SAP Basis Creating users, assigning roles, locking and unlocking users, etc - SAP Corner

Direkt zum Seiteninhalt
Creating users, assigning roles, locking and unlocking users, etc
Permanent tuning and performance monitoring in the aforementioned areas
Transporting transport orders from one system line to another or importing third-party transport orders into the SAP system is also an occasional task for an SAP basis administrator. As in my last blog post on system modifiability, I would like to offer you a way to quickly present this topic. So you will find a step-by-step guide which you can follow if you have already understood the content of the topic, but only the steps need to be taken. What are the requirements? Transport orders include two files, titled "data" and "cofiles". These files consist of a six-character alphanumeric combination and a file extension, which often represents the system from which the files were exported. The first character is always a K (the cofiles file) or an R (the data file). For our example we call the files K12345_DEV and R12345_DEV. These files are of course needed for an import into your own SAP system. Furthermore, you need access to the file system or the SAP directories, as they have to insert the above files there manually. In addition, the transaction STMS is required in the SAP system because it attaches the transport orders to the import queue. Now, if you have all of this available, we can start with the import: What is the procedure? Operating System Level Preparation. The first step is to copy the files to the transport directory of the SAP system. This is usually below /usr/sap/trans, but can be changed individually depending on the system. If you want to make sure that you are working in the correct directory, you can look in the transaction AL11 to see which directory is specified under "DIR_TRANS". This is the right directory to work on. Here the existing files are copied into it, namely the cofiles file (K12345_DEV) in the cofiles folder (/usr/sap/trans/cofiles) and the data file (R12345_DEV) in the data folder (/usr/sap/trans/data). Note: In this case, especially for companies with multiple systems on multiple servers, the access permissions and the file owner need to be changed so that the import in the target system does not cause problems.

From a purely technical point of view, each generated authorization role contains a profile from which a user receives the actual authorization objects and authorization characteristics. If this profile is outdated or not assigned at all, the user will not have all the authorization objects contained in the authorization role. Incidentally, the problem arises particularly frequently after role transports: If an authorization role is changed in the development system and then transported to the production system, the current profile is not automatically assigned to the users with the respective role. A user comparison must therefore be performed here.
Analysis and reflection of the existing system configuration
I recommend that you schedule the background job PFCG_TIME_DEPENDENCY with the report RHAUTUPD_NEW. Scheduling the RHAUTUPD_NEW report with two variants has proven to be a best practice: Once a day before users log on for the first time (e.g. midnight or very early in the morning). This way the users are synchronized once a day. Once a month (or even once a week) with the option "Perform cleanup", so that obsolete profiles and user mappings are regularly cleaned up. Also handy: If the naming conventions of your roles allow it, you can also align the report according to different time zones. For example, I have a customer who runs the user synchronization for his users in the USA and Asia at different times, so that the daily business of the respective users is not disturbed.

The results of the tests can be documented so that the development can be considered over a period of time. This way, you will be aware of the revision and of the relevant issues before the examination.

"Shortcut for SAP Systems" simplifies tasks in the area of the SAP basis and complements missing functions of the standard.

Regular further training will help you to develop your personal skills in a targeted manner.

Understanding the structure and functioning of the system is especially important for IT administration. It is not for nothing that "SAP Basis Administrator" is a separate professional field. On the page you will find useful information on this topic.

Instead, there is talk of a technology that will disrupt existing products, services, and even business models.
SAP Corner
Zurück zum Seiteninhalt