You are on page 1of 67

IBM Global Business Services

User Administration

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:


Know what are the responsibilities of a user administrator
What are the components of User master
What are the different user types
How to maintain users in SU01

2007 IBM Corporation


2 User Administration March-2007
IBM Global Business Services

User Administration :

Maintaining User Master records


Giving authorization by adding roles or profiles (SAP Profiles)
Display authorization and profiles
Maintain Roles
Generate Authorization Profiles

2007 IBM Corporation


3 User Administration March-2007
IBM Global Business Services

Components of the User Master Record:

Address Logon Data Defaults Parameters Roles Profiles Groups Personalization License Data

Personal data,
Communication
data, Company Assignment of Assignment of
address roles user groups
Assignment of
license data
Start menu, logon Assignment of
language, default profiles
printer

Default values for Assignment of


parameter IDs personalization
User group, user
type, validity
period

2007 IBM Corporation


4 User Administration March-2007
IBM Global Business Services

SAP User Type:

Dialog user
Logon with SAPGUI is possible. The user is therefore interaction-capable with the
SAPGUI.
Expired or initial passwords are checked.
Users have the option of changing their own passwords.
Multiple logon is checked.
System User
Logon with SAPGUI is not possible. The user is therefore not interaction-capable with
the SAPGUI.
The passwords are not subject to the password change requirement, that is, they
cannot be initial or expired.
Only an administrator user can change the password.
Multiple logon is permitted.

2007 IBM Corporation


5 User Administration March-2007
IBM Global Business Services

SAP User Type Cont


Service User
Logon with SAPGUI is possible. The user is therefore interaction-capable with the
SAPGUI.
The passwords are not subject to the password change requirement, that is, they
cannot be initial or expired.
Only a user administrator can change the password.
Multiple logon is permitted.

Communication User
Logon with SAPGUI is not possible. The user is therefore not interaction-capable
with the SAPGUI.
Expired or initial passwords are checked but the conversion of the password
change requirement that applies in principle to all users depends on the caller
(interactive/not interactive). (*)
Users have the option of changing their own passwords.

2007 IBM Corporation


6 User Administration March-2007
IBM Global Business Services

SAP User Type Cont

Reference User

No logon possible.
Reference users are used for authorization assignment to other users

2007 IBM Corporation


7 User Administration March-2007
IBM Global Business Services

User Maintenance:

2007 IBM Corporation


8 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


9 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


10 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


11 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


12 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


13 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


14 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


15 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


16 User Administration March-2007
IBM Global Business Services

User Maintenance contd..

2007 IBM Corporation


17 User Administration March-2007
IBM Global Business Services

Questions ?

2007 IBM Corporation


18 User Administration March-2007
IBM Global Business Services

Address Field in User wrt Address Management

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:


Recognize what is company address
How company address can be created
How a user can be assigned to a company address

2007 IBM Corporation


20 User Administration March-2007
IBM Global Business Services

Company Address Creation of Company

You can create, maintain and display Company address using the tcode SUCOMP

2007 IBM Corporation


21 User Administration March-2007
IBM Global Business Services

Company Address Creation of Company

You need to enter the above information and click on save


2007 IBM Corporation
22 User Administration March-2007
IBM Global Business Services

Company Address

The very first company need to be created in SUCOMP. After that all the newly
created users have the default company address automatically assigned to them. To
demonstrate the concept we need to have a look at the SU01 screen.

2007 IBM Corporation


23 User Administration March-2007
IBM Global Business Services

Creation of User

Create a user in SU01

2007 IBM Corporation


24 User Administration March-2007
IBM Global Business Services

Assign Company Address

The user is automatically assigned to the default company address

2007 IBM Corporation


25 User Administration March-2007
IBM Global Business Services

Assign other Company Address

You can assign this user to any of the existing company address using the button
Assign other company address

2007 IBM Corporation


26 User Administration March-2007
IBM Global Business Services

Assign Company Address

From here you can also create a new company address

2007 IBM Corporation


27 User Administration March-2007
IBM Global Business Services

Company Address contd..

You need to enter the new company name what you do in SUCOMP

2007 IBM Corporation


28 User Administration March-2007
IBM Global Business Services

Company Address

The same screen


like SUCOMP and
the same steps are
required to be
performed.

