Professional Documents
Culture Documents
SEC Ques PDF
SEC Ques PDF
Organizational level fields should only be created before you start setting up your system. If you create
organizational level fields later, you might have to do an impact analysis. The authentication data may have to
be postprocessed in roles.
The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level
field.
In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field
which is now to become the organizational level field are removed and entered into the organizational level data of the
role.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.
A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;
Now you can login to the client using sap* and password pass
You can also get this information directly from table, if you have access to SE16 or SE16N. Execute SE16N
Table AGR_1251
Object S_TCODE
VALUE (low) SU01
Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table AGR_AGRS
Composite roles You can put multiple composite roles using the more button
Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table AGR_DEFINE
Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table AGR_1252
Role Type in the role here and hit execute.
You can always download all the information to spreadsheet also using .
If you have more than 16 users Click on Authorization data and click on next to users and upload from
clipboard .
Hit the change button and go to the role tab and add the roles to be assigned and hit save.
Q. How to remove duplicate roles with different start and end date from user master?
A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 365841 for more info.
Q. How come the users have authorization in PFCG, but user still complains with no authorization?
A. Make sure the user master is compared. May be the there is a user buffer overflow
Also check the profile- Follow the instruction below.
SUIM > User by complex criteria.
Put the userid of user who is having issue.
Execute
Double click on the user id and expand the tree. Select the profile in question and see if the authorization is
correct or not. If not do the role reorg in PFCG and see if that helps.
Q. How can I have a display all roles.
A. Copy sap_all and open the role and change the activity to 03 and 08
Q. What is SAP?
A. SAP is the name of the company founded in 1972 under the German name (Systems, Applications, and Products in
Data Processing) is the leading ERP (Enterprise Resource Planning) software package.
Q. What is IDES?
A. International Demonstration and Education System. A sample application provided for faster learning and
implementation.
Q. What is Bex?
A. Bex stands for Business Explorer. Bex enables end user to locate reports, view reports, analyze information and can
execute queries. The queries in workbook can be saved to there respective roles in the Bex browser. Bex has the
following components: Bex Browser, Bex analyzer, Bex Map, Bex Web.
Q. What are variables?
A. Variables are parameters of a query that are set in the parameter query definition and are not filled with values until
the queries are inserted into workbooks. There are different types of variables which are used in different application:
Characteristics variables, Hierarchies and hierarchy node, Texts, Formulas, Processing types, User entry/Default type,
Replacement Path.
Q. What is Extractor?
A. Extractors is a data retrieval mechanisms in the SAP source system. Which can fill the extract structure of a data
source with the data from the SAP source system datasets. The extractor may be able to supply data to more fields than
exist in the extract structure.
Q. How do I change the name of master / parent role keeping the name of derived/child role same? I would
like to keep the name of derived /child role same and also the profile associated with the child roles.
A. First copy the master role using PFCG to a role with new name you wish to have. Then you have to generate the role.
Now open each derived role and delete the menu. Once the menus are removed it will let you put new inheritance. You
can put the name of the new master role you created. This will help you keep the same derived role name and also the
same profile name. Once the new roles are done you can transport it. The transport automatically includes the Parent
roles.
C (Check)
- An authority check is carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
N (No check)
- The authority check against this object is disabled.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.
U (Unmaintained)
- No check indicator is set.
- An authority check is always carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization..
You can start the user compare process from within the Profile Generator (User tab and User compare pushbutton). As a
result of the comparison, the profile generated by the Profile Generator is entered into the user master record. Never
enter generated profiles directly into the user master record (using transaction SU01, for example)! During the automatic
user compare process (with report pfcg_time_dependency, for example), generated profiles are removed from the user
masters if they do not belong to the roles that are assigned to the user.
