User Management for SAP NetWeaver PI Standard Installation (PI)
Roles
In a standard installation of SAP NetWeaver PI (which is technically a dual-stack installation), users and roles are maintained in the user management of Application Server ABAP.
To make these
“ABAP roles” also available for the Java- based tools of SAP NetWeaver PI, they are propagated to user groups of the Java-based User Management Engine (UME). UME is accessible either by SAP NetWeaver Administrator or by calling the page
http://<host>:<port>
User Management 
directly.
“ABAP roles” are mapped 1:1 to corresponding UME groups.
UME user groups have the same names as the corresponding “ABAP roles” and also define the same permissions.
On the “Java side” , permissions are defined in the following way: Each UME user group is assigned exactly 1 UME role. A UME role is composed of a set of actions. These actions are the “atomic” sets of permissions assigned to basic applications.
More information:
Note that in UME you cannot define composite roles as in AS ABAP.
The concept of user management for a dual-stack installation is shown in the following figure:
User
After installation, a set of standard users is available.
For more information, see Standard User (Dual-Stack)