2007 IBM Corporation


29 User Administration March-2007
IBM Global Business Services

Questions ?

2007 IBM Corporation


30 User Administration March-2007
IBM Global Business Services

User Groups

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:


The concept of user group
Specify the group for a user
Realize the importance of user groups in the context of user administration

2007 IBM Corporation


32 User Administration March-2007
IBM Global Business Services

User Group:

User group can be used for different purpose and in different


way in an SAP environment -

One of the Primary uses of user groups is to sort users into logical groups.

This allows users to be categorized in a method that is not dependent on roles,


Responsibilities & Profiles etc.
User Groups also allow segregation of user maintenance, this is especially useful in
a large organization as you can control who your user admin team can maintain - an
example would be giving a team leader the authority to change passwords for users in
their team.

2007 IBM Corporation


33 User Administration March-2007
IBM Global Business Services

User Group
In the latest versions of SAP, actually two types of user group exist

The authorization user group (exist in Logon data tab in the user
master record)

The general user groups (exist in Group tab in the user master
record)

The authorization user group is used in conjunction with S_USER_GROUP


authorization object. It allows to create security management authorization by
user group. e.g. you can have a local security administrator only able to
manage users in his groups, Help-Desk to reset password for all users except
users in group SUPER, etc..

The general user group can be used in conjunction with SUIM and SU10, to
select all the users in a specific group. User can only be member of one
authorization user group but several general user group.

2007 IBM Corporation


34 User Administration March-2007
IBM Global Business Services

User Group (SUGR):

2007 IBM Corporation


35 User Administration March-2007
IBM Global Business Services

User Group

2007 IBM Corporation


36 User Administration March-2007
IBM Global Business Services

User Group

2007 IBM Corporation


37 User Administration March-2007
IBM Global Business Services

User Group

2007 IBM Corporation


38 User Administration March-2007
IBM Global Business Services

User Group

USER GROUPS for authorization Check are used for access control to transactions and
tables based on user group assignment for a particular user and to which respective group
he/she belongs and the tables and transactions and reports that group has access.

Groups tab on SU01 Transaction is used for logical grouping of users based on similar
functionalities and for mass operations of same type for multiple users.

2007 IBM Corporation


39 User Administration March-2007
IBM Global Business Services

Questions ?

2007 IBM Corporation


40 User Administration March-2007
IBM Global Business Services

Mass Change for users

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:


Use SU10 as a mass user maintenance tool
Display the log once the mass changes are done.

2007 IBM Corporation


42 User Administration March-2007
IBM Global Business Services

Mass changes:

Logon data

Defaults Roles

Mass Changes (Su10)

Profiles
Parameters

Passwords

2007 IBM Corporation


43 User Administration March-2007
IBM Global Business Services

Mass Changes (SU10):

Address Data Authorization Data

2007 IBM Corporation


44 User Administration March-2007
IBM Global Business Services

Mass Changes (SU10):

Please check the


change check box
other wise
changes will not
take place

2007 IBM Corporation


45 User Administration March-2007
IBM Global Business Services

Mass Changes Log:

2007 IBM Corporation


46 User Administration March-2007
IBM Global Business Services

Questions?

2007 IBM Corporation


47 User Administration March-2007
IBM Global Business Services

Authorization objects S_USER_GRP..

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:

Understand the importance of different authorization objects related to user


administration

Divide the administrative power among various roles to be used by administrator.

2007 IBM Corporation


49 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:

S_USER_GRP - User Master Maintenance: User Groups

S_USER_PRO - User Master Maintenance: Authorization Profile

S_USER_AUTH - User Master Maintenance: Authorizations

S_USER_AGR - Authorizations: Role Check

S_USER_TCD - Authorizations: Transactions in Roles

S_USER_VAL - Authorizations: Field Values in Roles

2007 IBM Corporation


50 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:


S_USER_GRP Auth. Object

CLASS Field

ACTVT Field

01: Create
02: Change
03: Display
05: Lock, unlock
06: Delete
08: Display change documents
22: Add users to activity groups
24: Archive
78: Assign
68: Model users and assign to systems or activity groups in user management. The
models are used later as templates for the actual assignments.

