Assignment of Role to user for testing/debugging

[Former Member]

Hi

I need to create a user in SAP system for Testing and debugging.

Is should not violate the security.

May i know what role shall i assign to him?

It finding it hard, can you assist me?

Cheers

Ricky

[jurjen_heeck]

> I need to create a user in SAP system for Testing and debugging.

So, create a user.

And try to find out what needs to be tested and/or debugged and in which system, dev/test/prod....

> Is should not violate the security.

Please define "the security".

> May i know what role shall i assign to him?

How should we know which roles are available in your system?

> It finding it hard, can you assist me?

Tricky one, my psychic abilities fall short here.

Unfortunately this is not the kind of questions we can answer easily. You'll have to provide more information.

Jurjen

[Former Member]

I need to create a user in SAP system for Testing and debugging.

So, create a user.

And try to find out what needs to be tested and/or debugged and in which system, dev/test/prod....

ans : PROD

What are the basic roles should a tester/debuger have?

There must be standard SAP ROles, so out of those which one should be assigned to the person.

Application: MM/FICO

I dont much about Security, so i need

[jurjen_heeck]

> What are the basic roles should a tester/debuger have?

> There must be standard SAP ROles, so out of those which one should be assigned to the person.

> Application: MM/FICO

>

> I dont much about Security

You do not know much about security but assume and insist there's a quick fix for your problem? For both MM and FICO? If I search for SAP standard roles with SAP_FI* and SAP_MM* I get over 300 hits. That's without the debugging question taken into acount.

I'm afraid you're trying to over-simplicate something here, especially by stating 'which one '.....

Oops, forgot SAP_CO*. Grand total now over 400

Edited by: Jurjen Heeck on Sep 11, 2008 2:17 PM

[Former Member]

Can you please tell me, what informaation i shall i give you?

I can't create a user in Production with SAP_ALL profile.

If you had, get the similar situation, what whould you haad done.

Guide me.

[jurjen_heeck]

> If you had, get the similar situation, what whould you haad done.

I would have copied the account of the 'problematic user' (the one that triggered the need for a test/debug session)

Next to these authorizations I would build a small role with SE80 and make sure all S_* objects only have the value '03' in the ACTVT fields. That one I would present to the auditors and wait to see what they have to say. If it's still a no-no a refresh of the test system would be the next option.........

Jurjen

(Yes, I know, different account. Just activated my own OSSid)

[former_member1061482]

If your requirement was for creating a ABAP Developer role, then you could have used SAP menu.

Sadly, I don't find any thing related solely for testing and debugging.

You can do one thing:

Goto pfcg

Give the new role name e.g. ZTestDebug

Now on right hand side of menu tab, you will find copy menus

In that click on ->from SAP menu

Inside that search for ABAP Workbench. You may find more than one such hits. Select the one which has folders for overview, development, test, utilities etc.

Out of these, deselect all the folders except test and add to the menu.

In the menu , manually add t-codes required by your team for debugging like se80 etc. And as mentioned by Jurjen make sure that you give activity as display for these.

Generate the role and assign to necessary users.

[former_member248712]

Did you try reading this book - Authorization Made Easy. Check this thread in case you want the link.

AB

[Former Member]

partially

[Former Member]

Hello,

Create a new role and add this object:

ABAP Workbench S_DEVELOP

Activity 02, 03 ACTVT

Development class for Transpor * DEVCLASS

Object name * OBJNAME

Object type DEBUG OBJTYPE

Authorization group ABAP/4 pro * P_GROUP

This will add Debug and Replace.

[Former Member]

>

> partially

The debugging is not only an authorization topic on it's own. You also need to consider what you want to (permit) debug (of), how your system is setup to handle the debugging (abap and dispatcher params) and the user type in combination with the params.

I don't think it is possible to set this up correctly for a specific scenario without knowing what that scenario is, which release you are on and how much you know about the different types of debugging.

> It finding it hard, can you assist me?

If in doubt, do not permit it at all. Good developers whom I know tell me that even debugging in a development system is a symptom of a not-too-good program in the first place.

Cheers,

Julius