Role Distribution Process 

Background

You cannot copy roles from the Enterprise Portal to the SAP system on a one-to-one basis because the roles have different definitions. Instead, authorization roles (see Maintenance of Authorization Roles) that convert the Portal definition of a role on the R/3 side are assigned in the SAP system. The authorization roles in the SAP system are single roles with menu and authorization data.

The roles defined on the Portal side must be copied to connected SAP systems. The distribution process has two steps:

  1. In the Portal: Distribution of the role definitions and user assignments using the Portal component SAPAuthAdmin. You call this up from the administrator role using the menu path System Configuration ® SAP Authorizations.
  2. In the SAP system: Manual follow-up processing of the copied roles using Transaction WP3R.

The process requires manual follow-up processing since, in contrast to roles in the SAP system, Portal roles are not divided into responsible organizational units (such as company codes, plants, and so on) and therefore cannot supply the authorization checks connected with the transaction with data.

Example

The following graphic shows how the Portal definition of a role is assigned to the SAP system:

In the SAP system, transaction WP3R currently only accepts R/3 transactions for authorization roles. BEx Web applications, URL’s, MiniApps, and so on are not created.

Reason: The authorization role is only used to create authorizations with proposed authorization values. SAP only provides these proposed values for transactions. All other objects are ignored.