Authorizations for Background Processing (SAP Library

Authorizations for Background Processing

Definition

Authorizations for accessing background processing jobs can be set up for two types of users: administrators and end users.

Give administrator authorization only to a small number of trustworthy employees. This level of authorization allows a user to:

Have unrestricted access to background processing jobs
Perform any operation on any job, including:

Selecting jobs from all clients (from the Job Overview, Transaction SM37)

Deleting any job

Releasing jobs to start

Changing jobs, including copying, canceling, checking, repeating, and capturing and debugging.

Displaying jobs, job steps, and job logs

Triggering events manually (Transaction SM64)

Editing system events

Using restricted job classes A or B

Scheduling an external program in a job.

Maintaining SAP definitions for external commands

All users can schedule, cancel, delete, and check the status of their own jobs with no additional special authorizations. By default, a job runs under the authorizations of the user who scheduled it. Special user-level authorizations are needed for:

Any operation on a job scheduled by another user

Displaying the job log

Displaying a spool request generated by a background job

Releasing a job to start

Using an external command

A user’s jobs are defined and run in the user’s current logon client, regardless of whether the user’s background processing authorizations are set for user or for administrator.

Setting Up Authorizations

Administrator authorization setup requires the following authorization objects:

Authorization Object	Value
S_BTCH_ADM (Batch Processing: Batch Administrator) Allows all of the activities listed above except for maintaining external command definitions. No default profile with ONLY this authorization is currently shipped with SAP, but the standard SAP_ALL profile contains this authorization.	Y
S_RZL_ADM (CC Control Center: System Administration) Allows an administrator to maintain external command definitions and to trigger commands from the external command function (Transactions SM49 and SM69).	01
S_BTCH_JOB (Batch Processing: Operations on Batch Jobs) Allows an administrator to view job-generated spool requests. To protect sensitive data, this authorization is not included in the standard administrator authorization.	LIST
S_DEVELOP (ABAP Workbench) Allows an administrator to capture and debug background jobs by providing access to ABAP debugging tools

User authorization setup beyond job scheduling and status checking requires the following authorization objects:

Authorization Object	Value(s)
S_BTCH_JOB (Batch Processing: Operations on Batch Jobs) Allows all of the activities listed above except for maintaining external command definitions. No default profile with ONLY this authorization is currently shipped with SAP, but the standard SAP_ALL profile contains this authorization.	DELE (delete other users’ jobs) LIST (display spool requests) PLAN (copy other users’ jobs) PROT (display anyone’s job log) SHOW (display job details) RELE (release other users’ jobs to start; a user’s own jobs are automatically released when scheduled.)
S_BTCH_NAM (Batch Processing: Batch User) Allows a user to specify other users for runtime authorization for a job.	permissible users
S_LOG_COM (Authorization to Execute Logical Operating System Commands) Allows a user to run external commands.
S_ADMI_FCD (System Authorizations) For special functions, such as debugging active jobs.

For complete information, see authorization object documentation from Transaction SU21.