Quantcast
Channel: SCN: Message List - Security
Viewing all 5338 articles
Browse latest View live

Re: SU25 UPG ENHP : how to find modified roles?

$
0
0

Hi Colleen,

thank you very much for your appreciated collaboration. We are not using a sandpit client on DEV but a Sandbox system (which is a copy of DEV) on which we have upgraded the ENHPs. This Sandbox system will be the future DEV system when the ugrade will be completed. If we export Development System roles and re-import (or download roles from QA system) on Sandbox my question is : what will happenwhen we dothe upgrade onQAS? It will be sufficient to not execute the SU25 on QAS in order to assure alignment with the Sandbox?

Warm Regards

Bob


Re: LDAP Connection problem

$
0
0

Hello Shripad,

                     the error LDAPRC091 is being reported by the LDAP client library here to SAP (this is not an error in the SAP application rather the LDAP directory). Therefore check the documentation of your LDAP client library/LDAP directory to get more information in this case.

 

Thanks,

 

Chris

Re: HR-Security: Restriction at PSA/Orgkey(VDSK1) wise

$
0
0

Hi Ramesh,

 

If your requirement is to have authorizations based on the PSA (assuming Personnel Sub Area) then I believe using the org key is indeed the best approach.

 

As far as your math is concerned (175 PSA's times 6 roles), it would only make sense to create 1050 separate roles if you have 1050 or more HR administrators. If from an organizational point of view certain administrators are always responsible for more than one PSA then I wouldn't bother creating one role for each PSA. You could save yourself a lot of effort by combining those PSA's into the same role.


If you really do have 6 administrators for each PSA then perhaps structural authorizations isn't such a bad idea. If you can come up with a function module that retrieves the persons from the PSA that the user is responsible for (eg if all users belong to the PSA they are responsible for then you can just get all persons belonging to that PSA) then you can get away with having only 6 roles and let the structural authorizations take care of the PSA (and therefore also PA) part. That would save you a lot of time in build, maintenance and provisioning.

 

Good luck,

 

Brent

LDAP synchronization: Users only exist in database

$
0
0

Hi,

 

we are running LDAP synchronization periodically

 

In program RSLDAPSYNC_USER, box "objects that only exists in the database", we choose the option "Ignore objects". We'll probably change it to "lock in Database" when this question is solved

 

In LDAPLOG we see a message like "objects that only exists in the database" (perhaps no exact: translated from spanish) : 18

 

But can't see which users only exist in SAP DB

 

How can we know which users are these?

 

Thanks in advance

Re: Difference between * and ALL in P_ORGINCON for PROFL field

$
0
0

Hi Sheenam,

 

There are several possible explanations for this behaviour.

 

The most likely explanation would be that you're not using the standard (SAP example code) implementation for HRBAS00_GET_PROFL. While this is usually a good sign, it's possible that the developer didn't include the translation of "*" to "ALL" in the code or is pulling off some advanced logic that is causing these results. Would you mind sharing your code for this BAdI and the exact contents of profile A?

 

The less likely explanation is that your authorization switch DFCON is set to 1 (or 0) and the employee you are trying to display with user B is not integrated in the current time interval (i.e. on the default position). This means SAP can't figure out what to do with it in a context scenario and when your switch is set to 1 (or 0) will refuse to give you access. Not an issue for user A as he has value "*" for PROFL (and assuming also for PERSA/PERSG/PERSK if your switch is 1) which is another one of those undocumented exception scenario's (like the undocumented value 0). See note 647278 for more information on what the switch values actually stand for.

 

As for the difference between * and ALL, it depends on your implementation of HRBAS00_GET_PROFL:
1) No implemtation: ALL means profile ALL and "*" means "any profile assigned in T77UA"
2) Implementation that assigns ALL when you encounter a "*": ALL and "*" both mean the same because "*" gets replaced anyway
3) Implementation that doesn't assign ALL when you encounter a "*": ALL means profile ALL and "*" means "any profile assigned through the BAdI or T77UA"


On a side note, you can always run transaction RE_RHAUTH00 to get a view on the structural authorizations of user A and B. It gives a nice overview of which objects are accessible and where (which profile) the access is coming from. Comparing these results may already indicate what is causing the difference.


Hope that clears things up a bit.

 

Brent

Re: HR-Security: Restriction at PSA/Orgkey(VDSK1) wise

$
0
0

Hi Brent,

 

Am very thankful to you for putting effort/analysis to solve my issue.

Yes, you are correct but in my case the requirement will change according to my core team, that's the reason am in confusion either if I go for 1050 roles creation , is there any consequences which I need to face at run time or in case of maintenance..

 

I tried in different formats but am unable to decrease the size of role matrix and am failing while convincing the user in the form of clubbing one or more PSA's into one role.

This is some what complex situation(usually no one can maintain 1050 roles only for single HR module :)  which is not best practice)

 

But any way thanks again, your reply makes me more clarification about this issue.

 

thanks for your inputs.. Good day

 

Regards,

Ramesh Badam

Re: Variant SAP&_ACTVGRP of program RSUSR002 is not the current version

$
0
0

Hello Husin,

 

In order to correct the system variant you can use report RSVARDOC_610.

 

For that please enter report RSUSR002 and variant SAP&_ACTVGRP on the selection screen. Please do that in client 000 for this system variant.

