Config and Dev Roles

[Former Member]

Hello Every one,

We came up with a new SCM sandbox, and my task is I have to design configuration kind of roles on the system for functional developers(FD).

Any ideas how should I go about it, what would be the best approach:

1) Contact FD's and understand what kind of Tcodes they need. or

2)Look for SAP standard configuration roles and customize it to my company and than assign them....

I am a security developer, I have no understanding about the business..

Please guys let me know your thoughts...!

[Former Member]

Thanks Srinivasan, I am looking at some of the SAP delivered roles it seems like they have wide access.

Do you think it would be wise if I copy a SAP standard configure role for SCM and then tailor it to make more restricted on access..

Also my manager was saying she use Tcode SPRO and then customize it, I did not understand what she meant do you have any clues on this..

i will appreciate all your ideas..

Thanks!

[srinivas_krishnamoorthy]

There could be multiple approaches for evolving with the config and dev roles. SAP delivered roles are supposed to speed up the process of this evolution. We however went with a bottoms-up approach. We looked at each relevant T-Code and did what we had to in terms of getting the roles defined.

Transaction PFCG and other related authorization transactions are accessible through SPRO as well. You can do a find on Authorization and check where they appear in SPRO.

[srinivas_krishnamoorthy]

Coming up with the roles is an iterative process. The approach needs to start out from a restrictive side opening up only what is required of the role. So the roles may have access to certain transactions. In these transactions you would need to setup display or edit access based on the user role. C_APO_FUN authorization object is the key in APO. You would need to also look at some sample roles in PFCG transaction to arrive with the list.