Creating Derived Roles and Copying Authorizations 

Use

There are two possible reasons for deriving a role from an existing role:

●      The role menus are identical but the authorizations for the menu actions are different in the derived role.

●      The menu and authorizations of the derived role are identical, but the organizational levels are different in the derived role.

Prerequisites

Roles derived from another cannot have any additional menu entries.

Deriving a Role from Another Role

...

       1.      Create a role.

       2.      Enter a role description text.

       3.      Enter the name of the role from which all transactions including the menu structure are to be copied in the Derive from role field in the Description tab page.

       4.      Save your entries to create a role whose menu was derived from another role.

If additional transaction codes are added to the menu of the original role, they are copied into the derived role.

Copying the Authorizations of the Original Role to the Derived Role

...

       1.      Change the original role from which the authorizations are to be derived, in the role administration tool. Choose the Authorizations tab and the Change authorization data button.

       2.      Choose Authorizations ® Adjust Derived ® Generate Derived Roles.

The authorization data is copied to the derived roles.

The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).

More Information

To delete the inheritance relationship between two roles, choose the Delete inheritance relationship pushbutton in the Description tab.

You can display an overview of the inheritance of roles by choosing Role ® Where-used list. You can go to another role by double-click.

You cannot derive functions from the delivered user roles in your own roles.

 

See also:

Authorization Checks When Deriving Roles