User and Role Administration of Application Server ABAP
User and Role Administration of Application Server ABAP
Content
User and Role Administration of Application Server ABAP
ABAP Authorization Concept
Organizing Authorization Administration
Assigning Authorizations
From the Programmed Authorization Check to a Role
Editing Authorization Default Data (Development System)
Editing Authorization Default Data (Customer System)
Maintaining Authorizations in SAP Example Roles
Maintaining Authorizations in Roles for Productive Use
Trace for Authorization Checks
Maintaining Authorization Default Values Using Trace Evaluation in Transaction SU22 or SU24
Maintaining Authorization Fields Using Trace Evaluation in Transaction PFCG
Maintaining Role Menus Using Trace Evaluation in Transaction PFCG
Using the System Trace to Record Authorization Checks (Transaction STAUTHTRACE)
Glossary
ABAP Authorization Concept for CDS Entities
Configuration of User and Role Administration
First Installation Procedure
Setting Up User and Authorization Administrators
Configuring User Group as Required for User Master Records
Interaction of Required User Groups and Central User Administration
Enabling Movement Activity for S_USER_GRP
Setting Up the Role Administration Tool
Defining the Scope of Authorization Checks
Preparatory Steps
Globally Deactivating Authorization Checks
Reducing Authorization Checks in Applications
Searching for Deactivated Authority Checks
Editing Templates for General Authorizations
Check Indicators
Logon and Password Security in SAP NetWeaver Application Server ABAP
Implementation of Password and Logon Protection with Security Policies and Profile Parameters
Password Hash
Initial Password
Password Checks
Password Rules
Profile Parameters for Logon and Password (Login Parameters)
List of Customizing Switches for Generated Passwords
Security Policy Attributes for Logon and Passwords
Defining Security Policies
Rules for User Names
Protecting Special Users
Securing User SAP* Against Misuse
Securing User DDIC Against Misuse
Security in System Groups
Role Administration
Role Administration Functions
Changing Standard Roles
Creating Single Roles
Role Menu
Merge Function for the Authorization Data of PFCG Roles
Editing Predefined Authorizations
Symbols and Status Text in Authorization Administration
Copying Authorizations From Templates
Assign User
Assign MiniApps
Personalization Tab Page
Creating Derived Roles and Copying Authorizations
Authorization Checks when Adjusting Derived Roles
Comparing and Adjusting Role Menus
Creating Composite Roles
Generating Authorization Profiles
Regenerate the Authorization Profile Following Changes
Performing a Mass Generation of Profiles
Transporting Authorization Components
Transporting and Distributing Roles
Transporting Manually-Created Profiles
Transporting Manually-Created Authorizations
Transporting Check Indicators and Field Values
Loading or Storing Check Indicators and Authorization Default Values
Transporting Templates
Analyzing Authorization Checks
Analyzing Authorizations Using the System Trace
Authorization Error Analysis Functions
Indirect Role Assignment Using Organizational Management (OM)
Assigning a Role Indirectly
Indirect Role Assignment in a System Landscape
Distribution of the Organizational Management Model
Creating an Organizational Management Distribution Model in the Sending System
Generating Partner Profiles of the OM Distribution Model
Creating an Outbound Filter with Customer Exit
Activating Change Pointers
Writing Change Pointers for Infotype 0105
Distributing the Organizational Management Model (Initial Distribution)
Distributing Changes to the Organizational Management Model
Central User Administration
Setting Up Central User Administration
Creating an Administration User
Setting Up Logical Systems
Defining/Setting Up a Logical System
Assigning a Logical System to a Client
System Users and RFC Destinations
Defining Authorizations for System Users
Determining Existing RFC Destinations and System Users
Creating System Users
Creating an RFC Destination for the Target System
System Users and RFC Destinations with Trusted Systems
Creating RFC Destinations for the Target System with a Trusted System
Advantages and Disadvantages of Trusted RFC Destinations
Creating the Central User Administration
Checking Creation of the Central User Administration
Set Up Field Distribution Parameters
Synchronizing and Distributing Company Addresses
Synchronizing User Groups
Transferring Users from New Systems
Displaying and Processing Distribution Logs
Error Analysis in Central User Administration
Checking the Setup of Central User Administration
Avoiding Termination when Saving the System Landscape
Creating an ALE Model Including Partner Profiles Manually
Creating the ALE Distribution Model
Generating Partner Profiles
Checking Partner Profiles
Correcting Errors in Partner Profiles
Distributing the Model View
Other Error Sources
Activated Background Processing
Changing Partner Profiles with Active Background Processing
Creating a Background User
Removing Central User Administration
Removing a Child System from Central User Administration
Removing Central User Administration Completely
Glossary
Application Link Enabling (ALE)
ALE Landscape
ALE Integrated System
User Master Record
Authorization
Authorization Profile
Background Processing
IDoc
System User
Logical System
Partner Profile
Profile
Profile Generator
