Law-critical authorizations
User administration (transaction SU01)
A temporary shutdown of Central User Management is usually not recommended. However, in certain cases it may be necessary. We will show you what pre- and post-processing is required to avoid data inconsistencies. In complex SAP landscapes where the Central User Administration (ZBV) is used, there may be cases where you want to temporarily remove a subsidiary system from the ZBV without having to delete this system or shut down the entire ZBV, for example if you want to create users in a subsidiary system at short notice.
Single role - Created using the role administration tool, it enables the automatic generation of an authorization profile. The role contains the authorization data and the logon menu of the users.
Development
If you want to use reference users and use the User menu, you should also ensure that users also see the role menus associated with reference users. To do this, enter the corrections in SAP Note 1947910. They include two switches for customising in the SSM_CUST table.
To store all the information on the subject of SAP - and others - in a knowledge database, Scribble Papers is suitable.
Over the button field maintenance also own-developed authorization fields can be created to either a certain data element is assigned or also search assistance or check tables are deposited. On RZ10.de the topic has been described in more detail including a video recording in the article "Creating Authorization Objects with SAP Transaction SU21".
With "Shortcut for SAP systems" you can automate the assignment of roles after a go-live.
However, the check should not only focus on the global settings that are valid for all users, but should also include all those users who have been assigned their own security policies.
The Insert function from the Clipboard is also available in the dialogue box for maintaining the organisation levels.