Report availale: granted authority and used authority per user ID?

[former_member184878]

Hello dear collegaues,

May I ask, can you help me please?

My quesition is: Is a possibility to make a report per User ID where I can see all the functions the user  is allowed to use,

and the effective use of functions within a defined time period.

Exampel:

User Jane Doe has NN authority to functions within SAP.

But user Jane Do uses the following functions within defined time period.

Thank you for your help and answer.

All the best Erwin

[Former Member]

At a transaction, RFC, WebService or WebDynpro level you can compare the authorized functions to the ones in their menus and then compare them to the statistics database. That produces nice colourful ALV lists and excel sheets in the reports we have for this.

At an individual authorization object and field value level, you will have to wait a little while still for a kernel patch which will hopefully come soon. It will make it possible for you to simulate the affect of successful or unsuccessful checks without them actually failing. This means you can also over time gather what a user has for authorizations but does not use...

I am also waiting a long time for this. I will update this when it is available.

Cheers,

Julius

[former_member184878]

Hello,

Thank you for your help!

all the best Erwin

[Former Member]

There are many use cases for it. Currently only tcode, RFC, WYDA and Webservice comparisons between the stat records and the roles is possible, and this still does not tell you which role it as which led to the success of the check... so you need to create a rather complex selection criteria to take slices out of combinations of sets of users, ideally just one role and then try to assign them to each other functionaly to produce a meaningfull output.

The new solution is actually quite simple but very powerful. You assign just that which you wan to compare indirectly to the user(s) via a reference user, as those authorizations are evaluated first. Depending on whether this leads to setting sy-subrc to 0 or not, an additional "reason code" is assigned to the ST01 trace and also the Su53 data (if you have implemented SAP Note 1671117).

This means that you can evaluate the source of successfull checks and simulate whether they are sufficient for the user without it actually failing. This also means that any auths in roles assigned directly which are still reached are missing in the indirect role which is actually being evaluated, and any auths never reached are not needed.

The simulation mode use-case is what I am most interested in and find most powerful.

The origin of the request is the service described in SAP Note 1682316 (use-case RFC simulation, as often you cannot really test realistically in QA systems). Vut as mentioned, there are several other nifty tricks you can use to get very valuable information from these "reason codes".

Cheers,

Julius

[former_member184878]

Hello,

Thank you for your help and expertise.

all the best Erwin

[former_member184878]

Hello,

Do you have some experience this tool?

Thank you for your answer help.

all the best Erwin

[Former Member]

Hi Erwin,

Yes I use it. It is very useful to analyze if a user is (not) using certain authorizations for example if I have a discussion about solving SOD conflicts. There are certain views possible. In reporting the SOD conflicts I also report automatically which of the transactions was executed by the user.

Another option is for role maintenance. I can see what roles are assigned to users and the authorizations in the roles. If a certain transaction is not used by any of the users that have the roles I can start the process for removing the transactions from the roles.

Meta

[former_member184878]

Hello,

Many thanks for this hint.

Looks rather interesting.

A tool I was looking for.

I have already written to support.

all the best

Erwin