How to effectively document changes to roles?

[Former Member]

Hey Folks,

We are looking for a way to capture the changes in the roles as part of projects and defects.

We are considering the approach through storing the information in tables AGR_1251 ,AGR_TCODES, AGR_1252 and AGR_DEFINE in an excel sheet .But this is a cumbersome approach ..

Can people share how changes to the roles documented in their systems?

Raji

[Former Member]

Raj,

There are several ways to due this however you may want take a look at the different approaches and then form your standard based on the requirements you need.

Personally I'm not a big fan of tracking role changes in spreadsheets. As you state it is very cumbersome and it will it may become out of sync with what is actually in the role--depending on how it's maintained.

One approach is to define a documentation requirement directly in the role itself.

Add a new line to the long text role description on the description tab of the role every time a change is made to the role.

The is line may look similar to the following:

Date, (change request/ticket number), identifier of project or defect, description of change

Example:

04/03/2007 123456 Project Add tcode SU10 to security admin role

This information can then be extracted from the AGR_TEXTS table for reporting.

Cheers,

Ben

[Former Member]

If your organisation has licences to the SAP Access Controls suite (Virsa), then you may also want to consider Role Expert. Not only will it track changes, but defines role ownership and facilitates a workflow for approval of changes.

[Former Member]

Raji,

we are using the same approach Benjamin described. Having a line in the long text of the role specifying the date of the change, who did it, a brief summary and the case number.

We log cases for all changes we do in SAP (roles, ABAP, etc.) and with each case goes an auditable set of documentation like a Technical Design, justification, etc. Based on the case number logged in the role you can then go back this documentation to see what has changed and why.

I don't think spreadsheets are a good idea. SAP is keeping change logs for all role changes so why have duplicate data storage?

Kind regards

Petra

[Former Member]

we also do all documentation in the role itself. We have a change control system where we request changes and we note those tracking numbers in the roles as well. Here's an example

Updated 02/13/06 - Dave

- Added txn ZM01E per RFS #20060576

[Former Member]

Hi Rajeswari

As Benjamin said most of the clients would prefer to maintain a long text description for all the roles whenever they make any change to it.

Other than this you can go to SUIM --> Change Documents --> Roles where you can get the following details.

1.Overview of change documents

2.Create and Delete roles

3.Role description

4.Single rolesin composite roles

5.Transactions in role menu

6.Other objects in role menu

7.Auth data

8.Organizational level value

9.Authorization profile

10.Attributes

11.User assignment

12.All change documents(Technical view)

Don't forget to award points if this helps.

Regards

[Former Member]

Hi all,

I have an issue related to a role that was assigned to few users with different cadar(position viz., manager and jr manager and soo on ) and the role is related to MM(PO release related).

The problem is that the same role was acting different to 2 users with full authorization since a weeks time, but before that they were not given full authorization.

Now can anyone plz help me how to go about this issue, as the issue is related to users on the PRD server i am not able to decide what is my next plan of action.

for your information

ROLE NAME: M:CS:DISPLAY

Auth Object : M_EINK_FRG

i m sure these are default roles which are assigned but HOW can i do this

As this is a long pending issue i am waiting to hear it at the earliest from you.

Thanks in advance

Hari Haran.V