Implementing the ABAP Roles for On-Premise/Private Cloud

In this lesson, you will learn about the authorization concept for the On-Premise/Private cloud. With this knowledge, you will learn how to implement ABAP roles.

As you explored the roles, authorization profiles, and user master records in the previous lesson, you will now discover the ABAP authorization concept. In SAP's authorization framework, authorization object classes, objects, and fields all play crucial roles, but they operate at different levels of hierarchies and specificity. Here's a detailed breakdown.

For example, the authorization object S_USR_GRP relates to the user group in master record maintenance.

The important terminologies in the authorization concepts are as follows:

• Authorization Object Class: This high-level category groups related authorization objects for better organization and easier management.
• Authorization Object: An authorization object is a specific, predefined set of authorization fields that define a particular combination of conditions required for access control.
• Authorization Field: The Authorization Object is subdivided into groups of fields. These individual fields specify the detailed conditions for access.

Authorization objects protect actions and access to data in an ABAP-based SAP system. SAP delivers the authorization objects in SAP systems.

Administrators use the role maintenance tool (transaction PFCG) to maintain and manage roles within an SAP system. Role maintenance simplifies the creation of authorizations and their assignment to users. In role maintenance, transactions and applications required for business use are assigned to the role. In addition, role maintenance creates authorizations with the required field values for the authorization objects checked in the selected transactions and applications.

From role maintenance, you can assign a role to various users. Changes to a role, therefore, influence multiple users.

You can assign a user to various roles from SU01, the user maintenance tool discussed in the previous lesson.

The user menu comprises role menu(s) and contains entries assigned to the user through the roles. Examples of such entries include transactions, URLs, and reports.

Select and change functions by adjusting the menu tree for the individual roles, as required. You can also insert or delete transactions into or from the tree structure.

You can integrate reports by choosing the Report function in the dropdown menu of the Insert push button. In this case, role maintenance creates transaction codes (if they do not already exist) with which the reports can be called.

By choosing the function Web address or file in the dropdown menu of the Insert push button, you can add internet addresses or links to files (such as tables or text files). When integrating files, you must use storage paths instead of URLs. You can also specify Business Warehouse (BW) Web Reports and links to external mail systems and the Knowledge Warehouse (KW).

You can create, move, delete, and rename directories and subdirectories as required in the change menus. You can also use the drag-and-drop function in role maintenance.

Role maintenance automatically creates the authorizations associated with the transactions specified in the menu tree. However, all authorization values must be manually checked and adjusted, if required, per the actual requirements and authorities. The system administrator and the appropriate user department are responsible for this task.

Maintenance is not carried out directly in the field but via the Organizational Levels push button (CTRL+F8) when using organizational levels.

Choose the Authorizations tab page and then choose Display Authorization Data or the Change Authorization push button, depending on the maintenance mode. Then, check the scope and contents of the authorizations.

If the system has proposed these authorizations, a green traffic light in the authorization overview indicates that role maintenance has supplied at least one proposal for each authorization field.

A yellow traffic light indicates that the authorization must be manually maintained after it has been created. Role maintenance does not provide a default value for the authorization, and it cannot determine whether data access should only be read or read and write when accessing files.

Some fields appear in many authorizations. Therefore, several essential fields, such as the company code, are combined into organizational levels. If you maintain an entry for the organizational level using the Organizational Levels push button, you can then maintain all the fields that appear there in one go. A red traffic light indicates an unmaintained organizational level.

When all authorizations are maintained as required, the authorization profile can be generated by choosing Generate. After creation, this name cannot be changed. The authorizations are combined into profiles. The profiles must be entered in the user master record (by the role maintenance) for the authorizations to take effect for the user. This is called user master record comparison.

Users are assigned to roles in the role maintenance transaction (transaction PFCG) or the user maintenance transaction (transaction SU01). Within SU01, by selecting the User tab page, the user IDs assignments are maintained. When selecting user IDs, the system uses the current date as the start of the validity period of the assignment and sets 31.12.9999 as the end date, by default. However, both the start and end validity dates can be changed as per business requirement.

Users can be linked to more than one role. This can be useful if some activities, such as printing, are permissible across roles.

The assignment of roles to users does not automatically grant them the corresponding authorizations. To assign the authorizations, you must perform a user master record comparison, during which the profiles assigned to the roles are entered in the user master record.

A user master record comparison determines whether authorization profiles can be added or removed from the current user based on their current or updated role assignments. During the comparison, profiles are added to a user master record due to newly added roles. If role assignments are manually or time-dependently removed, the corresponding authorization profiles are deleted from the user master record.

The comparison can be performed individually for each role during maintenance by selecting User Comparisonfrom the User tab page. In the dialog box that the system displays, choose Complete comparison.

If multiple role assignments are to be updated, you can perform a corresponding comparison in role maintenance by choosing Utilities → Mass comparison (transaction PFUD). You can specify the desired roles individually or update all assignments by entering the asterisk (*) character.

You can also activate the periodic user master record comparison in role maintenance by choosing Utilities → Mass comparison. Select the Schedule or check job for the complete reconciliation option. The system then displays a search window for the background job PFCG_TIME_DEPENDENCY. You can create a new one if it does not find a corresponding job. The default value is that the comparison of all user master records occurs once daily.