Read-Only Role For User Admin

[Former Member]

Hi, I am trying to implement a role that would enable a user to have the same functionality as the out-of-the-box User Admin role, but that this user would not be able to actually create or modify users, roles assignments, etc.

The idea is to have a 'Display' role - with read-only access.

The solution we are comtemplating right now involves getting the source code from SAP, copying it, and modifying it - disabling any interaction. We would then create new iviews, pages, etc from there only for this role. This is a tedious task.

Any ideas on how else this can be done?

Thanks

[Former Member]

I have only managed to do this by creating a role and assigning the relevant User Admin iViews to the role and then changing the End User Permissions on the role.

I assigned the ReadAll Premission. That did the trick for me.

Groups unfortunately require the manage_groups Permission, so we do not allow the viewing of groups.

[Former Member]

If you upgrade to SP11 you get a new read only user admin tool:

http://portal:port/webdynpro/dispatcher/sap.com/tc_secume_wdenduser/UserViewerApp

Cheers

[Former Member]

You can quickly write some pars using usermanagement api.

[Former Member]

Thanks for your input Prakash. Can you elaborate a bit on this solution? Would we need to rewrite the whole user admin interface? Or is there any way we can just modify the existing PAR files?

Thanks

[Former Member]

Have you tried changing the permissions for the User Admin Role?

Go to System Administration -> Permissions and then under Content Provided by SAP -> Admin content -> User Administrators. Maybe create a new role that you can assign Read only permissions to this object.

Good luck,

Robin.