SAP_ALL usage

[former_member586384]

Hello ,

I want to know the main usage of SAP_ALL profile for RFC communications

(other than Basis work).

Can it be used for all RFC/ALE ids in production systems ?

Can SAP_ALL be a firefighter profile for dialog users (emergency

access) ?

Can SAP_ALL be given to Batch ids ?

Thanks in advance,

[sdipanjan]

>

> I want to know the main usage of SAP_ALL profile for RFC communications

> (other than Basis work).

>

No.. not needed.

> Can it be used for all RFC/ALE ids in production systems ?

>

No.. not needed.

> Can SAP_ALL be a firefighter profile for dialog users (emergency

> access) ?

>

Yes.. current audit scenario also tells not to use SAP_ALL for emergency users too..

> Can SAP_ALL be given to Batch ids ?

>

No.. not needed.

[Former Member]

Theoretically you can, but Dipanjan's answer is much more secure...

I think a License by Authority model would not sell very well, but would also be much more secure and authorizations would be more realistic for some of the user classes you have mentioned.

Cheers,

Julius

[Former Member]

Hi ,

I production system no user should have SAP_ALL profile except the OSS ids. If no specific role was created within the system for some particular access, SAP_ALL can be provided with limited validity.. but for audit issue, Security log(SM20 log) should be taken for that time period.

Also I would prefer to run ST01 trace against the user id to know the what authorizations are required to do the specific job.. Then proper role should be created as per requirement to avoid assignment of SAP_ALL profile. This new role can be used for emergency access.

Also for interface users also, assignment of SAP_ALL should be avoide.. Here also you should take trace against the interface user. In that case, you need to run the trace in both the systems where they are working.

But please note that running of trace may slow down the system performance.. So try to run trace when system load is minimum and try to run it only for the time when the user id is used.

Regards,

Sandip.

[Former Member]

This message was moderated.