Use the Authorization Editor to set up the SAP function authorization definition. To do this, group SAP applications and authorization objects together that should be covered by the SAP function.
To compile an authorization definition
- In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
- Select the function definition in the result list.
- Select the Authorization Editor task.
- Select one of the following tasks.
-
1. Add by menu template
Select from which menu you want to select the menu items and the SAP system whose menu tree should be displayed. Then select a menu item from the menu tree. Transaction codes that are linked to a menu item are shown in brackets in the menu tree as additional information.
All the transactions and their authorization objects are loaded that can be called from the selected menu item or its submenu items.
-
2. Add by SAP application
Select the type of SAP application and the SAP application whose authorization objects should be loaded into the Authorization Editor. All authorization object are added that are linked with the selected SAP application. You can defined a file to list the limit the number of SAP applications available.
-
3. Add via existing function definition
Select an existing function definition whose authorization definition is to be loaded into the Authorization Editor.
Only the enabled function definitions can be selected.
-
-
Specify details for each element in the Authorization Editor.
- Save the changes.
The functionality of the Authorization Editor is based on the SAPGUI Authorization Editor. The columns in the Authorization Editor have the following meaning.
Property |
Description |
---|---|
Function definition / SAP application / authorization / function element |
Function definition hierarchy. SAP applications, their associated authorization objects and function elements are mapped in a hierarchy. |
Processing status |
Processing status of hierarchy objects. : No value is specified for the function element. : A value is specified for the function element. |
Add |
Click +, to add more objects to the authorization definition. This adds a sub object. Click C, to copy the function element. |
Remove |
Click -, to remove objects from the authorization definition. |
Description |
Object description. |
Any |
Click *, to define the value of a function element as * (any value). |
Value / lower limit |
Values permitted for the function element. For example, you can limit SAP authorizations to specific SAP groups. When you specify a range, enter the lower limit here. Values can be added as variables. System variables can also be used. Wildcards can be used in the values. For more information, see Syntax examples for values. |
Display value / lower limit |
Display name for the function element's value, when a hash value is specified, for example. |
Upper scope limit |
Upper limit for the range of a function element Values can be added as variables. |
All function elements in an SAP application that are defined in a separate row must be fulfilled for the SAP function to match. If the SAP functions should only match when an SAP profile has one of several possible instances of one and the same function element, define this instance as a comma-delimited list of values for this function element.
To edit the properties of the selected object
-
Double-click on a function element in the Authorization Editor.
You can edit the description of the function element and the upper and lower limits.
Property |
Description |
---|---|
Type |
Specifies whether the selected function element is an activity or a authorization field. |
Name |
Name of the function element. |
Lower limit, upper limit |
Values permitted for the function element. When you specify a range, enter a lower and an upper limit. Values can be added as variables. Click to select variables from the variable definitions available. |
Description |
Detailed description of the function elements. |