SAP Library - Find your answers

I want to create new user for SAP module. I am having user id as sap* (someone has said that this is super user id); when I login with this id and go to IMG for configurations. A message is displayed that I am not authorised to change the details with sap* user.

What is the procedure for creating new user which have all features define under SAP* user and which could allow me to make the configruations.

Creating new user with superuser authorizations.

1. Goto SU01 --
username : sapuser
|-->Create.

2. In default settings, give
:Mr
first name : sap
lastname : user

3. Goto next tab,
give initial password :1234
repeat password : 1234

4. Goto profiles.
type- sap_all (say enter)
sap_new (say enter)
Then save....
See the message in status bar, (user created successfully)

5. Login with the new user. change the password. now this user contains all superuser authorizations.

Administrators who use the Profile Generator require authorization for the following authorization objects: S_USER_AGR Authorization Check for Activity Groups

• Authorization objects enable complex checks of an authorization, which allows a user to carry out an action. An authorization object can group up to 10 authorization fields that are checked in an AND relationship.
• For an authorization check to be successful, all field values of the authorization object must be maintained accordingly. The fields in an object should not be seen as input fields on a screen. Instead, fields should be regarded as system elements, such as infotypes, which are to be protected.
• You can define as many system access authorizations as you wish for an object by creating a number of allowed values for the fields in an object. These value sets are called authorizations. The system checks these authorizations in OR relationships.

Creating New User With Authorizations

I want to create new user for SAP module. I am having user id as sap* (someone has said that this is super user id); when I login with this id and go to IMG for configurations. A message is displayed that I am not authorised to change the details with sap* user.

What is the procedure for creating new user which have all features define under SAP* user and which could allow me to make the configruations.

Creating new user with superuser authorizations.

1. Goto SU01 --
username : sapuser
|-->Create.

2. In default settings, give
:Mr
first name : sap
lastname : user

3. Goto next tab,
give initial password :1234
repeat password : 1234

4. Goto profiles.
type- sap_all (say enter)
sap_new (say enter)
Then save....
See the message in status bar, (user created successfully)

Access control in SAP is composed of several concepts:

1. Program code that calls an authorization check using the authority-check statement. This will look something like:

   authority-check object id field

2. Authorization fields (corresponding to the in the above code) that define a scope of possible values. Examples of authorization fields would be:

   ACTIVITY: defines the type of activity the user is doing with the data. Possible values are 'DISPLAY', 'MODIFY', 'DELETE', etc.

   
   

   COMPANY_CODE: possible values are any single value, or any range of values, or any combination thereof (such as '0438' and '0600' thru '1100')

3. Authorization objects that define a group of fields. For example, an authorization object called 'CO_MDATA', containing our above fields ACTIVITY and COMPANY_CODE, might used to control access to the company master data tables.

4. Authorizations, each of which belong to exactly one authorization object, that define authorization values (within the scopes defined by the authorization objects) to be granted to users. Note that an authorization is different from an authorization object!! Extending our previous examples, we might have an authorization, belonging to the authorization object 'CO_MDATA', called 'CO_MDATA_ALL', that grants all access to all company master data. Then 'CO_MDATA_ALL' would have the following values:

   FIELD	VALUE
   ACTIVITY	*
   COMPANY_CODE	*

5. Profiles, each of which may contain several authorizations or profiles. A simple profile contains a group of authorizations. A composite profile contains a group of profiles (simple or composite). [Profiles can be conceptualized as forming the structure of a tree, in which end nodes (leaves) are authorizations, and all other nodes are profiles. Simple profiles are nodes whose children are all end nodes, and composite profiles are nodes, other than end nodes, who have no end nodes for children.]

   Profiles are designed to define set or one or more functions or positions. For example, a functional profile might define all the authorizations that are required for doing a goods receipt, or for making a payment in the AP module. A position profile, on the other hand, might define all of the authorizations that are granted to an accountant, or to a warehouse supervisor. Often, a position profile is a composite profile consisting of several functional profiles.

6. Users, to whom profiles are assigned. A user is assigned one or more profiles by the system administrator. These profiles define all of the user's system authorizations.

Keyword: BASIS
Title : Transporting Authorizations

Keyword: BASIS
Title : CCMS Monitoring Authorizations

Keyword: BASIS
Title : Activating Authorizations in SAP BW

Keyword: BASIS
Title : Hierarchical Authorizations in SAP BW

Keyword: BASIS
Title : Structural Authorizations in SAP BW

Keyword: BASIS
Title : Authorizations in SAPconnect