Real role and ideal role comparison

[OttoGold]

Hello, ladies and gentlemen,

I would like to write an experimental program that would help me understand how some weird and big roles, I have here, were created. I feel that some parts of the roles come from the SU24 suggestions and some were obviously changed/ added manually.

Here is what I would like to compare

a) the ideal role, if it would be generated only (no manual changes) based on the SU24 suggestions for the "objects" listed in the role menu

The premise here is that I can generate a reasonable and usable role based on the SU24 entries only. If you think this is crazy, let me know, but also let/ help me build the report so I can learn myself:))

b) a real role - the one that exists in the system

I can get a list of the auth objects that are parts of the role easily (tab AGR_1251).

I can also get a list of SU24 suggestions for various objects I can use in the role menu.

The last step to be able to build the comparison is that I don`t know how to connect role menu entries with the role. Or better: I can easily get a list of transactions used in the menu. That`s fine. But I can also add a function module into the menu (for example) but see this one as a SERVICE in tables only, without the additional details (FM name would be nice).

So I am not able to use this "SERVICE" to go to USOBX_C and get the SU24 suggestions for the function module.

Can anybody suggest a way, how can I get a whole list of objects used in a role menu, not only the transactions?

Thanks,

Otto

[mvoros]

Hi,

if you open a role in PFCG you can see which authorization objects were added manually to the role and which have modified values from default SU24 values (see [documentation|http://help.sap.com/saphelp_nw04/helpdata/en/5c/deaa77d3d411d3970a0000e82de14a/frameset.htm]). I don't have access to any system right now but you should be able to figure out what logic is used in PFCG. You might be able just to reuse internal function module.

Cheers

[OttoGold]

Hello Martin, thank you for the suggestion

if you open a role in PFCG you can see which authorization objects were added manually to the role and which have modified values from default SU24 values (see documentation)

This is the easy part. I can read everything about the role.

What I cannot read from DB (I am a developer so obsessed with tables and views) is how would the role look like without those modifications. How can I do that?

I`d rather avoid reading the change documents for example. Not nice.

Removing parts which are changed does not help, I don`t know if part was added manually, changed after being ivolved by the generation process and this way I cannot process those items which were removed completely, can I?

Thank you anyway,

Otto

[Bernhard_SAP]

Hi Otto,

please have a look at FM SUPRN_AUTH_DATA_IN_EXP_MODE coming with note 1441463.

You can read the authorization data depending on the value of parameter EXPERT_MODE:

'N', Delete and recreate (-->from scratch as per SU24 values)

'D', Edit old status (-->current existing values)

'M'. Read old and merge (-->what would be the result of an actual merge )

if you compare the results for isntance of 'N' and 'D' you propably are a step nearer to the required result....

Just a thought....

b.rgds, Bernhard

[OttoGold]

Hello Bernhard

please have a look at FM SUPRN_AUTH_DATA_IN_EXP_MODE coming with note 1441463.

This might be it, but I am not sure what do I see. I spend some time playing with the function module, but still could use a hint.

a) how do you explain what you see when comparing the results for N and D?

b) can you name attributes of the role which could work as a nice example? I am afraid I am not getting all the depth here because using it on roles that cannot show much...

Thank you very much,

I can smell the success now:))

cheers Otto

[OttoGold]

Not to ask stupid questions, I started tests from scratch. And I found something I can use nicely as well, FM: PRGN_ACTIVITY_PROF_INTERN_READ which returns the entries from the role menu. Sub-objective completed.

[mvoros]

Hi,

N means that you just added all transactions and additional stuff to user's menu in PFCG and you open authorizations for that role for the first time. So it takes all values from SU24 but you still need to enter values for all fields which don't have any proposed value in SU24. So it's really hard to tell what ideal role looks like. D means that it reads current authorizations for that role. So you can compare results. So you can have some extra authorizations in second results. These are manually added objects. You can have some extra authorizations in the first result. These should be deleted authorizations. Your problem will be with merged authorizations (it's impossible to split them).

BTW PRGN_ACTIVITY_PROF_INTERN_READ is used by SUPRN_AUTH_DATA_IN)_EXP_MODE and this FM is basically really similar to FM SUPRN_PROFILE_GENERATOR which is used in PFCG.

Cheers

[OttoGold]

Hello Martin,

what I spotted was that when I launch the FM with parameter D, then I receive the old values and the new ones. So I see no point in comparing N and D output. But I might be missing something, otherwise you would not suggest it, right. So you think that I can get something more out of the FM than launching it for D and looking for the "change" flags?

Could you please describe an example where one can see a difference in the output of those two calls?

About that ideal role. I know that the generated role might (most likely will) be "incomplete", but "incomplete" standard is still better than a role that was manually changed by somebody who was "not sure about all he was doing", hm? I am trying to learn how much are the roles (roles generally) changed manually, so how much does the admin/ role builder using SU24 or if he is driven by the wind direction.

Thanks,

Otto

[mvoros]

Hi,

that mode just goes through current values in SU24 and checks if that authorization is in the role. If not then it inserts it and flag it as new. It does not touch manually added objects. So you need to think if that's what you want. You can interpret it as if there is object flagged as new than somebody modified proposed authorizations. Don't forget that you might get false positive when there were changes in SU24. You also need to check if there are any manually added objects.

Using those two modes allow you to do comparison in both ways. Not only from SU24 to current role values.

Cheers

[Former Member]

Hi Otto,

Should the 'MODIFIED' field in table AGR_1251 help here.

Table AGR_HIER, field 'extended name' (=SERVICE) OR Reporttype not equals to TR can give where Tcode is added as Service.

The comparision,of course is not so quick, specially if you have big implementation. May xls or access be also helpful here (analysing data from agr_1251, USOBT_C, AGR_TCODES, AGR_HIER).

--Kamal

[OttoGold]

Hello Kamal,

one of us does not understand. If it is me, then I would like to ask you for more elaboration.

Table AGR_HIER, field 'extended name' (=SERVICE) OR Reporttype not equals to TR can give where Tcode is added as Service.

If this should answer the part of my question about RFC function modules for example, then I don`t see your point. I can get all the information about the tcodes used in the role menu. I want to be able to read the information about other menu "tems" on the same level of detail. And from your answer I feel that you`re helping me with transactions. The only part i can do myself.

Thanks for your time and effort,

have a nice day,

Otto