SAP Standard Authorisations for "Reporting Users"

[Former Member]

Hi all,

I just had a look at the authorisation template "BI Role: Reporting user" (S_RS_RREPU).

Some of the authorisation objects in this profile look a bit odd too me.

For example, why should a reporting user be able to execute OS commands (S_LOG_COM)?

Why does he need administration functions in the Change and Transport System (S_CTS_ADMI)?

Why should he be able to manage background processing (S_BTCH_ADM)?

Is there any documentation out there that explains why SAP thinks that a reporting user should have these authorisations?

Thanks

Gerrit

[Former Member]

Hello Gerrit,

Documentation on standard roles can sometimes be obtained from SU22 (but this does not give reasoning) and possibly by reconstructing the auth/authority_trace information during development of the application or transaction.

They are suggested values, that is important to consider. You might be better off using them than kicking up a huge storm, but you do not have to. The generally adopted procedure when using standard roles, is to copy them into your own name space and change them there.

Specifically regarding the 3 objects you mentioned...

You can restrict S_LOG_COM (see also S_DATA_SET) further (unlike S_RZL_ADM to create them) and S_ADMI_FCD can take many values (some critical, others less so). So they are suspect, but not necessarily harmfull depending on the value.

S_BTCH_ADM sounds like an error to me. This error is also often made when tracing or SU53'ing transaction SM37. I would recommend changing / challanging that one.

Hope that helps,

Julius

[Former Member]

This is beacuse they are standard roles....

Hence define using a job possition in mind..

May be while execuding the report must be running in background... and so on... other task assigned to that job are included

[Former Member]

>

> This is beacuse they are standard roles....
> Hence define using a job possition in mind..
> May be while execuding the report must be running in background... and so on... other task assigned to that job are included

I struggle to see what a standard reporting user would perform tasks which involve administering batch jobs and working with logical commands. Logical command access is pretty rare for end users at the best of times.