Show TOC

5.11 Remote SystemsLocate this document in the navigation structure


For some applications, you need to be able to define whether, although the role is defined locally, specific entries or all entries in one role can be executed in a foreign system.


SAP supports this leading system and the side-by-side scenario with some restrictions, but does not recommend to implement a hub scenario. For more information about the definition of the scenarios as well as the restrictions of working with remote systems, see SAP Note 1795171 Information published on SAP site.


There must be a trusted relationship between the relevant systems. To ensure that the same user is used in the target system, the only RFC destinations that are allowed are those created using the trusted system concept.

You can configure a target system for each menu entry. If the Target System field is blank, as is usually the case, the same destination is used. The transactions are started in the same system in which the user is logged on. If, however, the Target System field is filled with an RFC destination, the menu entries from a role of the system specified through the RFC destination are used for your role.

Note that instead of specifying RFC destinations using transaction SM59, you can also specify a variable that references an RFC destination. Variables are assigned to RFC destinations using transaction SM30_SSM_RFC.

  • For the complete role , enter the RFC destination in the Target System field. If you leave this field blank No destination is displayed. The concept described above is shown in the following figure:

    No RFC destination

  • For individual role entries from another system, leave the upper Target System field blank and navigate to the role menu folder or node. Then enter the RFC destination for this folder or node on the side of the screen in the area Other Node Details in the Target System field.

    The activity described above is shown in the following figure:

    RFC destination field for individual role entries


    You can edit or change a node entry in the navigation tree only if there are no entries within the tree for which a target system is specified.

    If there is neither a target remote transaction nor a Web Dynpro application in the local system, you cannot add it directly to the PFCG role or change it directly. Instead, you need to insert it to a role of the target system and import it by choosing Start of the navigation path Copy Menus Next navigation step From Another Role Next navigation step Target System End of the navigation path. If you change a remote transaction or Web Dynpro application, you need to re-import it. As a prerequisite, a PFCG role with the transaction or Web Dynpro application must be maintained in the target system. We recommend that you choose the PFCG role that is assigned to the user in the remote system. After the import, the Target System field is automatically filled with the RFC Destinations (Display/Maintain) ( SM59) transaction connection being used.

Target System Names

The system names must be the same as specified in transaction SM59. For more information, see Displaying, Maintaining, and Testing Destinations .

However, SM59 aliases are only of one specific type. It is not possible to define both SAP GUI and HTTP connections under one alias. This could be necessary in cases where either an SAP GUI or Web GUI entry is needed for the same transaction. The current approach is to have multiple SM59 entries that have the same (base) name with an extension ( _RFC, _HTTP, _HTTPS) attached to it to distinguish between the different types of connections. For example, if the system name is XYZ, the different destination names should be the following:

  • SM59 name resolving sequence for SAP GUI aliases: XYZ_RFC, XYZ

  • SM59 name resolving sequence for HTTP aliases: XYZ_HTTPS, XYZ_HTTP, XYZ


The SM59 alias name that you enter in the Target System field can be of any of these XYZ_* sequences; however, XYZ is recommended. At runtime, all possible name variations are tested to find the most matching name to the connection type that is required.

You can also configure proxy data for the _HTTP and _HTTPS entries within transaction SM59. If an HTTP proxy is detected in the network (the incoming HTTP request contains the Web Dispatcher HTTP header x-sap-webdisp-ap that describes the proxy access points), the proxy configured data is used to construct a URL instead of the configured host and port.


In addition to - at least - one RFC destination of type 3 (ABAP connection), you need at least one corresponding RFC connection of type H (HTTP connection).

Role Import from Remote System

If the transactions you want to use in your role are not all available locally, the recommended approach is to first define a role in the remote system that contains all relevant transactions and then to import the role into the system where it is required. For this, you choose Start of the navigation path Copy Menus Next navigation step From Other Role Next navigation step Target System End of the navigation path.

The following example uses an ERP and a CRM system. In one system called Q0M, the user is assigned to role ZSHELL_ROLE in PFCG.

To transfer this role to another system, for example Q00, maintain some RFC destinations in transaction SM59. In your home system, for example Q00, define the following RFC destinations:

  • An ABAP connection (Type 3) to Q0M system for the PFCG role import.

    RFC Destination




  • HTTP or HTTPS connections ( Type H) to Q0M for the NWBC server runtime:

    RFC Destination






    NWBC needs the HTTP or HTTPS destinations to build URLs.

To import the role from system Q0M into Q00, proceed as follows:

  1. Log on to system Q00.

  2. In transaction PFCG, enter your role and switch to the Menu tab page.

  3. Choose Start of the navigation path Copy Menus Next navigation step From Other Role Next navigation step In Remote System End of the navigation path.

  4. You can enter either an RFC destination or a variable that points to an RFC destination as target system. In this example, choose Select RFC Destination and then Continue (Enter) .

  5. In the following table, select the entry for RFC destination Q0MCLNT558 and choose Copy . A list of all available roles in Q0M is displayed.

  6. Select ZSHELL_ROLE and choose Copy . The menu tree of ZSHELL_ROLE is displayed.

  7. To choose those transactions from the ZSHELL_ROLE menu that you want to import into Q00, select the checkboxes in front of the relevant role entries. Then add the selected menu nodes by choosing Add . The role menu tree in Q00 is updated automatically with the entries you selected. The selected checkboxes next to the imported menu items indicate that these menu entries belong to a separate target system. In addition, the Target System field is automatically filled with the RFC destination for Q0M.

    The concept described above is shown in the following figure:

    Example of Imported Role Entries

More Information