Ansicht
Dokumentation
03053 - Assigning authorities under PFCG versus SU01
RFUMSV00 - Advance Return for Tax on Sales/Purchases General Data in Customer MasterThis documentation is copyright by SAP AG.
Assigning authorities under PFCG versus SU01
Hello Jerry.Currently, our local help desks assign roles via SU01 in our 4.6C system.
We still generate the roles from PFCG.
Each time a role is created/changed in our configuration client, we create a
transport and move it thru our landscape. Once the transport is in each
system, we do a Mass Generate and a Mass User Compare if the transport
occurrs during productive hours. The Mass generate re-generates any profiles
that need to be generated and the User comapare checks all usrids to see if
any should have the role and assigns it to them.
I'm not sure if assigning user id's thru PFCG is the correct way or not,
just that we don't have any problems using SU01.
There are 2 security classes that I know of, CA940 and BC940. The CA class
is Security Authorizations and the BC class is suppose to be the same except
it is technical in nature (Basis).
Good luck!
Chris
-----Original Message-----
From: Jerry Cummins [mailto:jcumminsZf...]
Sent: Monday, August 27, 2001 7:49 AM
To: DoNotReply@consolut.eu
Subject: Assigning authorities under PFCG versus SU01
We went to SAP 3 years ago to 31H. During my absence because of
schooling a basis consultant was assigned to our installation
project, and he set up a few users and authorities up by assigning
the users to an activity group. After only a week or so, another
consultant who stayed with the project much longer did this by using
PFCG to generate a profile, then attaching the profile to the user
via SU01. We did not use any of the standard SAP activity groups.
We constructed our own. After classes I worked with only the second
consultant and I proceeded to assign authorities in the manner he had
established. After he rolled off the project, I discovered the few
users setup under PFCG. I know there is a note that says this is the
incorrect way of doing this, don't recall the note offhand, but
for two reasons, I switched everything over to assigning the profiles
under SU01. First I only had a few users that had been assigned to
activity groups, and secondly, any change to the activity group,
obviously results in a transport. We have users in DEV with
different profiles attached in PRD. The transport implied you were
going to have the same assignment in DEV and in PRD for users
attached to that activity group. (I did not fully test that.)
I knew someday I needed to straighten this out, and with a test
install of 46C, it appears the changes in 46C will force us to
change. Questions:
1. If SAP wants us to assign the user under PFCG, and if this is
part of the transport of the activity group, roles as 46C calls it,
how do I give the same user different access in DEV than from PRD.
2. When I set up a new user, my logical thought process is I add the
user then assign to the user the access the id needs. I have ONE
user that may have MANY activities/roles assigned. I accomplish this
under one screen in SU01. By using PFCG to assign a user to a role,
I must go to MANY `roles' to assign the ONE user. In effect
it seems
to make the establishment of a user and the authorities that user
requires ... backwards for lack of a different term, and at best
considerable more clumsy. What am I missing in my thought process on
this?
For the 46C upgrade, I will be taking the delta basis class from 3.x
to 4.6. Are there other courses that are appropriate for 4.6 that I
should take?
To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com
Your use of consolut is subject to http://www.consolut.net
Durban Tours - Südafrika Safari
BAL Application Log Documentation CPI1466 during Backup
This documentation is copyright by SAP AG.
Length: 4627 Date: 20240418 Time: 201310 sap01-206 ( 2 ms )
