To be able to use the ESS applications (services), your employees require particular authorizations.
Each employee who is to use the ESS applications has a user in the SAP ECC system and a J2EE user. The user names must be the same.
To create the users in the SAP ECC system, you can use the HRUSER transaction (Set Up and Maintain ESS Users).
If you use the same client to manage J2EE users as the backend for the Employee Self-Service component, the system automatically creates the required J2EE users once you have created them in the SAP ECC system. If the client is not the same, you have to create the J2EE users manually.
For more information about the settings and authorization profiles for users, see SAP Note 677732.
...
1. Log on to the SAP ECC system.
2. Go to the PFCG transaction (Role Maintenance).
3. Create copies of the composite role SAP_EMPLOYEE_ERP and all the single roles contained in it. Work with the copies only.
4. Choose the authorization object S_SERVICE (check on start of external services) and enter the required services in the Program, Transaction, or Function Module Name field.
The service names must follow the naming convention <vendor>/<dc>/<Application>.
Example: sap.com/ess~us/Per_Address_US