If you assign roles to users for a limited period of time only, you must perform a comparison at the beginning and at the
end of the validity period. You are recommended to schedule the background job pfcg_time_dependency in such cases
Q. What happens to change documents when they are transported to the production system?
A. Change documents cannot be displayed in transaction 'SUIM' after they are transported to the production system
because we do not have the 'befor input' method for the transport. This means that if changes are made, the 'USR10'
table is filled with the current values and writes the old values to the 'USH10' table beforehand. The difference between
both tables is then calculated and the value for the change documents is determined as a result. However, this does not
work when change documents are transported to the production system. The 'USR10' table is automatically filled with the
current values for the transport and there is no option for filling the 'USH10' table in advance (for the history) because we
do not have a 'befor input' method to fill the 'USH10' table in advance for the transport.
Q. What is the difference between the table buffer and the user buffer?
A. The table buffers are in the shared memory. Buffering the tables increases performance when accessing the data
records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a buffer from
which the data of a user master record is loaded when the user logs on. The user buffer has different setting options with
regard to the 'auth/new_buffering' parameter.
To release Task
S_TRANSPRT
ACTVT=43, 03, 75
TTYPE=TASK
Other type:CLCP Client Transports
CUST Customizing Requests
DTRA Workbench Requests
MOVE Relocation transports
PATC Preliminary Corrections and Deliveries
PIEC Piece lists
TASK Tasks
TRAN Transport of copies
S_DATASET
PROGRAM=SAPLSTRF, SAPLSLOG
ACTVT=34
FILENAME=*
S_TRANSPRT
TTYPE=CUST
ACTVT=43, 03, 75
S_DATASET
PROGRAM=SAPLSCTS_RELEASE, SAPLSLOG, SAPLSTRF
ACTVT=33, 34
FILENAME=*
S_RFC
FC_TYPE=FUGR
RFC_NAME=STPA
ACTVT=16;
S_USER_AGR
ACT_GROUP= * (You can restrict by role, if proper naming convention is used)
ACTVT=01, 02, 03, 64 other fields below
01 Create or Generate
02 Change
03 Display
06 Delete
08 Display change documents
21 Transport
22 Enter, Include, Assign
36 Extended maintenance
59 Distribute
64 Generate
68 Model
78 Assign
79 Assign Role to Composite Role
DL Download
UL Upload
S_USER_GRP
CLASS=
ACTVT=22; 03
Other activity
01 Create or Generate
02 Change
03 Display
05 Lock
06 Delete
08 Display change documents
22 Enter, Include, Assign
24 Archive
68 Model
78 Assign
S_USER_TCD
TCD= * (Transaction in role)
S_USER_PRO
PROFILE= *
ACTVT=01, 06
Other activity
01 Create or Generate
02 Change
03 Display
06 Delete
07 Activate, generate
08 Display change documents
22 Enter, Include, Assign
24 Archive
S_TCODE
TCD=PFCG;
SAP Security Interview Questions
The table USOBT_C defines for each transaction and for each authorization object which default values an
authorization created from the authorization object should have in the Profile Generator.
Q What authorization are required to create and maintain user master records?
The following authorization objects are required to create and maintain user master records:
1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your
own password. Check for multiple dialog logon
2. A Service user - Only user administrators can change the password. No check for expired/initial
passwords. Multiple logon permitted
3. System users are not capable of interaction and are used to perform certain system activities, such as
background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System user, a general, non-personally related, user. Additional
authorizations can be assigned within the system using a reference user. A reference user for additional
rights can be assigned for every user in the Roles tab.
Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the
functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only
inherit menus and functions if no transaction codes have been assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values which can be
changed afterwards. Organizational level definitions are not passed on. They must be created anew in
the inheriting role. User assignments are not passed on either.
Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical
menus and identical transactions) but have different characteristics with regard to the organizational
level. Follow this link for more info
A composite role is a container which can collect several different roles. For reasons of clarity, it does not
make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are
also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations (that are
represented by a composite role), you must maintain the data for each role of the composite role.
Creating composite roles makes sense if some of your employees need authorizations from several roles.
Instead of adding each user separately to each role required, you can set up a composite role and assign
the users to that group.
The users assigned to a composite role are automatically assigned to the corresponding (elementary)
roles during comparison. Follow the link to learn more