Ansicht
Dokumentation
03060 - Assigning authorities under PFCG versus SU 01
Vendor Master (General Section) ROGBILLS - Synchronize billing plansThis documentation is copyright by SAP AG.
Assigning authorities under PFCG versus SU 01
Jerry,I know this sounds confusing. To answer your first question, when you
transport an activity group several pop-up windows appear. On one of them
there is a checkbox to transport user assignments. Make sure that the
checkbox is not checked. Do you see this checkbox in 4.6C? We're on 4.6B,
but I think it's the same.
To answer your second question, there are two ways to assign a user to an
activity group. The first is in PFCG in the users tab, just type the user
ID you want assigned. If you have to assign a large number of users to an
activity group this is the way to go (or use SU10 - mass maintenance). The
second is in SU01 in the activity group tab, type the activity group name
you want assigned. This is beneficial if you have many activity groups to
assign to one user. What SAP does not want you to use is the PROFILES tab
in SU01.
I hope this answers your questions.
**********************************
Diane Piccirello
Twin Laboratories Inc.
Corporate Office:
150 Motor Parkway, Suite 210
Hauppauge, NY 11788
Phone: 248.473.8511
Cell: 516.901.2646
Fax: 248.473.8512
Email: dpiccirelloZt...
-----Original Message-----
From: Jerry Cummins [mailto:jcumminsZf...]
Sent: Monday, August 27, 2001 11:21 AM
To: DoNotReply@consolut.eu
Subject: Re: Assigning authorities under PFCG versus SU
01
Diana - what you wrote makes sense, partially, but I have users in
DEV with profiles attached that were generated by PFCG. If I use
PFCG to assign, the user is transported, if I use SU01 I go against
the SAP standard. Is it true by using PFCG for the user assignments
that you are going to have a considerable greater number of screens
to navigate through to establish a user versus the old method, or am
I missing a process that I'm not aware of?
--- In SAP on System iZy..., Diane Piccirello <dpiccirelloZt...> wrote:
> Hi Jerry,
>
> Regarding assigning users in development, it is better not to
assign users
> to the activity group when you create it. Transport the activity
group
> throughout the domain without user assignments, then go into
production and
> assign the activity group to a user in SU01, or go to PFCG and
assign the
> user to an activity group. What you shouldn't do is assign the
profile in
> SU01. I was told that SAP does not support that anymore. They
want us to
> use activity groups and not profiles, the exceptions being SAP_ALL,
SAP_NEW,
> and X_REST for super users.
>
> Regards,
>
> **********************************
> Diane Piccirello
> Twin Laboratories Inc.
>
> Corporate Office:
> 150 Motor Parkway, Suite 210
> Hauppauge, NY 11788
>
> Phone: 248.473.8511
> Cell: 516.901.2646
> Fax: 248.473.8512
> Email: dpiccirelloZt...
>
>
> -----Original Message-----
> From: Sugg, Chris [mailto:aacsuggZn...]
> Sent: Monday, August 27, 2001 10:09 AM
> To: 'SAP on System iZy...'
> Subject: RE: Re: Assigning authorities under PFCG
versus
> SU 01
>
>
> Hey Jerry.
>
> Yes, we do a mass user compare and a mass generate.
>
> I have a job scheduled to run during our slowest system time to do
a user
> compare to clean up any differences between user ld's and roles.
Looking in
> PFCG at the User Tab, if you have any inconsistencies wit the role,
you will
> see a Yellow light until you do the User Compare.
>
> Chris
>
> -----Original Message-----
> From: Jerry Cummins [mailto:jcumminsZf...]
> Sent: Monday, August 27, 2001 9:49 AM
> To: SAP on System iZy...
> Subject: Re: Assigning authorities under PFCG versus
SU01
>
>
> I found the note that I recall seeing. Note 171786. BUT after
> reading this release 'independant' note, if I understand it
> correctly, it is an error to attach PFCG generated profiles to a
user
> using SU01, but it is okay to attach the activity group. If you
do
> so, the user comparison will nuke the assignment. I can't find in
> 31H a way of attaching anything but a profile. In the test version
> of 46C, it appears you can attach either profiles or roles
(activity
> groups). You appear to be handling this in 46C the same way we are
> currently. Have you ever done the user comparison?
