Mike

In some industries in the USA and other countries, (pharmaceuticals, food, defense, electronics, for some examples) they are not legally allowed to open access outside of very limited administrative groups. 

I have asked a few other MII folks to chime in with their opinions.  I also welcome others who I did not Direct Message (DM) to put in their thoughts.

Thanks, Mike

Message was edited by: Michael Appleby

[Former Member · Accepted solution]

Thanks Michael for your reply.

They need scheduler access is just for to manually run jobs in production in case of urgent issue or client requirement. That's also somewhat acceptable. yah..!! i agree requirements comes sometime on urgent basis, then they need to depends on MII basis people. and that is they don't want i guess. 

but production workbench access, is totally cant understand. To check codes in production, or to read data from production database, or other remote database through data server, as far as my understanding, this again degrade production performance on high level. Because to fetch data from remote database through data servers from production system which uses high application and network resource.

I am still trying to understand them, but no luck. Thank you so much for your support. At least i got some guidelines.

Michael two questions in my mind,

1. What is the ideal access strategy should have in MII production???

Rather than BASIS consultants administrator access, are there any recommendation you have ever seen in MII production system???

2. Is MII application has that much facilities by which developer can create table, create stored proc, create linked servers, create views etc?? Because my self as BASIS consultant i have tried that. From MII workbench if data server user id has access, then from MII workbench level everything is possible to manage database. Absolutely no issues in that. I believe MII is worlds best SAP application, because everything is user friendly and i liked to work and learn new things.

But still to have access on database level for all developers and doing same job over there, that was somehow i cant digest/Understand. because application and database are running on same server, and both sap and non-sap database running on same instance. I am sure, some how this is going to affect system performance.  Its just my worries, what are the  other things which theses guys cant do from MII workbench that's why they need access on database level. Need to think on that..!!! 

[Former Member · Accepted solution]

In short, no, the recommendation is not to give developers production access.

In my experience, MII developers sometimes want database level access so they can directly access MII tables to get a handle on issues.  However this is really an administrators' role, but sometimes the MII developer is more fluent in MII issues so he thinks he should have the access.  But really the two should work in conjunction on whatever problem is occurring.

Also, do you use NWDI for content management and for transports?  When a project is imported into the production system in this method, it is read-only.  So it's fine for whoever to have Workbench access, they won't be able to change anything, they'll just be able to read the code.  But also in this case, your code is guaranteed to be the same.  So they shouldn't need this here either.

It's also possible that the developers aren't aware they can view the logs for a transaction via the Transaction Manager view in the administration screen.  They should probably have access to this, so they can read the output that they would get from the Execution Logger window in the Workbench.  They can turn up the debug level in the scheduler for the scheduled jobs, or via the LogLevel request parameter if they're calling the Runner servlet directly.

Hope this helps..

Mike

[Former Member · Accepted solution]

Thank you so much Michael.A & Michael.S .... Thanks a lot for your guidance...!!

Regards,

Mahesh