Different role types. Was: "Hi sap gurus"

[Former Member]

define and differentiate the following types of roles

1.single role

2.composite role

3.derived role

4.child role

5.parent role

Message was edited by: Moderator

Please use meaningfull thread subject titles.

[Former Member]

You will get the answer for all of those if you type them into a search engine

3&4 are the same

[Former Member]

pls buy authorisatiosn made easy and you will know teh answers after readiing

[Former Member]

Single role is role which generally does not have a Org level (Generally sap delivered roles are single)

Composite role is a summation of single roles

Derived and Child roles are the same. They are created where Org levels have to be maintained.

Parent role is the role from which the child roles derive their data.

best regards

Ravi

[Former Member]

Hi Damodar,

Dervied role(child & dervied are same)

Derived role is a role which derived its authorizations from the role from which it is derived.

For example: You have created a Master role for Purchase Requisition creator . Now if you want person A to be able to do this for a particular Org Unit A and another user B for for Org Unit B.

Then in this case you create two derived roles for the Master role mentioned above and maintain the Organizational fields accordingly (Org Unit A for Dervied roleA, Org Unit B for Derived Role B)

So in Short derived roles are used when you have a common role which needs to be given to morethan one user with the difference only in the Organizations Fields with the same activities then you create derived roles.

Now for composite roles say you have 100 end users who perform the same activities. and each one needs to be assigned same set of ten roles.

Now if you go on doing it one by one its a painful task. A solution to this is to club the roles into a Composite role and now once you assign this role to the users gives the same effect as the earlier case and managing and maintaining becomes easier. So composite role is like a folder with a collection of single roles in it and can be assigned to users.

Master role or parent role :Parent role is the role from which the child roles derive their data.

refer to dervied role.

____________________________________________________________________

These online help looks good on this topic:

Derived Rols:http://www.sapsecurityonline.com/tutorials/derived_role.htm

Composite roles: http://www.sapsecurityonline.com/tutorials/composite_role.htm

http://help.sap.com/saphelp_webas610/helpdata/en/da/59f8a4d49411d3970b0000e82de14a/frameset.htm

[Former Member]

Hi

There are 5 types of Roles:

1) Single Role.

2) Composite Role. (Max 164 Single Roles can be attached to one Composite Role)

3) Derived Roles.

4) Orphans Role.

5) Reference Roles.

<b>Composite roles </b>

A composite role is a container with several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.

Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role. Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group. The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.

The menu tree of a composite role is, in the simplest case, a combination of the menus of the roles contained. When you create a new composite role, the initial menu tree is empty at first. You can set up the menu tree by choosing Read menu to add the menus of all roles included. This merging may lead to certain menu items being listed more than once. For example, a transaction or path contained in role 1 and role 2 would appear twice. If the set of roles contained in a composite role changes, the menu tree is also affected. In such a case, you can completely rebuild the menu tree or process only the changes. If you choose the latter option, the Profile Generator removes all items from the menu, which are not contained in any of the roles referenced. It is possible (and often necessary) to change the menu of a composite role at any time. You adjust these menus in the same way as the menus for roles.

<b>Derived roles </b>

Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.

The higher-level role passes on its authorizations to the derived role as default values, which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either. Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.

The menus passed on cannot be changed in the derived roles. Menu maintenance takes place exclusively in the role that passes on its values. Any changes immediately affect all inheriting roles. You can remove the inheritance relationship, but afterwards the inheriting role is treated like any other normal role. Once a relationship is removed, it cannot be established again.

In real time scenario Roles and Authorizations are primarily based on Company codes in many cases and in some scenarios are also based on Cost centers or divisions etc. IN such scenario, a Master role is created and many child roles are created with relevant Organizational levels added to the same. So any change to the master role would be drilled down to Child roles and hence it would avoid a lot of Maintenance overhead.

E.g.: Master Role -- Z_SAP_FI_BUYER_000

Child Role1 -- Z_SAP_FI_BUYER_CC1

Child Role 2 -- Z_SAP_FI_BUYER_CC2

Child Role 3 -- Z_SAP_FI_BUYER_CC3

<b>Orphans Role</b>

Orphans Roles are Stand-alone roles and are many a times required for IS uses/. So a System Admin role, a Security Auditor role and many other special roles mainly not used in Business side are created as ORPHANS. This role limits the user to a particular organization.

<b>Reference Role</b>

They are SAP standard Roles.

Reward points if helpful