>
> --- In SAP on System iZy..., "Sugg, Chris" <aacsuggZn...> wrote:
> > Hello Jerry.
> >
> > Currently, our local help desks assign roles via SU01 in our 4.6C
> system.
> > We still generate the roles from PFCG.
> >
> > Each time a role is created/changed in our configuration client,
we
> create a
> > transport and move it thru our landscape. Once the transport is
in
> each
> > system, we do a Mass Generate and a Mass User Compare if the
> transport
> > occurrs during productive hours. The Mass generate re-generates
any
> profiles
> > that need to be generated and the User comapare checks all usrids
> to see if
> > any should have the role and assigns it to them.
> >
> > I'm not sure if assigning user id's thru PFCG is the correct way
or
> not,
> > just that we don't have any problems using SU01.
> >
> > There are 2 security classes that I know of, CA940 and BC940.
The
> CA class
> > is Security Authorizations and the BC class is suppose to be the
> same except
> > it is technical in nature (Basis).
> >
> > Good luck!
> > Chris
> >
> >
> > -----Original Message-----
> > From: Jerry Cummins [mailto:jcumminsZf...]
> > Sent: Monday, August 27, 2001 7:49 AM
> > To: SAP on System iZy...
> > Subject: Assigning authorities under PFCG versus
SU01
> >
> >
> > We went to SAP 3 years ago to 31H. During my absence because of
> > schooling a basis consultant was assigned to our installation
> > project, and he set up a few users and authorities up by
assigning
> > the users to an activity group. After only a week or so, another
> > consultant who stayed with the project much longer did this by
> using
> > PFCG to generate a profile, then attaching the profile to the
user
> > via SU01. We did not use any of the standard SAP activity
groups.
> > We constructed our own. After classes I worked with only the
> second
> > consultant and I proceeded to assign authorities in the manner he
> had
> > established. After he rolled off the project, I discovered the
> few
> > users setup under PFCG. I know there is a note that says this is
> the
> > incorrect way of doing this, don't recall the note offhand, but
> > for two reasons, I switched everything over to assigning the
> profiles
> > under SU01. First I only had a few users that had been
assigned
> to
> > activity groups, and secondly, any change to the activity group,
> > obviously results in a transport. We have users in DEV with
> > different profiles attached in PRD. The transport implied you
> were
> > going to have the same assignment in DEV and in PRD for users
> > attached to that activity group. (I did not fully test that.)
> >
> > I knew someday I needed to straighten this out, and with a test
> > install of 46C, it appears the changes in 46C will force us to
> > change. Questions:
> > 1. If SAP wants us to assign the user under PFCG, and if this is
> > part of the transport of the activity group, roles as 46C calls
> it,
> > how do I give the same user different access in DEV than from PRD.
> > 2. When I set up a new user, my logical thought process is I add
> the
> > user then assign to the user the access the id needs. I have ONE
> > user that may have MANY activities/roles assigned. I accomplish
> this
> > under one screen in SU01. By using PFCG to assign a user to a
> role,
> > I must go to MANY `roles' to assign the ONE user. In effect
> > it seems
> > to make the establishment of a user and the authorities that user
> > requires ... backwards for lack of a different term, and at best
> > considerable more clumsy. What am I missing in my thought
process
> on
> > this?
> >
> > For the 46C upgrade, I will be taking the delta basis class from
> 3.x
> > to 4.6. Are there other courses that are appropriate for 4.6
that
> I
> > should take?
> >
> >
> >
> >
> > To unsubscribe from this group, send an email to:
> > SAP on System i-unsubscribeZegroups.com
> >
> >
> >
> > Your use of consolut is subject to
> http://www.consolut.net
>
>
>
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
>
>
>
> Your use of consolut is subject to
http://www.consolut.net
>
>
>
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
>
>
>
> Your use of consolut is subject to
http://www.consolut.net
To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com
Your use of consolut is subject to http://www.consolut.net
Durban Tours - Südafrika Safari
Vendor Master (General Section) BAL_S_LOG - Application Log: Log header data
This documentation is copyright by SAP AG.
Length: 11669 Date: 20240427 Time: 002236 sap01-206 ( 5 ms )
