Regeneration of SAP_ALL

[former_member298408]

Hi,

We have a requirement in our Project to create a new Auth Object for a Z Tcode.

We need to include it in SAP_ALL as well.

However before doing that we have certain questions:

1) We are planning to regenerate it through report AGR_REGENERATE_SAP_ALL, so that it gets regenerated in all clients. Is it an advisable way to do that, or else we should regenerate through SU21?

2) Also, no value is maintained in Table PRGN_CUST against entries ADD_ALL_CUST_OBJECTS and ADD_S_RFCACL, does this affect the regeneration in any way. Our moto is to add our new auth object in SAP_ALL, we do not want any other change to happen to SAP_ALL.

3) Also, if we regenerate SAP_ALL in Dev environment, how does it move to Production? Do we have a transport mechanism, or this needs to be performed in each system separately.

4) I can see that there are already some Z Auth Objects added in SAP_ALL in our project, but the user responsible for last change is coming as DDIC. So, even if I run the Regeneration does it take DDIC as the user responsible for change?

5) Finally, is it advisable to regenerate SAP_ALL? I mean what all could be the bad affects of regenerating SAP_ALL?

Please help!!!

Thanks

Aditi

[mvoros]

Hi,

probably the best solution would be not to use SAP_ALL.

What value do you have in PRGN_CUST for key SAP_ALL_GENERATION? If it's set on 'ON' then SAP will regenerate SAP_ALL when you release your transports with new custom objects. Check note 439753.

1) They use same FM PRGN_CREATE_SAP_ALL. So no difference.

2) Not having record  ADD_ALL_CUST_OBJECTS is taken as yes. Hence all custom objects will be included. The logic is opposite in case of ADD_S_RFCACL. Not having record in table is taken as NO. Hence S_RFCACL won't be included in SAP_ALL profile.

3) Importing transport into system should trigger regeneration of SAP_ALL unless you explicitly turn it off.

4) I am not sure I don't think that it will use DDIC if you execute it manually. It will use DDIC when regeneration is triggered during import of transport.

5) It's OK but as I said you should avoid using SAP_ALL profile.

Cheers

[former_member298408]

Hi Martin,

Many thanks for your reply.

I have some further questions on your inputs.

1) Why do you consider that using SAP_ALL is not a good option. We are not assigning SAP_ALL to any dialog user, but SAP_ALL need to have this new customized auth object, else batch users having SAP_ALL would face auth check failure if it tries to execute this Z Tcode.

2) In PRGN_CUST, no value is maintained for SAP_ALL_GENERATION, so I guess by default it's ON.

Could you please confirm me on my points above.

Thanks

Aditi

[mvoros]

Hi,

1) It's good that you don't assign SAP_ALL to dialog users. Generally, it's good to start from zero access/authorization and add required authorization/access. Assigning SAP_ALL is exact opposite of this approach. Even SAP provides a role for WF-BATCH. It used to have SAP_ALL.

2) Correct

Martin