TRANSPARENCY ON SAP basis ROLES
ST05 SQL Trace
Only one transaction code can be entered here, otherwise a single role would always be searched, which includes all transactions searched for and is assigned to the respective user. However, since the transactions can also be assigned to the user via different roles, this would not be useful. If you use the above Input variants are also only considered transactions that have been maintained in the role menu. If it is not certain whether the transaction was entered in the menu or in the S_TCODE privilege object of the role, up to four transactions can also be checked by searching through the S_TCODE permission object. Important is the attention and appropriate use of the AND/OR relationship. After the query is executed, the roles that contain the requested transaction and are associated with the user are now displayed. If you use the search through the S_TCODE permission object, the following result page appears. When looking at the result, in addition to limiting the number of transactions that can be entered, another drawback of this variant becomes apparent: Although both associated roles are displayed, at first glance it is not possible to see which transaction is contained in which role. To do this, the roles would have to be considered individually. If more transactions with user assignment are to be identified at the same time and the role assignment is to be seen directly, the use of the transaction SE16N is recommended.
He has already gathered a lot of helpful information from the day-to-day business in his department: Johannes knows the RFC interfaces and the corresponding technical RFC users from his work with the applications. He also quickly got the password for various RFC users via the radio ("As long as passwords are only communicated by phone and never exchanged in writing, we are clean!"). And that the RFC users are generously entitled even in productive systems is no longer a secret ("Better to have more permissions than too little; the RFC connections have to run, otherwise there is trouble from the specialist areas!"). Since Johannes has access to the SE37 as a developer, it is not a problem to get the necessary access using the function block BAPI_USER_CHANGE - disguised as RFC User. In short, it changes the user type of a technical RFC user in a production system from to by calling the function block.
Administration SAP & SAP HANA
In order to escape the checks carried out by the iris scanners and ultimately his own arrest, a doctor illegally reuses his eyes and acts under a new identity. With the help of the new eyes he finally succeeds in entering the secured area of the "Precogs" and he can begin his investigation. Through this "biohacking" he not only deceives the biometric security systems - he compromises the highest police control system. All stories!? "Great stories!" think now. But: No one will ever fall for a simple trim. And anyway: Biometric security systems and eye transplantation? It's not for nothing a science fiction movie! What does this have to do with RFC security? All right, I can understand your doubts. But how do you like the following story, for example? RFC Security and the Art of Identity Change Germany, everywhere, 2017: Johannes Voigt has been a medium-sized company employee for several years. He is considered a reliable and conscientious developer from the IT department. In fact, he is increasingly unfairly treated. He decides that he no longer wants to carry his frustration with him.
Each SAP Basis system must be controlled and managed by an administrator. This person is responsible for the smooth operation of the system. This can be an internal administrator or it can be handed over to external service providers.
"Shortcut for SAP Systems" makes it easier and quicker to complete a number of SAP basis tasks.
If you want to use Ansible to implement simple automations - for example, starting and stopping SAP environments - you have to put up with a lot of manual effort and complicated scripts.
There is more to this database layer than just the working data.