Remote Function Call (RFC)
Role
Child System
Distribution Model
Central User Administration (CUA)
Central System
DBMS User Management
Configuring DBMS User Management for SAP HANA
Central Repository for Personalization Data
Using the Generic Storage Table
Implementing a Dialog
Integrating External Tables
Registering Personalization Objects
Directory Services
LDAP Connector
Maintaining the Directory Server
Configuring the LDAP Connector
Configuring Connection Data for the Directory Service
Defining the System User of the Directory Service
LDAP Connector Interface
Logging On to the Directory Service
Calling LDAP Protocol Functions
Synchronization of SAP User Administration with an LDAP-Compatible Directory Service
Mapping SAP Data Fields to Directory Attributes
Mapping and Synchronization Process
Schema Extension
Generating a Schema Extension
Mapping SAP Data Fields to Directory Attributes
Mapping with a Function Module (Linking Type)
Mapping Indicator Versus Synchronization Indicator
Setting Mapping Indicators
Setting Synchronization Indicators
Preparing and Starting Synchronization
Synchronization Report RSLDAPSYNC_USER: Examples
Administering the Synchronization Log
Checking for Changes in Authorizations After Upgrades
Generated Role SAP_NEW
Migrating Report Trees
Customizing Scenario-Based Authorizations
Scenario-Based Authorization Checks
Transporting Productive Scenarios to Follow-On Systems
Saving Scenarios to the Local File System
Uploading Productive Scenarios to SAP NetWeaver Application Server for ABAP
Checking the Consistency of Productive Scenarios
Displaying an Overview of Scenarios
Administration of Users and Roles
User Administration
User Administration Functions
Creating and Editing User Master Records
Documentation Tab
Logon Data Tab
Password Status
Assigning Security Policies to Users
DBMS Tab
SNC Tab Page
Roles Tab Page
Profiles Tab
Groups Tab Page
Personalization Tab Page
Licence Data Tab Page
Copying Users
Personalizing Users or Roles
Changing the Standard Company Address
Assigning Roles
Assign a Standard Role to a User
Documenting Users
Documenting Changes to Users
Deleting User Change Documentation
Mass Changes
Logging Off Inactive Users
Editing User Defaults and Options
Comparing User Master Records
Creating and Editing Internet Users
User Administration with DBMS User Management
Changes in Behavior When DBMS User Management Is Active
Password Management with DBMS User Management
SSO Options with DBMS User Management
Constraints in DBMS User Management
Removing Inconsistent Mappings in DBMS User Management
Mass Maintenance with DBMS User Management
Maintaining User Mappings of Many DBMS Users
Maintaining Role Assignments for Many DBMS Users
Maintaining Additional Attributes for Many DBMS Users
Maintaining Authentication Methods for Many DBMS Users
Operating Central User Administration
User Administration with Active Central User Administration
Assigning Passwords with Active Central User Administration
Sending User Master Data to a Child System
Performing a Text Comparison with Target System Specification
User Information System
Reports for Evaluating Users
Evaluating Users Across Systems
Evaluating Users by Address Data
Evaluating Users by Complex Selection Criteria
Evaluating Users by Local License Data
Finding Users Who Are Locked Due to Failed Logon Attempts
Evaluating Users by Logon Date and Password Change
Evaluating Users or Roles with Critical Authorizations
Reports for Evaluating Roles
Evaluating Roles by Complex Selection Criteria
Evaluating Single Roles by Authorization Data
Evaluating Profiles by Complex Selection Criteria
Evaluating Authorizations by Complex Selection Criteria
Evaluating Authorization Objects by Complex Selection Criteria
Evaluating Transactions
Comparing Users, Authorizations, Roles, and Profiles Cross-System
Creating Where-Used Lists in the User Information System
Evaluating Change Documents
Troubleshooting
Cleaning Up User Tables
Reference Documentation for User and Role Administration
Authorization Objects Checked in Role Administration
Viewing the System Documentation for Authorization Objects
Role Administration: Example
Role Administration: Tips and Tricks
Creating Roles
Organization Without the Profile Generator
Creating and Maintaining Authorizations and Profiles Manually
Line-Oriented Authorizations
Administration Tasks
Maintaining Authorization Profiles
Simple and Composite Profiles
Defining Profiles and Authorizations
Alternative Authorizations
Choosing Authorization Objects
Maintaining Composite Profiles
Activate Profiles
Naming Convention for Predefined Profiles
Maintaining Authorizations and Their Values
Special Authorizations Requiring Protective Measures
Authorization Profile SAP_ALL
Generated Role SAP_APP
Developer Documentation for User and Role Administration
Authorization Checks
Authorization Checks in Your Own Developments
Creating Authorization Fields
Assigning Authorization Objects to Object Classes
Programming Authorization Checks
Programmatically Checking Passwords Against the Password Rules
Performing Authorization Checks Based on Scenarios
Creating Scenario Definitions for Authorization Checks
Creating Productive Scenarios for Testing
Automatically Adding Authorization Objects to Scenarios
Manually Adding Authorization Objects to Scenarios
Transporting Scenarios Definitions
Switchable Authorization Check Framework Overview
Authorizations Required For Scenario-Based Authorizations