2007 IBM Corporation


51 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:

S_USER_PRO Auth. Object

Profile Field

ACTVT Field

01: Create
02: Change
03: Display
06: Delete
07: Activate
08: Display change documents
22: Assign profile to users / remove
assignment
24: Archive

2007 IBM Corporation


52 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:

S_USER_AUTH Auth. Object

Authorization object Field

Authorization name Field

Activity Field

01 = create
02 = change
03 = display
06 = delete
07 = activate
08 = display change documents
22 = assign authorization profiles
24 = archive

2007 IBM Corporation


53 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:

S_USER_AGR Auth. Object

ACT_GOUP Field

Activity Field

2007 IBM Corporation


54 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:

01 Create roles
02 Change roles
03 Display roles
06 Delete roles
22 Compare role user master records
The profiles generated in the Profile Generator are transferred into the user
master record for the relevant role users.
36 This activity is not yet used. It is planned for use for additional objects that
can be maintained from the roles.
21 Transport role
59 Distribute roles to another system using RFC
64 Generate authorization profiles from the role
68 Modeling: Assigning roles to systems or users in user management using
models. The actual assignments can be derived from these models later.
78 Assignment of roles to systems or user groups in the central system when
using Central User Administration.
79 Assignment of individual roles to composite roles.
DL Download Save roles to a file
UL Upload Upload roles from a file

2007 IBM Corporation


55 User Administration March-2007
IBM Global Business Services

Authorization objects for Maintaining User master record:


S_USER_TCD Auth. Object

TCD Field

T-Code

S_USER_VAL Auth. Object

OBJECT Field

AUTH_FIELD Field

AUTH_VALUE Field

2007 IBM Corporation


56 User Administration March-2007
IBM Global Business Services

Authorization Objects for User Administration:

S_USER_GRP

ACTVT
CLASS

S_USER_SYS

ACTVT

SUBSYSTEM

2007 IBM Corporation


57 User Administration March-2007
IBM Global Business Services

Authorization Objects for Role Administration:

S_USER_AGR

ACTVT
ACT_GROUP

S_USER_TCD

TCD

S_USER_VAL

OBJECT
AUTH_FIELD
AUTH_VALUE

2007 IBM Corporation


58 User Administration March-2007
IBM Global Business Services

Authorization Object for Profiles & Authorizations


Administration:
S_USER_PRO

ACTVT
PROFILE

S_USER_AUT

OBJECT
OBJECT
ACTVT

2007 IBM Corporation


59 User Administration March-2007
IBM Global Business Services

Questions?

2007 IBM Corporation


60 User Administration March-2007
IBM Global Business Services

User Buffer introduction

User Administration March-2007 2007 IBM Corporation


IBM Global Business Services

Objectives

The participants will be able to:


Realize the concept of User Buffer.
To view the user buffer.

2007 IBM Corporation


62 User Administration March-2007
IBM Global Business Services

User Buffer:

When a user logon to the SAP, the


authorizations present in his/her user master
record are copied in memory area called User
Buffer. Each user has his or her own user buffer.
When the users try to perform activities in the
SAP environment, authorizations are checked in
the user buffer. If the required authorization is in
the user buffer, he/she will perform the activity
successfully otherwise system will show the pop
up You are not authorized

2007 IBM Corporation


63 User Administration March-2007
IBM Global Business Services

User Buffer:
A user would fail an authorization check if:

The authorization object does not exist in the


user buffer.

The values checked by the application are not


assigned to the authorization object in the user
buffer

The user buffer contains too many entries and


has overflowed. The number of entries in the user
buffer can be controlled using the system profile
parameter auth/number_in_userbuffer.

2007 IBM Corporation


64 User Administration March-2007
IBM Global Business Services

User Buffer:
User can display his/her own user buffer using the transaction SU56

2007 IBM Corporation


65 User Administration March-2007
IBM Global Business Services

Authorization update in the User Buffer:

Any change in authorizations in the user master


record should be updated in the user buffer. This
update can happen two ways
User has to logoff and re-login to get the effect
of authorizations change.
The parameter auth/new_buffering set to be 4.
So that authorization changes take place
immediately and no need to logoff from the
system.

2007 IBM Corporation


66 User Administration March-2007
IBM Global Business Services

Questions ?

2007 IBM Corporation


67 User Administration March-2007