SAP User Profiles, Roles and Authorizations

SAP User Profiles, Roles and Authorizations

The SAP roles and authorizations are managed by the security team or BASIS team. It is a combined effort of the function of consultant and security team.
This helps to provide authority:

• People who are keen to learn Production Planning.
• People who are keen to learn Supply Chain Management.



Roles are created and attached to a user.

---

When does the authorization concept arise?

When we get an authorization error, the BASIS person will ask for a screenshot of your screen, so you should have got the SU53 T code here we can see the error. So he will insert the authorization value in that authorization object.

Difference between authorization and Authentication.

• Authorization means permission the execute activities in the system. [Inside System]
• Authentication means identity check for e.g.:
• Authorization varies from person to person, Ex: HR, PP, PM module all the person will differ from module to do different activities.
• Each department will do different activities working on their respective modules
• Object class reveals the area of Authorization Objects.


In SU21, we can see many objects that give access to many activities according to the module.
For every T code, there are some authorization objects related to it.
Following is the structure:

---

Important T codes used:

Role: It is used to choose a menu and create the corresponding authorization profile. After this, a role can be assigned to users. Use PFCG T code to create roles.

There is naming convention in creating role:
X_HR_PERSONNEL_ADMIN_BMW
Role Type _Business Process Module_Subprocess_Extra Info_Company Name.

---

Types of Roles:

1. Single Role: It contains all transaction codes with required authorization object and values.
2. Master Role: It contains all transaction codes with req. authorization object but some values will not be maintained.
3. Derived Role: It contains all transaction code with required authorization object and specific values will be maintained.
4. Composite Role: Set of a single role. This role simplifies user administration.

Below are screenshots observed while creating the role:


Then go to the authorization tab,

Now, click on the generate icon and the profile name screen will pop up automatically and save it.
Here, profiles are of two types:

1. Standard: It comes along and the installation can be assigned directly to the user.
2. Generated: They are the ones we generate while setting authorizations.

SAP recommends, never assigning a standard profile to user because it gives extra access.
Hence we assign roles to a user which in turn assigns profiles to generate users.
Generated profiles start with the alphabet “T”.
When you assign role profiles gets automatically assigned.
Only generated profiles will have roles associated with them, not standard profiles.
Now assign the created role to the User Id: Go to SU01 – Create User Id
First, create a user id and then assign role to user id.



Then go to logon tab, and set the password here.

Next step is to assign role and the profile will automatically reflect here.
Below screen shows that the we have added the role Z_ALL in the role column and press enter, now go to the profile tab it will show the profile name, which was attached to this role.

After configuring all these information’s, click on SAVE button above. We will get the message user created, as shown in the below screenshot.

Now log in with the new user id created:
User Id = B_TESTUSER
Password = BUSER123
In the below screenshot we can see the new user B_testuser has been created successfully.