Creation of a "SAP ALL" Profile only for client dependent changes

[Former Member]

Hi,

I want to create a SAP ALL user, who can only perform changes within his client. The System is an IDES ERP 6.0 version and I don´t want to search all client independentet objects in the customizing or in all authorization objects.

Did anyone here has a tip for me to solve this problem as efficient, as it can be solved.

Regards,

Dennis

[Former Member]

Hi Dennis,

will it be not enough to withdraw the authority S_TABU_CLI ?

Regards Wolfrad

[Former Member]

Hi Wolfrad,

your idea was my first idea, but it didn´t work... e.g. activation of special ledger... did anyone here have other ideas?

Regards,

Dennis

[fredrik_borlie]

Dennis, first of all, take the time neccessary to create the correct authorizations for the users!

It is ALWAYS the best method to ensure that no one does things they should not.

If you really want your user to use SAP_ALL you could (but should not) restrict changes by setting the client to only allow client dependent settings. But, since the user then can access SCC4 they can change that parameter.

Then an ugly hack is to lock both the SCC4 transactions and SM01 (SM01 is the locking transaction).

Then you have to restrict access to table view tool like SE16 and debug change rights cause otherwise the smart user can reset the lock on the transaction SM01 and start unlocking again.

So. Again. It is advisable to create the correct authorizations directly from start. You have many roles that could be used as templates. Use the template and then add transaction after transaction when the user requests it!

/fredrik

[Former Member]

Hi Fredrik,

thanks for your answer!

I know, that I have to set a user up only with his necessary rights in a productive client. But´the problem, I want to solve is to set up a user only for client dependent, because ´the User´s will work in a test client with no transport to a productive system, only to test. I´ll have a master for this client and will set it up new, if the client does´nt run anymore.

The Problem is, that I have in this test system with some client´s some client´s which will be used as pilot´t for projects and I want to prevent any change´s to these client´s and I can´t set up a seperate system for them.

Do you have any additional Idea´s?

Thanks in advance,

Dennis

[Former Member]

Hello,

Why do you want to create a SAP_ALL?

Why not just create a role, or even customize a SAP Template Role, and then assign to your user. Then limit him to a client thru the System Tab in su01.

The object S_TABU_CLI controls access to making cross- client changes.

You set it to " (null value), and then limit the user to a specific client/child system through Systems tab in su01.

chumy.