Profile without basis permissions

[Former Member]

Hi all,

How can i create a profile for many users without basis transactions (ej. sm04, sm50, db02, etc) this users now have SAP_ALL, SAP_NEW profiles.

please ¡¡¡

[Former Member]

You can't.

SAP_ALL means EVERYTHING

Give me one good reason why a user should have access to 20000+ transactions

Create the user based on the transactions which they need. Do not start with SAP_ALL or you will remove functions in one place & they will just perform them somewhere else

[Former Member]

Hi Alex,

i know what is SAP_ALL, i want to quit that profile for all users that have it, until the other consultants define fine the permissions for all users i want to quit basis transactions.

thanks alex.

[Former Member]

Hi Francisco,

It's not that easy really, but one place to start is to create a role based on SAP_ALL and go through and remove most of the S_* objects or at least only give the display options for them. The role will likely still have a lot of holes, but it's a start.

Removing only the transactions will do nothing as the underlying access will remain and there are many ways to get to each function.

Good luck!

[former_member1061482]

One way that I would suggest is to make a list of non BASIS profiles which you want to use (which have currently been assigned to users from function modules other than BASIS).

Goto pfcg

Give the new role name (which you want to create) and role description.

Goto Authorization tab->change Authorization data

Goto edit -> Insert Authotrizations-> From Profiles.

Give the profile names one by one which you have selected to use.

Update the org level values and othe open field values and generate the role.

[Former Member]

Hi Francisco...

No wonder I saw many Sec. consultants in similar situations...I saw this issue discussing in one my SAP BI Security class...

I was in similar situation like you are two months back...on my brand new SCM system.....

As BA or partners were not ready to define me standard roles/tcodes I had to give SAP_ALL to them...after spending a week of sleepless nights......I customized a role from SAP_ALL, I restricted almost like more than 300 critical basis/security/db config by defining ranges in S_TCODE...I tested it can be satisfied.....

I think you can take try by defining ranges in S_TCODE....if you may want to try the ranges......give ur email id...I will email you the ranges and the tcodes restricted.....

I would promise, you will have good sleep.....however you need to insist BA or partner consultants to define roles on Quality/Test box and Production....because my role will give elevated access...

If you may want to try let me know.....

Thanks

[Former Member]

Anil,

If you have restricted by S_TCODE ranges then your role will not provide any useful restriction. Unless you restrict by object values you might as well save yourself the time and give them SAP_ALL.

[former_member1061482]

Thats right!

Restriction by S_TCODE always leaves some back-door entries of accessing the critical t-codes.

[former_member1061482]

Duplicate post

Edited by: Hemant Raj on May 3, 2008 7:12 PM

[former_member186775]

hi Anil ,

Can you help me with your role......i want to try it .......if you like to share it with me.......... email id = manjula.matha from GMAIL

[Former Member]

Please look at O* tcodes also.

Harinder

[Former Member]

Hi Kumar,

can u post those t-code in this thread...

tahnk you...

[Former Member]

Hi Anil,

You really will help me with your role......i want to try it .......if you like to share it with me.......... email id = daniel.uvm from GMAIL

thanks to all for your help

[Former Member]

Good Morning All - As per Alex note, just forgot to tell you that apart from ranges in S_tcode I also disabled some of the critical S_* objects just to be in saferside.

Thanks!

[Former Member]

Hi all,

thanks all for your help, i will try this solution.

thanks ....