Log in history of users using SAL
A high sense of responsibility
From a purely technical point of view, each generated authorization role contains a profile from which a user receives the actual authorization objects and authorization characteristics. If this profile is outdated or not assigned at all, the user will not have all the authorization objects contained in the authorization role. Incidentally, the problem arises particularly frequently after role transports: If an authorization role is changed in the development system and then transported to the production system, the current profile is not automatically assigned to the users with the respective role. A user comparison must therefore be performed here.
Especially in larger companies, which also have multiple locations in different countries, it is often necessary to grant different employees the same permissions for different levels of organisation, such as accounting circles. In order to make maintenance and maintenance of the system easy in such a situation, it is useful to set the inheritance principle for SAP permissions. How does SAP Permissions Inheritance work? An inheritance is always about a master object passing certain properties to a derived (sub) object. Therefore, these properties do not need to be maintained several times. Also, changes to the master object are passed directly to the derived objects. This allows easier maintenance and drastically minimises the error rate. In the case of SAP Permission Inheritance, the required permissions are bundled in a Upper or Master role. Only the organisational levels have to be maintained in the roles derived from them. The permissions are automatically pulled from the master role. Create Inheritance for SAP Permissions The following shows how to create and use inheritances for SAP permissions. This requires only two steps: Creating a master role and defining derived roles. Step 1: Create a master role Inheritance always requires a parent role, because all properties are inherited from it. If this role, in which all shared permissions are bundled, is missing, the first step is to create this master role. To do this, open the PFCG transaction and enter the desired name of the master role in the Name field. It is possible to identify master and derived roles by using naming conventions. The "Single Role" button will then be used to create the desired role. In the following example I create the master role "findepartment_r".
SAP technologies
In the area of SAP Basis it is necessary to make temporary changes in the security settings of the clients and systems in the course of system updates. You can use the system changeability variable to specify whether changeability of cross-client data, such as programs or menus, as well as client-independent customizing is allowed.
If you want to skip the backgrounds and prefer a direct step-by-step guide, you can jump directly into the last section. Preparation For this workaround, you need access to both the source system and the BW system. In addition, they shall have the possibility to access the SE37 and execute functional modules there. Especially in production systems this is a very critical justification. So assume that you may need a Firefighter user for this action. Working in the BW system Now that the preparations have been completed, you have to call a FuBa on the BW system and on the source system, which solves the connection on the respective page. Beginning on the BW system, go into the transaction SE37 and call the function block "RSAR_LOGICAL_SYSTEM_DELETE": RSAR_LOGICAL_SYSTEM_DELETE Enter the required values here. The following table helps you fill in: Field Description I_LOGSYS The logical name of the source system. The name of the source system, as found in RSA1, will be entered here. In addition, this name can also be found in the DB table TBDLT. I_FORCE_DELETE Boolean, X = Delete despite error messages I_NO_TRANSPORT Boolean, X = This change should not be transported to subsequent systems I_NO_AUTHORITY Boolean, X = Ignore Permission Checks Work in the source system In the source system, go to transaction SE37 and call the function block "RSAP_BIW_DISCONNECT" : The descriptions of the fields are as follows. These can be found in the RSBASIDOC source system connection table Field Description I_BIW_LOGSYS The logical name of the BW system. In the RSBASIDOC table, find the correct value in the column "RLOGSYS". I_OLTP_LOGSYS The logical name of the source system. The column ‘SLOGSYS’ in the table RSBASIDOC. I_FORCE_DELETE The logical name of the BW system. In the RSBASIDOC table, find the correct value in the column "RLOGSYS". Completion In the end, you have to call the respective function block in the BW and source system, fill in the parameters and execute the function block.
Some missing SAP basic functions in the standard are supplied by the PC application "Shortcut for SAP Systems".
Therefore, the chosen IT strategy must be chosen from this point of view with the lowest risk.
What steps are needed to exchange data between two systems? In this post, I'd like to show you how to configure your SAP system so that an order, after it has been released, is sent electronically to your supplier.