SAP Security - Day 2 2nd Half - Anwar - Chandra

IBM Global Business Services
Working with Profile Generator
SAP/ PFCG - Profile Generator
March-2007
2007 IBM Corporation
PFCG Checking if PG is Active

In R/3 release 4.6 PG is already activated and there is no need to set the
system parameter in the R/3 instance profile .
To check whether PG is activated:
1. System Parameter:
2. Value:
Y
auth/no_check_in_some_cases
March-2007
PFCG - Overview
Definition:
A Central Tool available and integrated with R/3
Automatically generates authorizations and authorization profiles

Assigns them to users
Transaction Code: PFCG
Release:
Released with the 3.1G version of SAP
Benefits:
Simplifies the task of setting up the authorization environment
Enables proper User Role mapping

Reduces of time for R/3 authorization implementation
March-2007
PFCG - Components of Profile Generator

Profile generator has the following Components
Activity Groups/ Roles
Composite Activity Groups/ Composite Roles
Derived Activity Group/ Derived Roles
User Assignment
March-2007
PFCG
To launch the profile generator, choose the following from SAP Menu
Tools
Administration
User Maintenance
Role Administration
Roles
The corresponding
Transaction Code is PFCG
March-2007
PFCG Role Maintenance Screen
Change
Role
Display
Role
Create
Role
March-2007
Create
Composite Role
PFCG Different Functionalities/ Tabs

Description
Menu
Authorization
User
MiniApps
Personalization
1. Define
Role names
1. Define
Activities
2. Design
User Menus
Maintain
Authorization Object
2. Generate
Authorization Profile
1. Assign
Users
2. Adjust
User master
Records
1. Assign
MiniApps
(if any) to
the Role
March-2007
1.
PFCG Description Tab
March-2007
PFCG Menu Tab
March-2007
PFCG Menu Selection

For example, if we choose to copy the Menu by selecting specific items for SAP
Menu, it may be done as follows. After selection Transfer button needs to be
clicked
March-2007
PFCG Menu Tab

After selection of items, the Menu will automatically be populated as follows.
March-2007
PFCG Authorization Tab
March-2007
PFCG Authorization Activities

For maintaining Authorizations it will take to the following screen where the
Organization Level needs to be maintained.
Note: In case of Master Role the Org. level values may be kept as *
March-2007
PFCG Authorization Activities

After Organization Levels are maintained, the following screen will appear for
maintaining Authorizations
Unmaintained
Organizational
Level
Some
Authorization
Fields have
Missing Values
All
Authorization
Fields have
Values
Assigned
March-2007
PFCG Profile Generation

Once Authorizations are maintained, the Profile can be generated by
clicking on the Generate button (Shift+F5). The new Profile Name needs
to be entered.
March-2007
PFCG Authorization Tab (status change)

By going back to Authorization Tab, the Status change would be visible
and Profile Name is displayed
March-2007
PFCG User Tab

The Role can be assigned to as many User IDs as required. Please note that this
applies only for the existing User IDs. Then the user master record needs to be
updated after User Comparison.
March-2007
PFCG User Tab

The user assignment and the generated profile must be updated in the user master records.
There are a number of ways in which we can do this (depending on the release status):
In all releases, we can schedule a background job that regularly updates the user master
records.
We can either use the user comparison function or have the user master records
automatically updated when saving the activity groups or roles. (Choose Utilities Settings,
and activate the option Automatic comparison at save.)
Even if we use the User Comparison function or the option Automatic Comparison at Save,
it is recommended to schedule a background job and ensure that all user master records
are regularly automatically updated.
March-2007
Questions??
March-2007
User Menu and Area Menu
March-2007
User Menu & Area Menu - Overview

User Menu:
Combination of all the Role Menus of the Role (one or more roles) which are
assigned to the User.
Area Menu:
Another type of Menu that contain a set of functions intended to perform a
particular task in a company. Two types of Area Menus are there:
1. Default Area Menus (predefined within SAP)
2. Customized Area Menu (By Transaction SE43)
Role1
User1
Role2
Menu1
(Selected
based on
requirement)
Menu2
(Area Menu)
March-2007
User Menu - Defining a Menu using PFCG

