User master records, roles and profiles, authorisation objects, tracing authorisation failures, and segregation of duties.
Contents
Authorisation management is among the most audited parts of Basis. Controlling who can do what is basic internal control.
The user master
User types
Type
Purpose
Can log on?
Dialog
A human user
Yes
System
Background processing and RFC
Not via GUI
Communication
System-to-system RFC
Not via GUI
Service
Anonymous access
Yes, multiple sessions
Reference
Collects shared authorisations
No
Roles and profiles
Kinds of role
Kind
Content
Single role
The basic unit of authorisation
Composite role
Several single roles bundled by job function
Derived role
Inherits authorisations, varying only organisational values
Derived roles suit the same job performed at different sites: one parent buyer role, derived per plant, so only the accessible plants differ and changes to the parent propagate.
Authorisation objects
An example object
M_BEST_WRK (purchase order / plant)
ACTVT: 01 create, 02 change, 03 display
WERKS: 1000, 2000
-> the user may create, change and display
purchase orders for plants 1000 and 2000
Objects worth knowing
Object
Controls
S_TCODE
Which transactions may be started
S_PROGRAM
Which programs may be run
S_TABU_DIS
Table display and maintenance
S_DEVELOP
Access to development objects
S_USER_GRP
User administration
S_BTCH_JOB
Background job operations
Investigating authorisation failures
Code
Purpose
SU53
The last failed authorisation check; quickest
ST01
Authorisation trace with full detail
STAUTHTRACE
Longer traces across several users
SUIM
Reports on users and roles
Segregation of duties
Combinations to keep apart
Combination
Risk
Create vendors and run payments
Invent a vendor and pay it
Create purchase orders and post receipts
Record deliveries that never happened
Raise credit memos and release billing blocks
Issue fraudulent refunds
Create users and assign roles
Grant yourself unlimited access
Develop and transport to production
Put untested code live
Check your understanding
Test what you just read.
Quiz 1
Which transaction code is used to create and modify SAP users?
Quiz 2
Which transaction code is used for role creation and authorization assignment?
Quiz 3
A Dialog user is the user type used for interactive login via SAP GUI.
Quiz 4
Which user type is used for background processing and RFC communication?
Quiz 5
Which transaction checks the details of a recent authorization failure?
Quiz 6
It is recommended to assign authorizations to users through roles rather than directly.
Hear when the paid version launches
A paid version is in preparation, with no ads, saved learning progress and many more practice questions. Leave your email and you will be told when it launches.
Your email address is used only to announce the paid version.