Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

SU25-Step:2C Roles to be checked

Former Member
0 Kudos

Hello All,

I searched old threads but didnot find answer for my question, appreciate your reply

My systems is going for upgrade from 4.6 to ECC 6.0, I performed SU25 on my sandbox(ECC) to see roles affected, its pulling up all the our Z roles affected status RED.

Is there a way to generate these profiles automatically, as I feel its really tedious to manually generate 100's of roles.

This is the first time I am involved in upgrade, want to play safe with security change.

And in "Display changed Trans." its showing huge list of tcodes changed I dont know its pulling up the accurate list or not....Most of the tcodes I see are like ME21(old) changed to ME21N (New)

Any thoughts on "N"...?

Extra info......

And also my company really never maintained SU24, they appended SAP default checks and manually maintained auth. fields in PFCG...

As per forum threads I backedup UST12, USOBT_C, USOBX_C...

Please suggest me guys...thanks in advance....

1 ACCEPTED SOLUTION

Former Member
0 Kudos

Hi Anil,

1. For generation of profiles you can use transaction SUPC and slect the roles and tick mark generate automatically, all the profiles will be generated.

2. From ECC5.0 onwards ME21 exists in three formats ME21N(Create Purchase Order), ME22N(Change PO) ME23(Display PO).

Hope that helps

Rakesh

14 REPLIES 14

Former Member
0 Kudos

Hi Anil,

1. For generation of profiles you can use transaction SUPC and slect the roles and tick mark generate automatically, all the profiles will be generated.

2. From ECC5.0 onwards ME21 exists in three formats ME21N(Create Purchase Order), ME22N(Change PO) ME23(Display PO).

Hope that helps

Rakesh

0 Kudos

Hi,

SUPC will not work for that roles, as their status (of the profile) is 'to be compared'.

My opinion is, not to bypass the point of updating the profiles with the new authorization data. Sooner or later, this adaption will be necessary anyway.

If you perform the updates now in your test environement, you could save that roles (with the updated authorizations) in a transport. If you upgrade then your production, you will have the work already done. Simply import your role transport and you have the actual versions of the roles in your production.

So my recommendation is, to perform all steps completely in the testenvironement and not to bypass any point. It will foll back to you some when later on (latest in production, if some orles will not work anymore because of missing authorizations due to new/additional authority checks in the applications.

b.rgds, Bernhard

0 Kudos

I agree with you Bernhard, soon or later its my task to clean up all the mess...its good that I take care of the things now and be cool when its go to Test-Prd.

However my question still not answered, if SUPC doesnt work for this situation is there any way I can do auto.VS manually generating profiles, as there are 100's of roles...

Thanks alot for suggestions.....

0 Kudos

If you purely want to generate the roles then it would be no problem to create an eCATT to open up each one & then generate the profile - it will only put the open data into the profiles which is not something I would personally want to do.

0 Kudos

I agree Alex! I cannot go by eCATT, so this left me with going into profiles and check auth. to see if it works for us and manually generate it....If I understood correct...

Thanks Guyz...for your thoughts!

0 Kudos

Hi All,

How about downloading the roles and doing neccessary changes uploading them and then using SUPC.

Even this is a manual work but saves profile generation time.

Rakesh

0 Kudos

You should not modify the downloaded Roles using Notepad or any other editor. SAP wont allow the upload of such Roles.

0 Kudos

beside Gautams post.....

....before manipulating the downloadfile I would be faster to update the authorizations in pfcg directly. Then simply save the authorizations in pfcg. After that the profile will be selectable in SUPC too, if you don't want to trigger the generation immediately online in pfcg.

b.rgds, Bernhard

0 Kudos

SAP will allow the upload of those roles if you do it right.

You have to be very careful & know what you are doing, personally I prefer not to do this but it is a valid, if risky option.

0 Kudos

Hi,

I do agree that its not the best practice.

As Anil is upgrading his SAP version to ECC6.0

So downloading a role and uploading it will may lead to new tcodes like ME21N,ME22N instead of ME21 and some newly introduced tcodes may come as they were not in 4.7 and hence the red status for profiles in Su25.

If they upgrading from 4.7 to ECC 6.0, then downloading the role and uploading the role (with modifications if any) into ECC 6.0 Sandbox/test system, check the su25 and then test the roles functionality,and also the ABAP programs.

Its a manual work again!!!

Rakesh.

0 Kudos

I am not involved in this process before...Just to check my understanding...Download/Upload(with changes)....If I understood correctly download from 4.6 to external file make changes and than upload to ECC and generate all profiles using SUPC......

So you mean to say I should replace/add new tcodes on downloaded roles and than upload and run SUPC...

Guyz I know this thread is going little long, however this is something new..want to see I got forum idea right...

Thanks All for valuable suggestions!

0 Kudos

Sounds ok..

As said earlier by Alex and Bernhard its risky but if done carefully it should work fine.

Good luck

Rakesh

0 Kudos

...still I don't think, that this will save much time....Sorry....

Former Member
0 Kudos

Thanks guyz