Authorizations / Roles for configuring SAP

[Former Member]

I need to assign myself Roles or Authorization Objects in order to configure SAP. I can't give myself SAP_ALL so I need specific roles/ auth. objects.

I have the role SAP_BC_CUSTOMIZER assigned to me however, I do not have access to a lot of the tracsactions like O035, KS01, KS02, SE16N, EC01, EC02, EC16, OX06, EC*, SCAL etc.

Are there roles or authorization objects that can be assigned to me that would be give me access to all the transactions that I would need to completely configure SAP.

[Former Member]

This message was moderated.

[Former Member]

Hi Robert,

Do the following steps to search the roles for the said required transaction codes:

Run the transaction code SUIM  -> Roles -> Roles by transaction assignment -> put all the transaction codes by selecting arrow for multiple selection and click on execute button on left top.

It will give you list of roles in which these transaction codes exists, assign the appropriate roles from the list to your user ID. You will get the asses of the require transactions.

Hope this helps

Regards,

Kiran

[Former Member]

Dear Robert,

  You can search with one of the security consultant help there may be one SAP basis role in your system and I hope that will fulfill your requirements to configure SAP. If it does not work the other way is to work with one of the security consultant and find the relevant role in the system having the transactions you need and he will find it for you through SUIM--> ROles-> Roles by complex selection criteria--> Auth object S_TCODE and then put the tocdes or objects u need.

I hope it will help u.

Regards,

Varun Jn

[Former Member]

This message was moderated.

[magexposito]

Hello Robert,

The best idea is always to use a custom (Z*) role with all the transactions and authorization you are going to use. You can export this role to a file and then upload it to any new system so you can create a role really quick.

Otherwise you can assign yourself all the roles like SAP_BC* so you will have all the transaction for the Basis module.

Best regards.

[mvoros]

Hi,

slightly off-topic but custom roles do not have to comply with naming convention Z* or Y*. There is no such a restriction from SAP. SAP uses name space SAP_* for their roles. So you don't want to have names with prefix SAP_ but everything else is OK. Not sure why this really irritates me.

Cheers

[koehntopp]

Robert,

what part of "configuring SAP" are you supposed to be doing? There are many many different types of support/administration/development tasks, each of which needs their own type of authorizations.

Depending of what kind of organzation you're working in there should be some kind of body that has governance over these authorizations and makes sure everybody has what they need, but nothing more.

I have worked in many authorization related projects - the worst thing you can do right now is to hack your way throigh this on your own; you will create a huge mess that will be very difficult and time consuming to fix later on. I would also advise to get in contact with a knowledgeable person who can help you get a good start with SAP security concepts and avoid many of the pitfalls. I'm certain this will pay off pretty quickly....

Frank.