In transaction PFCG the Menu Tab gives the option to create Menu for a
particular Role
Menu Can be
copied from:
1. SAP Menu
2. Other Role
3. Area Menu
4. File Import
March-2007

For example, if we choose to copy the Menu by selecting specific items for SAP
Menu, it may be done as follows. After selection Transfer button needs to be
clicked
March-2007

For example, if we choose to copy the Menu by selecting other Area Menu, it may be
done as follows.
March-2007
User Menu Assigning Users to Role by PFCG

The Role can be assigned to as many User IDs as required. The Menu of this
Role then becomes a part of the User Menu for the users who would be
assigned this Role.
March-2007
User Menu Assigning Role to User by SU01

On the Roles Tab of Maintain User Screen (SU01), the Roles are assigned to the
users. Hence the corresponding Menus (of Roles as created in PFCG) together forms
the User Menu.
March-2007
User Menu Assigning of Default Start Menu by SU01

In the Default Tab of Maintain User Screen (SU01), the Start menu can be defined by
specifying the Area Menu (predefined/ customized). By default its S000, i.e., Default
SAP Menu
March-2007
User Menu Activation

We can define how the menus would behave through the SSM_CUST table.
For example, two job roles are ever assigned to the same user or two derived roles from the
same JOB-ROLE to the same users, SAP will dynamically consolidate the menus and
minimize duplicate nodes provided the correct parameters in the SSM_CUST table are set.
It does not prevent from

assigning the SAP Easy menu
to the users, unless parameter
ALL_USER_MENUS_OFF is set
to YES in table SSM_CUST
March-2007
Area Menu Customize using SE43
In SE43 Area
Menus can be
created, modified,
copied as per the
requirement
Create a new
Area Menu
Change an existing
Area Menu
Copy from an
existing Area Menu
March-2007
Questions?
March-2007
Working with Profiles
March-2007

The next step is creating a profile for that role.
For that, click on the authorization tab which will take us to the following screen
March-2007

The Profile Name tab and the Profile Text tab will be blank in case of a new role creation (as in this
case)
In order to go inside the role we need to click on the tab Change authorization Data or Expert mode
for profile generation
Selecting Expert mode for profile generation pops up three options viz :
Delete and recreate profile and authorizations : For any role modifications, if there is any need to delete
the existing profile and authorization of the role and recreate a new profile,this option is used.
Edit old status : This option is same as the Change authorization data option which is the most used
option used in daily work which does not have any added functionalities like the other two options but simply
guided the user to the inside of the role keeping the old data of the role intact.
Read old status and merge with new data : In case of existing role modifications, in oder merge new
datas that have been added to a role (while adding a tcode to a role, the objects that are pulled due to
SU24) with the existing one, this option is used.
March-2007

The next screen will take us to the inside of the role :
March-2007

Sometimes initially some objects appears to be yellow in colour. We can expand the object by
clicking on the icon
After the full expansion the view looks like :
The yellow field is due to the unavailability of

the values in the object fields (which can be
maintained through SU24).
Those objects which has missing values are
known as Open Fields.
Fields
Authorization Object
Authorization Object class
We can change/edit the existing values of a

field or add some values to a missing field
depending upon the Business requirement.
March-2007

In order to change the values of any authorization object ,click on the Icon
A following pop-up emerges out :
We can put the values in the
columns ( S and E in this case)
or we can click the tab Full
Authorization to provide full
access and click on
March-2007

There is a special field called Activity which decides what type of access should be provided.
Clicking on that field emerged out another type pop-up wherefrom we can select the type of
activity
We can select the type of activity by
clicking on the desired checkbox (01,02
and 04 in this case).
We can also provide full access by
clicking on the tab Full
Authorization and then click on the
icon
March-2007

