Features of the SAP authorization concept
Authorization object documentation
With more than 28 users, the simple Copy & Paste in the user selection no longer works. However, this does not mean that you have to care for all users individually! It is common for you to make mass changes to users in the SAP system, such as changing role assignments, locking a group of users, or having to adjust their validity dates. Unfortunately, there is no button in the start image of the transaction SU10 that allows users to be pasted from the clipboard. While Copy & Paste allows you to insert users from the clipboard, this feature is limited to the visible area. Therefore, it is not possible to add a list of more than 28 users, which can be very difficult for long lists.
SNC secures communication with or between ABAP systems, but there are also many web-based applications in SAP system landscapes. They communicate via the Hypertext Transfer Protocol (HTTP). The data is also transmitted unencrypted when communicating via HTTP; Therefore, you should switch this communication to Hypertext Transfer Protocol Secure (HTTPS). HTTPS uses the encryption protocol Transport Layer Security (TLS) for secure data transfer on the Internet. You should therefore set up HTTPS for all users to access the Web. For communication between SAP systems, you should use HTTPS if you think the data transfer could be intercepted. You should either set up HTTPS on individual components of the infrastructure (such as proxies), or the ABAP systems should support HTTPS or TSL directly. Details of the configuration can be found in the SAPHinweis 510007.
User group can be defined as required field
In the course of a comprehensive protection of your system from the inside as well as from the outside it is indispensable to have a closer look especially at the SAP standard users. They have far-reaching authorizations that can cause great damage to your system if misused. It should be noted that they are very important for the operational execution of your SAP system and must not be deleted. However, since the associated standard passwords can be quickly researched, they must be changed immediately after delivery of the SAP ERP. You can perform a detailed check of these users using report RSUSRS003. It is also recommended to set certain default users inactive until they are actually used.
To store all the information on the subject of SAP - and others - in a knowledge database, Scribble Papers is suitable.
If the programme determines that both of the criteria set out in the previous bullet points are met, the criterion of equality shall apply. This means that the proposed values of the permission that is already in place and to be added will come from the same transaction. Thus, the programme does not add a new default permission to the permission tree.
The possibility of assigning authorizations during the go-live can be additionally secured by using "Shortcut for SAP systems".
To obtain the trace data for each authorization object, select the authorization object you want to customise in the upper-left pane of the Permissions object drop-down list.
Learn how to turn on table logging in the system for a large set of tables.