Mass creation of roles in ECC 6

[Former Member]

hello,

we're installing ECC6 and we will have to create a lot (1000+) of derived roles depending of our organizational structures.

i'm looking for any information on how to automate this process : third party products, custom abap programs, catt...

thanks in advance

best regards

[Former Member]

Oliver,

I am working to create mass user creation. After my initial readings I found eCatt is useful to do this. Please use this link to get yourself familiar with eCatt to create the mass users.

http://www.sapsecurityonline.com/tutorials/secatt_user_create.html

I have not yet completed reading about eCatt would do that next week and help you if I am successful here.

Thanks!

Surya.

[Former Member]

thank you!

first tests with ecatt seems to show that it is not possible to automate role derivation with all my organizational structures as authorizations values...

may be do i miss something?

best regards

[Former Member]

Hi Olivier,

Its possible to create derived roles with different ORG values using SECATT.

I have done it for my one of my projects, the trick lies in parameterising the fields.

I dont prefer simulation while parameterising instead I browse through each screen name under DYNPRO in command editor.

With regards to the ORG values you have to be careful while playing with Low and High values.

Let me know if you need any further help.

Thanks.

Regards,

Muthu Kumaran KG

[Former Member]

Hi Olivier,

A Surya suggested, CATT scripts are good for building the shells of the derived roles.

In our implementation, we had to create over 10000 derived roles. (don't ask me why, am finding an answer myself after several discussions !)

Since it was a humanly huge task to maintain the ORG values manually, we got an ABAP'er to make a custom program that does these ORG updates in AGR_1252. Upon several testings, it worked fine for us.

say for example: need to update role ZXXX with comapny code 0000

the input would be as simple as:

ROLE | ORG_VAL | LOW | HIGH

ZXXXX | $BUKRS | 0000 |

It might be something you can consider. At least it saved us a HUGE time!! not to mention the ease of use.

Do let us know on the strategy your team comes up with

-Abhishek

[Former Member]

Thanks to all for your very useful replies!

i'm not familiar with SECATT but will take a look on what's possible. Any clue would be greatly appreciated!

at first sight, i would prefer an ABAP program that does all the "magic".

Abhishek, could you tell me more about this program : was it difficult/long to create?

best regards

[Former Member]

Hi Olivier,

More than difficult, its very interesting!

We had a cool ABAP'er. We gave the requirements and the tables. and he did a fantastic job. We got this program ready and tested within a couple of days. it takes an excel fie as input and after updating the derived roles, it generates the role too.

We found this to be a life saver for us. Let me know if you need any further info

-Abhishek

[Former Member]

yes Abhishek, i'm very interrested with having further informations

is there a way for me to contact you directly?

best regards

[Former Member]

Hi Olivier,

I am afraid, my help is limited to this forum.

However, I can help you with some ABAP logic :

Table AGR_1252 is used to store the ORG values of derived roles.

You can start working with an ABAP'er to get his coding magic started. Though I am not familiar with ABAP, I believe our ABAP'er debugged PFCG and knew what needed to be done. I have no clue what he did

the logic:

***********************************************************************

• Start of Selection

• Load information into internal tables for use in creating report

***********************************************************************

• Upload the Organsational Changes Spreadsheet

• Ensure Roles exist and there are no duplicates

• Ensure Organistional levels exist and there are no duplicates

*Checks if the file exists

• Role must exist

• Ignore duplicate roles

• Authority Check Role for user

IMP Logic checks-

• For Add High range of Role must be greater than low range

*...if adding specific ranges - remove existing * or space entry if it

• exists

*...if adding * access remove other accesses if they exist

*Process All Org Levels for each role

• ...submit report to generate profiles

You can start working with your ABAP'er with this logic.

*Disclaimer* - this may need enhancements to meet your requirements. Also, I have just put the logic what I could remember at the top of my head. I may have missed something.

Hope it helps

Abhishek

[Former Member]

thanks a lot Abhishek for those details and the time you took for me

it's an excellent starting point

best regards

[Former Member]

Hi Olivier,

Since you did mention 3rd party tools, I just wanted to emphasize on a 3rd party tool we have been using. We have used Mercury Quick test professional to create our master roles.

I found some good advantages of using this tool over CATT-

1. you can incorporate VBscript code in it ( gives you the advantage of looping)

for e.g. if i need to create 100 master roles, not all roles will have the same number of transactions. I can loop each role till the number of transactions we need to add

2. Exceptionally good error handling

Apart from code, it gives you the flexibility of making some screens optional

for e.g. Not all roles may pull ORG values. There might be some roles which do not pull any ORG value. So once we add the transaction and go to maintain authorization data, we will not get the ORG screen pop-up!

so in this case we can make this optional. If this screen pops up...okay..put this value..if not , forget it.

3. has the ability to maintain functional values in roles.

- I had to work on some BI 7.0 roles, in which we have multiple roles , the differentiating factor just being the analysis authorization(if you are familiar BI and analysis authorization). so i could do this easily with QTP

i am not marketing QTP, but I found it to be a handy tool for SAP.

PS>> its NOT as fast as CATT. CATT runs in the background in SAP, this is a front end interactive tool.

Let me know if you have any questions.

-Abhishek

3.