We can also add an object manually into the role by clicking on the tab
The following screen pops-up
We need to put the object name in the

field (S_TABU_DIS in this case) and
click on the green check.
The object will be manually added to the
role.
Then we need to expand that object and
put the field values into the object as
described in the previous slides.
March-2007

We can also assign the Organizational Values to a role by clicking on the icon
We can put the values of

Plant, Company Code , etc. in
the respective field as
proposed by the business
We can also give full access to

all the Org Values by clicking
on the tab Full Authorization
March-2007

The last but the most important step is Generation of a profile
Profile Creation can also be done through this method.
Click on the Icon
The following screen will pop-out
The profile name as well as the description can be changed .

Once done you need to click on the green check to save the changes
Every time any change In the role is made it is mandatory to Generate the profile otherwise the
entire role will not be any use and any user who will be assigned with the role will not get any access
to the authorizations.
March-2007
USER ASSIGNMENT & USER COMPARISON
March-2007

WHAT IS A USER IN A SAP SYSTEM?
A user here is referred to as an end user. There are five types of users in SAP as
mentioned below:i) Dialog
ii) System
iii) Communication
iv) Service
v) Reference
March-2007

In a SAP R/3 System, Users are assigned to Roles (where each role is
associated to some transactions) and the authorizations to run these transactions
are stored within the profile. User Assignment to a Role can be done by
conducting the following procedure.
March-2007

PFCG (Profile
Generator Display
Screen)
Click on
Change
Button for
editing User
assignment
for the Role
Here the Role
name is typed to
which the user is
being assigned
March-2007
March-2007
USER TAB
Click on Selection button and then the

below screen appears. i.e it displays all the
users belonging to a single user Group.
You can as many users from the list.
User Assignment Validity Periods
March-2007

The user master record comparison consists of three types of comparison:
a) Profile comparison The profile assignments and newly generated profiles are updated
and associated with the respective roles and thus eventually gets associated with the users.
b) Composite role comparison - This updates the role assignments defined in composite
roles i.e. any kind of updation within the granular level roles present within the composite
role.
c) HR comparison- This generates the direct role assignments from the indirect role
assignments of the HR-ORG model.
March-2007

Click on User Master
Compare
Select Complete Comparison
March-2007
USER COMPARISON- TRANS PFUD
Click here to enter the roles
1
2
3
March-2007

PFUD- MASS COMPARISON
Schedule or check job for the full comparison Option
Here the
Job name
is
PFCG_TI
ME_DEPE
NDENCY
Enter
the job
schedule
period
March-2007

There are two ways to execute the comparison.
As a background job before the start of each day. If report PFCG_TIME_DEPENDENCY is
run every night, the authorization profiles in the user master will be current each morning
(assuming that the job has run correctly).
Report PFCG_TIME_DEPENDENCY must also have run after each import of roles from
other systems.
Using Transaction PFUD, Compare User Master
An administrator should use this transaction regularly to check that no errors have occurred
in the background job. Any such errors can then be corrected manually.
March-2007
QUESTIONS ?
March-2007

SAP Security - Day 2 2nd Half - Anwar - Chandra

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

SAP Security - Day 2 2nd Half - Anwar - Chandra

Încărcat de

Drepturi de autor:

Formate disponibile

IBM Global Business Services

Working with Profile Generator

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Checking if PG is Active

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

Automatically generates authorizations and authorization profiles

Enables proper User Role mapping

2007 IBM Corporation

IBM Global Business Services

PFCG - Components of Profile Generator

Activity Groups/ Roles

Composite Activity Groups/ Composite Roles

Derived Activity Group/ Derived Roles

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Role Maintenance Screen

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Different Functionalities/ Tabs

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Description Tab

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Menu Tab

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Menu Selection

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Menu Tab

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Authorization Tab

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Authorization Activities

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Authorization Activities

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services

PFCG Profile Generation

SAP/ PFCG - Profile Generator

2007 IBM Corporation

IBM Global Business Services