03054 - Assigning authorities under PFCG versus SU01SUBST_MERGE_LIST - merge external lists to one complete list with #if... logic for R3up CPI1466 during Backup
This documentation is copyright by SAP AG.
Assigning authorities under PFCG versus SU01I found the note that I recall seeing. Note 171786. BUT after
reading this release 'independant' note, if I understand it
correctly, it is an error to attach PFCG generated profiles to a user
using SU01, but it is okay to attach the activity group. If you do
so, the user comparison will nuke the assignment. I can't find in
31H a way of attaching anything but a profile. In the test version
of 46C, it appears you can attach either profiles or roles (activity
groups). You appear to be handling this in 46C the same way we are
currently. Have you ever done the user comparison?
--- In SAP on System iZy..., "Sugg, Chris" <aacsuggZn...> wrote:
> Hello Jerry.
> Currently, our local help desks assign roles via SU01 in our 4.6C
> We still generate the roles from PFCG.
> Each time a role is created/changed in our configuration client, we
> transport and move it thru our landscape. Once the transport is in
> system, we do a Mass Generate and a Mass User Compare if the
> occurrs during productive hours. The Mass generate re-generates any
> that need to be generated and the User comapare checks all usrids
to see if
> any should have the role and assigns it to them.
> I'm not sure if assigning user id's thru PFCG is the correct way or
> just that we don't have any problems using SU01.
> There are 2 security classes that I know of, CA940 and BC940. The
> is Security Authorizations and the BC class is suppose to be the
> it is technical in nature (Basis).
> Good luck!
> -----Original Message-----
> From: Jerry Cummins [mailto:jcumminsZf...]
> Sent: Monday, August 27, 2001 7:49 AM
> To: SAP on System iZy...
> Subject: Assigning authorities under PFCG versus SU01
> We went to SAP 3 years ago to 31H. During my absence because of
> schooling a basis consultant was assigned to our installation
> project, and he set up a few users and authorities up by assigning
> the users to an activity group. After only a week or so, another
> consultant who stayed with the project much longer did this by
> PFCG to generate a profile, then attaching the profile to the user
> via SU01. We did not use any of the standard SAP activity groups.
> We constructed our own. After classes I worked with only the
> consultant and I proceeded to assign authorities in the manner he
> established. After he rolled off the project, I discovered the
> users setup under PFCG. I know there is a note that says this is
> incorrect way of doing this, don't recall the note offhand, but
> for two reasons, I switched everything over to assigning the
> under SU01. First I only had a few users that had been assigned
> activity groups, and secondly, any change to the activity group,
> obviously results in a transport. We have users in DEV with
> different profiles attached in PRD. The transport implied you
> going to have the same assignment in DEV and in PRD for users
> attached to that activity group. (I did not fully test that.)
> I knew someday I needed to straighten this out, and with a test
> install of 46C, it appears the changes in 46C will force us to
> change. Questions:
> 1. If SAP wants us to assign the user under PFCG, and if this is
> part of the transport of the activity group, roles as 46C calls
> how do I give the same user different access in DEV than from PRD.
> 2. When I set up a new user, my logical thought process is I add
> user then assign to the user the access the id needs. I have ONE
> user that may have MANY activities/roles assigned. I accomplish
> under one screen in SU01. By using PFCG to assign a user to a
> I must go to MANY `roles' to assign the ONE user. In effect
> it seems
> to make the establishment of a user and the authorities that user
> requires ... backwards for lack of a different term, and at best
> considerable more clumsy. What am I missing in my thought process
> For the 46C upgrade, I will be taking the delta basis class from
> to 4.6. Are there other courses that are appropriate for 4.6 that
> should take?
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
> Your use of consolut is subject to
Durban Tours - Südafrika Safari
PERFORM Short Reference rdisp/max_wprun_time - Maximum work process run time
This documentation is copyright by SAP AG.
Length: 5503 Date: 20140310 Time: 125020 triton ( 17 ms )