Editing Templates for General Authorizations

Editing Templates for General Authorizations

It does not makes sense to include general authorizations (printing, archiving and so on) in every transaction.

You can adopt authorization objects from templates created by SAP when you maintain activity groups (Transaction PFCG).

You can then maintain these templates from the initial screen of Transaction SU24. Choose Edit templates.

The system then displays a list of the SAP templates. These cannot be changed directly.

You can, however, copy these and use them as a pattern for your own settings, or you can create completely new templates. To do this you require the User Master Maintenance: User groups authorization (S_USR_GRP).

The names of SAP templates begin with S . If you create any templates yourself, they should not begin with S . SAP_ALL contains all authorizations.

Ensure that changes to templates are not passed on when you carry out activity group comparisons.

If you want to transport your template, you need to specify an appropriate development class when you create it (not $TMP, local objects). You can find details on this in the BC - Workbench Organizer documentation in Maintaining Development Classes.

Suppose you want to create a Basis user in your test system with authorization to do "almost everything". Typically, users with this level of authorization may not create user master records or change authorization profiles.

Proceed as follows:

Create an activity group by choosing User maintenance ® Activity groups

Do not choose any transactions, but choose Authorizations and then Change authorization data.

Do not copy any templates, but choose Edit ® Add authorization. ® Full authorization.

Expand the Basis administration object class.
Here you find the authorizations which are generally regarded as critical.

Deactivate all authorizations which begin with user master maintenance and any others which you regard as critical.

Using the Profile Generator, generate a new profile and save it under a new name (see Naming Convention for Pre-Defined Profiles)

Activate the profile (see Activating Profiles).

If you choose User Maintenance ® Users, you can assign the activity group you have just created to the user. For further information, see Assigning Activity Groups.