Hi,
To assign general authorizations to users, you can copy general authorizations to a role in the form of templates. You can copy the delivered templates, or create your own templates.
Delivered templates for user administration:
· SAP_ADM_AU: Administration: Authorization data administrator
· SAP_ADM_PR: Administration: Authorization profile administrator
· SAP_ADM_US: Administration: User administrator
You require very extensive authorizations to process templates using transaction PFCG ® Utilities ® Templates.
You can assign general authorizations to users in one of two ways,
1. Create a role which only contains general authorizations (such as printing). Then assign this role to all users. This is useful if, for example, all users may print on all printers.
2. Use a template to import the required objects into the role and then maintain missing field contents. This is useful when the users to whom the role is assigned may only use certain printers, for example.
In the authorization data maintenance, choose Edit ® Insert authorizations ® From template. Choose the SAP_PRINT template. You now need to fill in missing details in the field values of authorization data inserted in this way, such as which printers are to be used, and so on.
You can then create your own templates or make copies of SAP templates and change these. To create your own templates, choose the option Templates in transaction PFCG. Unlike changes to defaults, changes to templates are not passed on when you compare roles.
The names of SAP templates begin with S. If you create any templates yourself, they should not begin with S.
All functions in the CTS are safeguarded by detailed authorization checks.
With the help of authorizations, you can specify whether a user may perform administration functions and which request types this user can edit.
SAP provides roles for the different CTS user types. Each role has the appropriate authorizations for the different CTS activities. In most cases it is sufficient to set user authorizations by assigning roles. You can use the role maintenance transaction (PFCG) to change the authorizations of roles for your own requirements, or to create new roles.
For more information, see Roles in the Change and Transport System.
Choose Tools ® Administration ® User Maintenance ® PFCG – Roles (transaction PFCG).
2. Choose Goto ® Settings ® Total View (Organizational Management and Workflow).
The Org.Management pushbutton is then displayed on the User tab page.
3. Specify the role that you want to assign indirectly, and choose Display.
4. Choose the Org.Management button on the User tab page.
The Role: User Assignment screen appears.
5. Switch to change mode, and choose the Create Assignment pushbutton.
The system displays the Select processor type dialog box, in which you can select some or all of the following object types, depending on the evaluation path:
position, job, organizational unit, position, work center, and user.
The assignments for the User object type are then completely identical to the assignments maintained on the User tab page.
6. Select the object to which the role is to be assigned.
7. In the following dialog box, select an available object (for example, using the possible entries help) and choose Create.
The assignments created in this way are called indirect user assignments, as they are not made directly between the user and the role.
These indirect user assignments are stored as gray in the user display and highlighted in color.
The status display in the Org.Management button shows whether you need to update the indirect user assignments,
Green: User assignments are current
Red: User assignments are not current, the indirectly assigned users are not completely displayed on the tab page.
Comparing the Indirect Role Assignments
You have the following options to update the assignment:
Choose Org.Management and then Compare indirect user assignment.
Perform the manual user master comparison that also automatically updates the indirectly assigned users.
Schedule report PFCG_TIME_DEPENDENCY periodically. This report performs a complete comparison, consisting of organizational management, composite role, and profile comparisons.
Create a variant of report RHAUTUPD_NEW (transaction PFUD), in which the HR Organizational Management Comparison indicator is set on the selection screen, and schedule this variant periodically.
Call transaction PFUD and set the indicator HR Organizational Management Comparison on the selection screen
This means that all indirectly assigned users for which the assignment has become valid on the basis of the assignment period are directly assigned to the role, and all directly assigned users for which the assignment has become invalid are removed.
PFCG integration of role assignment maintenance in PPOME.
Hope it helps.
Thanks in advance,
V Praveen
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.