03054 - Assigning authorities under PFCG versus SU01

BAL Application Log Documentation   General Data in Customer Master  
This documentation is copyright by SAP AG.
SAP E-Book

Assigning authorities under PFCG versus SU01

I found the note that I recall seeing. Note 171786. BUT after
reading this release 'independant' note, if I understand it
correctly, it is an error to attach PFCG generated profiles to a user
using SU01, but it is okay to attach the activity group. If you do
so, the user comparison will nuke the assignment. I can't find in
31H a way of attaching anything but a profile. In the test version
of 46C, it appears you can attach either profiles or roles (activity
groups). You appear to be handling this in 46C the same way we are
currently. Have you ever done the user comparison?

--- In SAP on System iZy..., "Sugg, Chris" <aacsuggZn...> wrote:
> Hello Jerry.
>
> Currently, our local help desks assign roles via SU01 in our 4.6C
system.
> We still generate the roles from PFCG.
>
> Each time a role is created/changed in our configuration client, we
create a
> transport and move it thru our landscape. Once the transport is in
each
> system, we do a Mass Generate and a Mass User Compare if the
transport
> occurrs during productive hours. The Mass generate re-generates any
profiles
> that need to be generated and the User comapare checks all usrids
to see if
> any should have the role and assigns it to them.
>
> I'm not sure if assigning user id's thru PFCG is the correct way or
not,
> just that we don't have any problems using SU01.
>
> There are 2 security classes that I know of, CA940 and BC940. The
CA class
> is Security Authorizations and the BC class is suppose to be the
same except
> it is technical in nature (Basis).
>
> Good luck!
> Chris
>
>
> -----Original Message-----
> From: Jerry Cummins [mailto:jcumminsZf...]
> Sent: Monday, August 27, 2001 7:49 AM
> To: SAP on System iZy...
> Subject: Assigning authorities under PFCG versus SU01
>
>
> We went to SAP 3 years ago to 31H. During my absence because of
> schooling a basis consultant was assigned to our installation
> project, and he set up a few users and authorities up by assigning
> the users to an activity group. After only a week or so, another
> consultant who stayed with the project much longer did this by
using
> PFCG to generate a profile, then attaching the profile to the user
> via SU01. We did not use any of the standard SAP activity groups.
> We constructed our own. After classes I worked with only the
second
> consultant and I proceeded to assign authorities in the manner he
had
> established. After he rolled off the project, I discovered the
few
> users setup under PFCG. I know there is a note that says this is
the
> incorrect way of doing this, don't recall the note offhand, but
> for two reasons, I switched everything over to assigning the
profiles
> under SU01. First I only had a few users that had been assigned
to
> activity groups, and secondly, any change to the activity group,
> obviously results in a transport. We have users in DEV with
> different profiles attached in PRD. The transport implied you
were
> going to have the same assignment in DEV and in PRD for users
> attached to that activity group. (I did not fully test that.)
>
> I knew someday I needed to straighten this out, and with a test
> install of 46C, it appears the changes in 46C will force us to
> change. Questions:
> 1. If SAP wants us to assign the user under PFCG, and if this is
> part of the transport of the activity group, roles as 46C calls
it,
> how do I give the same user different access in DEV than from PRD.
> 2. When I set up a new user, my logical thought process is I add
the
> user then assign to the user the access the id needs. I have ONE
> user that may have MANY activities/roles assigned. I accomplish
this
> under one screen in SU01. By using PFCG to assign a user to a
role,
> I must go to MANY `roles' to assign the ONE user. In effect
> it seems
> to make the establishment of a user and the authorities that user
> requires ... backwards for lack of a different term, and at best
> considerable more clumsy. What am I missing in my thought process
on
> this?
>
> For the 46C upgrade, I will be taking the delta basis class from
3.x
> to 4.6. Are there other courses that are appropriate for 4.6 that
I
> should take?
>
>
>
>
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
>
>
>
> Your use of consolut is subject to
http://www.consolut.net


Durban Tours - Südafrika Safari

BAL_S_LOG - Application Log: Log header data   CL_GUI_FRONTEND_SERVICES - Frontend Services  
This documentation is copyright by SAP AG.


Length: 5503 Date: 20140725 Time: 223427     sap01-206 ( 11 ms )

consolut Transport Check

The consolut Transport Check is a simple and reliable tool that helps you identify dependencies between transport orders.

consolut Transport Check