Security: Migration via User &/or User groups

[Former Member]

Hi,

quotation from SAP help:

Before you migrate users and the authorizations assigned to them, you need to make sure that you only migrate complete user groups. Complete means that only those users selected have the profiles that are affected by the selection of users and authorization objects.

Example:

User USER1 and user USER2 are subject to the following authorization concept:

USER1:

Authorizations for the authorization object BO1 in profile T_1234

&

Authorizations for authorization object BO2 in profile T_4567

USER2:

Authorizations for authorization object BO2 in profile T_4567

If you select the user USER1 and the authorization objects BO1 and BO2, the group would be incomplete, because user USER2 has authorizations for the authorization object BO2. The migration would affect both users. The user group from both users would be complete, on the other hand, as long as no other users in the system had been assigned one of the two profiles. The migration of user USER1 and authorization object BO1 would also be complete.

We have 31 old authorization object in use, we have 51 user groups based on organisational values.

My questions to you:

If I am understanding SAP correctly, it is mandatory to create new user groups per authorization object & new user groups per authorization group combination!

Is this correct?

Is there any other way to get the old concept migrated?

thanks in advance

Oliver

[Former Member]

You are understanding the concept of complete user groups correctly. To use the migration tool, you would have to have complete user groups. The opther option is migrate manually by rebuilding this concept from scratch, in which case you could use roles for grouping and have other options.

[Former Member]

thanks for the quick response

[former_member192700]

Hi together,

just for clarification purposes:

The user groups stated in the online documentation and in the responses are not user groups that you define in SU01, yet just semantical / logic user groups to explain the issue. You could also replace the word user groups by "a number of users" or "a group of user".

Cheers

SAP NetWeaver BI Organisation