Ansicht
Dokumentation

03064 - Assigning authorities under PFCG versus SU 01

03064 - Assigning authorities under PFCG versus SU 01

ABAP Short Reference   Vendor Master (General Section)  
This documentation is copyright by SAP AG.
SAP E-Book

Assigning authorities under PFCG versus SU 01

Dear Colleagues,
I just joined this group. I'm from Istanbul.
I'm a IS-U,SD and CRM consultant.
Are there any IS-U consultant?
Regards

Musa ZORBOZAN



From: "Hill, John" <jhillZs...>
Reply-To: DoNotReply@consolut.eu
To: "'DoNotReply@consolut.eu'" <DoNotReply@consolut.eu>
Subject: RE: Re: Assigning authorities under PFCG versus SU
01
Date: Mon, 27 Aug 2001 13:30:11 -0400

We actually set it up when we started with our development environment. It
was no big deal. As you add your QA and PRD environment you have to
configure those systems and redistribute your configuration. This also gives
you time to understand all of the little tricks involved with CUM. We
refresh our QA environment from Production periodically and then you have to
reconcile your QA user assignments but that is not a big thing. Just write a
CATT to lock your production users that do not do QA testing. Then write a
CATT in your DEV Central Client to change and then save the users in SU01.
When it saves it reassigns the Act Grps in QA. One thing to remember in this
case, you have to promote your QA Act Grps to production so that when you
copy PRD to QA the QA Act Grps come with it.

-----Original Message-----
From: Diane Piccirello [mailto:dpiccirelloZt...]
Sent: Monday, August 27, 2001 12:18 PM
To: 'DoNotReply@consolut.eu'
Subject: RE: Re: Assigning authorities under PFCG versus
SU 01


Hi John,

We were advised not to set that up until we went live. There are some
decisions that have to be made that may be clearer after GoLive. What do
you think?

**********************************
Diane Piccirello
Twin Laboratories Inc.

Corporate Office:
150 Motor Parkway, Suite 210
Hauppauge, NY 11788

Phone: 248.473.8511
Cell: 516.901.2646
Fax: 248.473.8512
Email: dpiccirelloZt...


-----Original Message-----
From: Hill, John [mailto:jhillZs...]
Sent: Monday, August 27, 2001 11:55 AM
To: 'DoNotReply@consolut.eu'
Subject: RE: Re: Assigning authorities under PFCG versus
SU 01


Jerry, have you considered using Central User management. This will take
care of your concerns.

-----Original Message-----
From: Jerry Cummins [mailto:jcumminsZf...]
Sent: Monday, August 27, 2001 11:21 AM
To: DoNotReply@consolut.eu
Subject: Re: Assigning authorities under PFCG versus SU
01


Diana - what you wrote makes sense, partially, but I have users in
DEV with profiles attached that were generated by PFCG. If I use
PFCG to assign, the user is transported, if I use SU01 I go against
the SAP standard. Is it true by using PFCG for the user assignments
that you are going to have a considerable greater number of screens
to navigate through to establish a user versus the old method, or am
I missing a process that I'm not aware of?


