Predefined Profiles and Basis System Authorization Objects in Software

Encoder QR Code in Software Predefined Profiles and Basis System Authorization Objects

A newly installed SAP R/3 system includes hundreds of authorization objects, authorizations, and profiles which allow a virtually unlimited number of combinations for protecting the system against unauthorized access. To list the profiles of the system, from the main menu select Tools Administration User maintenance Profiles. Select the check box next to Active only and click on the Generate work area button to display the list of available active profiles. Some of these profiles are special, such as the SAP_ALL and the SAP_NEW. The SAP_ALL profile includes all the access privileges for the R/3 system and should be assigned only to superusers. The SAP_NEW profile includes all new access privileges which were added to system components of previous releases. SAP recommends adding the SAP_NEW profile to all user master records for compatibility reasons when performing R/3 upgrades. With the SAP_NEW, users can continue to use functions which were unprotected in earlier versions when access tests have been added in new releases. The following is a short list of system authorization profiles for common basis functions: S_A.SYSTEM. The superuser's profile for system administrators. It's a simple profile including all the authorizations for the basis system. This profile excludes authorizations for business applications; however, since users with this profile can create and assign authorization and profiles to users, it's virtually a fully privileged user. S_A.ADMIN. The profile for system operators. It includes less authorizations than the superusers. For example, they are not allowed to modify users belonging to the group SUPER. S_A.DEVELOP. The standard profile for privileged SAP developers. This profile does not allow users to perform any system administration functions except for those directly related with development. S_A.USER. The basic profile for normal end users. They have basic authorizations for working in the R/3 system. Many of the authorizations it contains allow users only to perform the display activity over functions. S_A.CUSTOMIZ. This profile can be assigned to end users and consultants who need to work with the customizing functions. S_A.TMSADM. This profile provides access to the transport management system functions and is used by the RFC user TMSADM. S_A.SHOW. This is a simple profile that provides display access to most basis functions. It is suitable for occasional users, visitors, or auditors.

The R/3 system includes some options to find the authorization for any transaction or function a user performs in the system. This is quite useful when looking for an authorization denial problem or when defining profiles when you want to specify exactly what authorization objects a particular transaction checks. The two methods available in R/3 for finding authorizations are the authorization check transaction (SU53) and using the system trace. The system trace is a more general purpose tool used mainly by developers or system administrators which can provide a great detail of information and can be used to trace other user sessions. Transaction SU53 is more specific for authorization error analysis but can only be used for the current user sessions. However, SU53 is a faster and more direct method for finding an authorization denial problem. Transaction SU53 can be accessed from the menu System Utilities Displ. auth. check.

The SAP system includes extensive tracing and debugging utilities. You can find more information about tracing in Chap. 10. This section covers just the simple process of activating and displaying a trace concerning authorization checks. To start the system trace, from the main menu select Tools Administration Monitor Traces System trace. The system displays the initial tracing screen. From this screen, select Trace switch Switch, edit. The system displays the available trace options and switches, one of which is the authorization check. Make sure you mark the check box next to authorization check. In the Write options field, select the value write trace to disk. The system trace can be used for recording which are the authorization checks performed by the system using your own user ID or using other users' sessions. To limit the trace to your own user ID or another user ID, enter the name of the user ID you want to trace in the field General filter by clicking on the possible entries arrow and then selecting it from the list. To activate and start the tracing process, select Trace switch Editor save In active system from the menu. The trace will start recording every system function you or the entered user performs. So, if you are looking for an authorization problem or just want to find a particular authorization check, open a new session and go to the screen, function, or transaction you want to analyze. Once you are finished you should stop the system trace. Go back to the session where you activated the trace, and if you are on the tracing screen, stop the trace by selecting Trace switch Immediate switch Stop. Now you should look at the trace file generated. To display the trace, select Trace file Choose file, or simply Trace files Standard, from the menu. The system displays a list of traces. Position the cursor over the file to be displayed and click on Display file or Choose file. The trace file contains the authorization objects, authorization fields, and values that have been tested while you have been performing system functions. Authorization tests are displayed in the following format: 339

Using the SU53 Transaction <Authorization object>:<Field>=<Value tested>. But you can display a more legible view of the authorization check by clicking over the entry. Figure 9 25 shows an example of the trace file showing an authorization check for object M_MATE_ST.