 

Further details can be found in note 915638, under the "Explanation of the solution" section.

 

Hopefully it'll help you overcome this issue.

 

Regards,

Felipe Fonseca

Re: CALL C FUNCTION NO AUTHORITY

$
0
0

Hello!

 

Try add the authorization object 'S_C_FUNCT' with follow options:

 

  • PROGRAM = * (that is, for calling from all programs)
  • ACTVT = 16 (call authorization)
  • CFUNCNAME = * (authorization for all operating system functions)

 

Hope this could help you.

 

Regards,

César


Re: Authorization missing

$
0
0

Hello!

 

 

Try add the authorization object 'S_C_FUNCT' with follow options:

 

 

PROGRAM = * (that is, for calling from all programs)

ACTVT = 16 (call authorization)

CFUNCNAME = * (authorization for all operating system functions)

 

 

Hope this could help you.

 

 

Regards,

César

Re: LDAP synchronization: Users only exist in database

$
0
0

Hi,

 

unfortunately, RSLDAPSYNC_USER does not return a list of objects in DB if you choose option Ignore. You can get it with help of debugger. Put a break point on line 570 in report RSLDAPSYNC_USER. You will see a global variable gt_objects_db_only that will have this list for you.

 

Cheers

Re: Variant SAP&_ACTVGRP of program RSUSR002 is not the current version

$
0
0

Hello Fonseca,

 

Thanks for your sharing.

The problem is solved now.

 

Regards,

Husin.

Re: Mass Role Assignment using SECATT in ECC with EHP6 - Role Name parameter not found

$
0
0

Hi Karhik,

 

Did you ever solve this issue?

 

I have found the same issue when using LSMW and SU10.  I have found the cause to be a new version of SU10 introduced before ECC6 SAP_BASIS release 731 release 0005, which is my current version.  A colleague on an earlier Basis release of ECC6 does not have an issue with LSMW and SU10.  I have also successfully written many LSMW/SU10 scripts on earlier versions of SAP, and also written LSMW/SU01 scripts on this version.

 

It appears that the focus is on the reference user, rather than the role name when changing to the roles tab.  With a straightforward recording of adding a role, the script does not include the role assignment.

 

Regards,

 

Jeremy

Re: Mass Role Assignment using SECATT in ECC with EHP6 - Role Name parameter not found

$
0
0

Hi Jeremy,

 

I hit this issue just recently. SAP re-wrote these transactions. They use component that is not visible in batch input session. Hence you can not add roles to a user. As a workaround for LSMW you can switch from batch input to BAPI and generate IDocs that will create new users.

 

Cheers

Restrict user login on multiple terminals

$
0
0

Hi,

 

I am looking for a solution to restrict user from logging-on from multiple terminals. User should allowed to login from any terminal for the first time, and  the terminal ID should be recorded. He should be allowed to login only from the same terminal from the 2nd time. Incase if he tries logging in on from other terminal, it should give a message that says "You are logging in from a different terminal".

 

I am sure that SAP doesn't have this as a standard functionality. But, I am looking for any solution/views on this requirement, incase if applied in any of the implementations.

 

Appreciate any pointers.

 

PS: I've went thru numerous threads on SCN, which provides solution to activate SM19 audit lots, which I would not interested.

 

Regards,

Raghu

User login logout date/time

$
0
0

Hi,

 

Is there a way I can capture the user login, logout time & date without enabling SM19/SM20 audit logs?

 

Rgds,

Raghu


Re: User login logout date/time

$
0
0

Hi Raghu

 

i truly don't think so. Why don't want enable sm19 that btw it's good security manner?

 

Let me know

a

Re: Restrict user login on multiple terminals

$
0
0

Hi,

 

there is a standard user exit SUSR0001 that gets called after user logs on with SAP gui. You could use it to implement this logic. It only works for sap gui. It does not work on web based apps such as web dynpro. Also users must not have access to debugger.

 

Cheers

Report availale: granted authority and used authority per user ID?

$
0
0

Hello dear collegaues,

 

 

May I ask, can you help me please?

 

My quesition is: Is a possibility to make a report per User ID where I can see all the functions the user  is allowed to use,

and the effective use of functions within a defined time period.

 

Exampel:

User Jane Doe has NN authority to functions within SAP.

But user Jane Do uses the following functions within defined time period.

 

 

 

Thank you for your help and answer.

 

 

All the best Erwin

Re: Report availale: granted authority and used authority per user ID?

$
0
0

At a transaction, RFC, WebService or WebDynpro level you can compare the authorized functions to the ones in their menus and then compare them to the statistics database. That produces nice colourful ALV lists and excel sheets in the reports we have for this.

 

At an individual authorization object and field value level, you will have to wait a little while still for a kernel patch which will hopefully come soon. It will make it possible for you to simulate the affect of successful or unsuccessful checks without them actually failing. This means you can also over time gather what a user has for authorizations but does not use...

 

I am also waiting a long time for this. I will update this when it is available.

 

Cheers,

Julius

Re: User login logout date/time

$
0
0

Hi Andrea,

 

The reason why I don't want to rely on SM19 is that the logs will consume more space. My client has around 50,000 users and is not willing to use SM19 audit logs. Appreciate any other views.

 

Regards,

Raghu

Viewing all 5338 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>