Configuring single role assignment
Only directly assigned single and composite roles are mapped in SAPUserInSAPRole. Assignments of single roles to composite roles are mapped in SAPCollectionRPG. You can establish which single roles are indirectly assigned to a user account through both tables.
The following applies by default for the inheritance of single roles by user accounts: If a single role is assigned to a user account and this single role is part of a composite role that is also assigned to the user account, then the assignment of the single role is additionally mapped in the SAPUserInSAPRole table if the validity period of the assigned single and composite role is not identical.
To not map memberships in single roles in the SAPUserInSAPRole table if the single roles are part of assigned composite roles
-
In the Designer, disable the TargetSystem | SAPR3 | KeepRedundantProfiles configuration parameter.
The table contains only the membership in the composite role.
Effect of the KeepRedundantProfiles configuration parameter
A single role is assigned to a user account, as well as a composite role that contains this single role.
-
The configuration parameter is set. Both role assignments have a different validity period.
The SAPUserInSAPRole table contains both the composite role assignment and the single role assignment.
-
The configuration parameter is set. Both role assignments have the same validity period.
The SAPUserInSAPRole table contains only the assignment of the composite role.
-
The configuration parameter is not set.
The SAPUserInSAPRole table contains only the assignment of the composite role. This applies regardless of the validity period of either role assignment.
Related topics
Inheriting SAP profiles and SAP roles in a central user administration
If user accounts are managed through the central user administration, SAP roles and profiles can only inherited by user accounts if the user accounts have access permission for the client that the role and profiles belong to. By default, roles and profiles can only be inherited by user account if access to the clients is guaranteed explicitly. Otherwise, the roles and profiles are not inherited.
User accounts can be granted the missing client access automatically as soon as a role or profile is inherited by the client.
To automatically grant missing access permission to user accounts
The missing access permission is granted when inheritance is calculated (entry in the SAPUserMandant table) and the roles and profiles are assigned to the user accounts.
|
|
WARNING: As inheritance is an automated process, user accounts can therefore be given access permission to clients without the target system owners knowing about it. |
Related topics
Additional tasks for managing SAP groups, SAP roles, and SAP profiles
After you have entered the main data, you can run the following tasks.
Overview of SAP groups, SAP roles, and SAP profiles
To obtain an overview of a group
- Select the SAP R/3 > Groups category.
- Select the group in the result list.
- Select the SAP group overview task.
To obtain an overview of a profile
- Select the SAP R/3 > Profiles category.
- Select a profile in the result list.
- Select the SAP profile overview task.
To obtain an overview of a role
- Select the SAP R/3 > Roles category.
- Select the role in the result list.
- Select the SAP role overview task.