--- In SAP on System iZy..., Diane Piccirello <dpiccirelloZt...> wrote:
> Hi Jerry,
>
> Regarding assigning users in development, it is better not to
assign users
> to the activity group when you create it. Transport the activity
group
> throughout the domain without user assignments, then go into
production and
> assign the activity group to a user in SU01, or go to PFCG and
assign the
> user to an activity group. What you shouldn't do is assign the
profile in
> SU01. I was told that SAP does not support that anymore. They
want us to
> use activity groups and not profiles, the exceptions being SAP_ALL,
SAP_NEW,
> and X_REST for super users.
>
> Regards,
>
> **********************************
> Diane Piccirello
> Twin Laboratories Inc.
>
> Corporate Office:
> 150 Motor Parkway, Suite 210
> Hauppauge, NY 11788
>
> Phone: 248.473.8511
> Cell: 516.901.2646
> Fax: 248.473.8512
> Email: dpiccirelloZt...
>
>
> -----Original Message-----
> From: Sugg, Chris [mailto:aacsuggZn...]
> Sent: Monday, August 27, 2001 10:09 AM
> To: 'SAP on System iZy...'
> Subject: RE: Re: Assigning authorities under PFCG
versus
> SU 01
>
>
> Hey Jerry.
>
> Yes, we do a mass user compare and a mass generate.
>
> I have a job scheduled to run during our slowest system time to do
a user
> compare to clean up any differences between user ld's and roles.
Looking in
> PFCG at the User Tab, if you have any inconsistencies wit the role,
you will
> see a Yellow light until you do the User Compare.
>
> Chris
>
> -----Original Message-----
> From: Jerry Cummins [mailto:jcumminsZf...]
> Sent: Monday, August 27, 2001 9:49 AM
> To: SAP on System iZy...
> Subject: Re: Assigning authorities under PFCG versus
SU01
>
>
> I found the note that I recall seeing. Note 171786. BUT after
> reading this release 'independant' note, if I understand it
> correctly, it is an error to attach PFCG generated profiles to a
user
> using SU01, but it is okay to attach the activity group. If you
do
> so, the user comparison will nuke the assignment. I can't find in
> 31H a way of attaching anything but a profile. In the test version
> of 46C, it appears you can attach either profiles or roles
(activity
> groups). You appear to be handling this in 46C the same way we are
> currently. Have you ever done the user comparison?
>
> --- In SAP on System iZy..., "Sugg, Chris" <aacsuggZn...> wrote:
> > Hello Jerry.
> >
> > Currently, our local help desks assign roles via SU01 in our 4.6C
> system.
> > We still generate the roles from PFCG.
> >
> > Each time a role is created/changed in our configuration client,
we
> create a
> > transport and move it thru our landscape. Once the transport is
in
> each
> > system, we do a Mass Generate and a Mass User Compare if the
> transport
> > occurrs during productive hours. The Mass generate re-generates
any
> profiles
> > that need to be generated and the User comapare checks all usrids
> to see if
> > any should have the role and assigns it to them.
> >
> > I'm not sure if assigning user id's thru PFCG is the correct way
or
> not,
> > just that we don't have any problems using SU01.
> >
> > There are 2 security classes that I know of, CA940 and BC940.
The
> CA class
> > is Security Authorizations and the BC class is suppose to be the
> same except
> > it is technical in nature (Basis).
> >
> > Good luck!
> > Chris
> >
> >
> > -----Original Message-----
> > From: Jerry Cummins [mailto:jcumminsZf...]
> > Sent: Monday, August 27, 2001 7:49 AM
> > To: SAP on System iZy...
> > Subject: Assigning authorities under PFCG versus
SU01
> >
> >
> > We went to SAP 3 years ago to 31H. During my absence because of
> > schooling a basis consultant was assigned to our installation
> > project, and he set up a few users and authorities up by
assigning
> > the users to an activity group. After only a week or so, another
> > consultant who stayed with the project much longer did this by
> using
> > PFCG to generate a profile, then attaching the profile to the
user
> > via SU01. We did not use any of the standard SAP activity
groups.
> > We constructed our own. After classes I worked with only the
> second
> > consultant and I proceeded to assign authorities in the manner he
> had
> > established. After he rolled off the project, I discovered the
> few
> > users setup under PFCG. I know there is a note that says this is
> the
> > incorrect way of doing this, don't recall the note offhand, but
> > for two reasons, I switched everything over to assigning the
> profiles
> > under SU01. First I only had a few users that had been
assigned
> to
> > activity groups, and secondly, any change to the activity group,
> > obviously results in a transport. We have users in DEV with
> > different profiles attached in PRD. The transport implied you
> were
> > going to have the same assignment in DEV and in PRD for users
> > attached to that activity group. (I did not fully test that.)
> >
> > I knew someday I needed to straighten this out, and with a test
> > install of 46C, it appears the changes in 46C will force us to
> > change. Questions:
> > 1. If SAP wants us to assign the user under PFCG, and if this is
> > part of the transport of the activity group, roles as 46C calls
> it,
> > how do I give the same user different access in DEV than from PRD.
> > 2. When I set up a new user, my logical thought process is I add
> the
> > user then assign to the user the access the id needs. I have ONE
> > user that may have MANY activities/roles assigned. I accomplish
> this
> > under one screen in SU01. By using PFCG to assign a user to a
> role,
> > I must go to MANY `roles' to assign the ONE user. In effect
> > it seems
> > to make the establishment of a user and the authorities that user
> > requires ... backwards for lack of a different term, and at best
> > considerable more clumsy. What am I missing in my thought
process
> on
> > this?
> >
> > For the 46C upgrade, I will be taking the delta basis class from
> 3.x
> > to 4.6. Are there other courses that are appropriate for 4.6
that
> I
> > should take?
> >
> >
> >
> >
> > To unsubscribe from this group, send an email to:
> > SAP on System i-unsubscribeZegroups.com
> >
> >
> >
> > Your use of consolut is subject to
> http://www.consolut.net
>
>
>
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
>
>
>
> Your use of consolut is subject to
http://www.consolut.net
>
>
>
> To unsubscribe from this group, send an email to:
> SAP on System i-unsubscribeZegroups.com
>
>
>
> Your use of consolut is subject to
http://www.consolut.net



To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com



Your use of consolut is subject to http://www.consolut.net



To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com



Your use of consolut is subject to http://www.consolut.net



To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com



Your use of consolut is subject to http://www.consolut.net



To unsubscribe from this group, send an email to:
SAP on System i-unsubscribeZegroups.com



Your use of consolut is subject to http://www.consolut.net




_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


Durban Tours - Südafrika Safari

Fill RESBD Structure from EBP Component Structure   rdisp/max_wprun_time - Maximum work process run time  
This documentation is copyright by SAP AG.

Length: 15122 Date: 20240329 Time: 124129     sap01-206 ( 3 ms )