HOW MANY ROLES ARE ELGIBLE FOR THE USER

[Former Member]

hello gurus,

how many roles can we assign to the user... what is the maximum limit of the roles and profiles for the user.

thanks in advance!

sri

[Satyabrata_Basu]

Hi,

I don't think there is a limit as such.

However, it's better to merge as much as possible to have better performance.

Cheers !!

Satya.

[Former Member]

Hello sathya,

no sathya there is a limit for the profiles of one user the limit of profiles are 312.

but iam little bit confused about roles.. thats it... but i have one idea if roles are more for the user then u have to compare the profiles... how many profiles are there if the profiles exceeds more than 312. i dont what we have to do?

regarding the above issue if u have any queries feel free to reach out me.

srinivas.

[Satyabrata_Basu]

Dear Srinivas,

About roles it's indeed not to easy to tell..just imagine the scenario:

1. Maximum number of profile is 312 ... (however due to some known bug system reads about 300). So, let's say 300 profile maximum can be assigned to an user

2. Now you can have single ABAP role which generally one-to-one to profile. So, this theory says if you are only assigning single ABAP roles, you can assign maximum 312 (or 300) roles.

3. But, you might also have Composite ABAP role. A composite ABAP role can have one or more Single/Composite ABAP role. So, one Composite ABAP role can correspond to any number of Profile which is determined by number of individual Single roles under than composite role. So, when you are assiging Composite ABAP role, you have to take care underlying number of profiles and make sure total does not exceed 312 (or 300 without note correction)

4. Now, last part of complication (and my favourite one). Sometimes, there is an empty Role which does not have any ABAP authorization assigned to it. But, this type of roles are used to map a authorization role in JAVA system. These roles does not have any Profile (as it does not have any ABAP authorization). Now, that brings my confusion ..What happens you assign 300 ABAP profiles via ABAP Roles and another 20 empty role for JAVA system without profile. You see my point

Hope this clarifies a bit

Cheers !!

Satya.

[Former Member]

maximum profiles = 312

You can have any number of roles as long as the profiles associated with them does not exceed 312, practically that means < 312 roles.

If you have anywhere near that number then I would suggest that it may be useful to revisit your authorisation concept

edit to add for clarity, field PROFS in USR04 is 3750 chars max. profile length = 12 chars so 312 is max profs as the assignment is stored in that field

Message was edited by:

Alex Ayers

[Satyabrata_Basu]

Hi,

yes...For maximum number of profiles it's 312. But, usable is only 300 (without note correction).

Please check the note 841612 and 410993 for detailed explanation.

http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=841612&_NLANG=E

http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=0000410993&nlang=E

For maximum number of roles, I don't see any such restriction because you can have some roles without any profiles attached to it (e.g. mapping role for JAVA instance). I'm not sure about this.

But, 300 roles per user in a single system is quite a lot to be honest

Thank you with kind regards...

Satya.

[Former Member]

hello satya,

thanks for u r post.

regards,

srinivas.

[Satyabrata_Basu]

Dear Srinivas,

thanks.

BTW: The SDN way of saying thanks is to award points for helpful answer

Cheers !!

Satya.

[Former Member]

hello sathya,

once again thank you very much... ya sure sathya i will give points....

dont worry and thanks for u r post.

Take care bye