Copy User Masters from 4.7 to ECC 6.0

[Former Member]

Can the User Masters be copied from an R/3 4.7 system to an ECC 6.0 system?

Thanks.

Chris

[jurjen_heeck]

If both systems are running simultaneously it could be an option to temporarily hook them up as CUA master and child.

If not, maybe the tables are transportable for alll userdata (guru's, help!!!) but I do not know what will happen with the passwords.

[Former Member]

I disagree with both of Jurjen's suggestions (although I normally find myself agreeing with Jurjen

Temporary CUA will flag the user as a CUA user in the target and can cause problems later on. There have already been some threads about this.

Transporting the tables assumes that you find them all and know how to find the correct ones. Don't go that way...

My suggestion: To get the users (based on criteria), use FM BAPI_USER_GET_LIST (or similar name, I am not logged on). Also see FM BAPI_USER_GET_DETAIL for the data on the user you want to take with from 4.7.

Then call BAPI_USER_CREATE with the data you want to take with to ECC 6.0.

The user admin BAPI's are documented in transaction BAPI => Basic Components => User Administration if you want more detailed infos or other options.

Test it in 4.7 DEV to ECC 6.0 DEV first.

After the "migration", delete the connections (SM59) and remove the User Administration access of the SYSTEM type RFC user. Don't enter your own ID into the connection...

Cheers,

Julius

[jurjen_heeck]

> Temporary CUA will flag the user as a CUA user in the target and can cause problems later on. There have already been some threads about this.

Didn't know that and will never advise that again

> Transporting the tables assumes that you find them all and know how to find the correct ones. Don't go that way...

OK, we won't.

> My suggestion: To get the users (based on criteria), use FM BAPI_USER_GET_LIST (or similar name, I am not logged on). Also see FM BAPI_USER_GET_DETAIL for the data on the user you want to take with from 4.7.

>

> Then call BAPI_USER_CREATE with the data you want to take with to ECC 6.0.

>

> The user admin BAPI's are documented in transaction BAPI => Basic Components => User Administration if you want more detailed infos or other options.

That does sound better. We agree again.

[Former Member]

Hi,

The advantage of the BAPIs is that it gets the source data release dependently, and updates the target release dependently while keeping the interfaces of the function modules stable.

Perhaps one of the NW admin or SAP folks who have done upgrades know of other better supported ways (perhaps using "shadow instances"?)

Cheers,

Julius

[WolfgangJanzen]

>

> Temporary CUA will flag the user as a CUA user in the target and can cause problems later on. There have already been some threads about this.

Well, frankly speaking I would have proposed that CUA approach, as well.

What kind of problems did you (or others) experience? IMHO it should be possible to "de-install" a CUA (after moving the user master data from the 4.7 system (acting as CUA client) to the new system (acting as CUA master) - notice: such master data import (CUA client -> CUA master) preserves all user attributes, including the user's password).

The issue with the "user master record is flagged as 'CUA master only' and cannot be used to logon to the system" only occurs when the CUA master system is not a CUA child "of its own" (i.e. if it does not occur in the list of systems which is used to control the user distribution). So, that problem should be easy to avoid (just by adding the own system (CUA master) to the list of CUA child systems).

[Former Member]

Hi Wolfgang,

Yes, it was the threads about "cannot logon" and "where have the tabs gone" which I remembered. Some also had a healthy dose of additional confusion from client copies added to them.

So if that does work (when considering adding the master as a client to itself) then that should work quiet nicely as long as BD87 doesn't think otherwise.

Good point. Thanks for pointing that out to me, and I owe Jurjen a beer

Kind regards,

Julius

[Former Member]

Thanks guys....I owe you both a beer...

Chris

[WolfgangJanzen]

>

> Thanks guys....I owe you both a beer...
> 
> Chris

Last time (end of January) I had a coffee with Julius.

Well, next time a beer - sounds good.

[Former Member]

>

> >

> > Thanks guys....I owe you both a beer...
> > 
> > Chris

>

> Last time (end of January) I had a coffee with Julius.

> Well, next time a beer - sounds good.

My first thought was: There are 3 of us, but only 2 beers. But, I also owe Jurjen a beer already so we are all set with a beer each.

Cheers!

Julius

[Former Member]

Sorry guys....one more question.... Within the User Masters, can we copy JUST the Roles from 4.7 to ECC6?

We are in a Dual Path environment while we are upgrading from 4.7 to ECC, and we are updating Roles in both places, so I wanted to see if we can copy the Roles periodically to move our changes from 4.7 to ECC 6. Can this be done somehow?

Thanks!

Chris

[WolfgangJanzen]

>

> Sorry guys....one more question.... Within the User Masters, can we copy JUST the Roles from 4.7 to ECC6?
> 
> We are in a Dual Path environment while we are upgrading from 4.7 to ECC, and we are updating Roles in both places, so I wanted to see if we can copy the Roles periodically to move our changes from 4.7 to ECC 6.  Can this be done somehow?
> 
> Thanks!
> 
> Chris

Well, to my knowledge PFCG allows to download / upload roles.

And there's even a menu item named "Read from other system by RFC" and also "Transport".

But I cannot tell whether all that works also across release boundaries.

However, transporting roles from an older to a newer release should be possible - I can only imagine that the opposite direction might cause problems (e.g. if the role contains authorization values for authorization objects which do not exist in the older release).

Maybe someone more familiar with roles can comment on this.

Cheers, Wolfgang

[Former Member]

Are you going to use the CUA approach?

By "JUST" do you mean the User Master and the role assignment, but not the role (with all the profiles, authorizations and other role and authorization data) itself? So you want to migrate the users and not loose the role assignment in the process?

You could create only the roles first with the exact same role names in ECC without saving or generating any authorizations / profiles, and then build them from scratch again.

or, you could transport all the roles to ECC and there is a report to delete all the profiles and authorizations. I am not sure of the name anymore though.

If you have setup SU25 and have used SU24 in 4.7 and before then you would want to take that with you to ECC as well to be able to run the upgrade steps. There are number of usefull threads here about SU25 and upgrades already (keep your eye out for posts by Jurjen and Bernhard Hochreiter when you search

Cheers,

Julius

[Former Member]

Thanks Julius and Wolfgang!! I owe you both a beer....except I drink that Lite Beer, and I'm sure you both don't think that's "beer", right?

Well anyway, thanks on your notes....and just as I had thought too. I just wanted to confirm with the experts. I've been doing this for 12 years and thought we could copy them, just wanted to confirm.

No, don't want to take the Users. And yes we have CUA here, just only in some of the Development environments. They are also trying to convert to and use CUA here, but have not done so yet.

But, this dual path updates, doing Security updates in both the 4.7 and ECC 6 systems is a manual coordination nightmare, so I want to propose doing periodic copies of the Roles on a weekly basis to keep both environments in sync. So, copying the Roles or transporting them will work.

Thanks again!

Chris

[Former Member]

Julius -->please mark this as an " update" link

2. Can you give links or expalin how to work with BAPI??