A concept for SAP authorizations prevents system errors and DSGVO violations
Translating texts into permission roles
You can view the change documents of the permission proposal maintenance using the report SU2X_SHOW_HISTORY (available with the support package named in the SAPHinweis 1448611). If the note is not implemented, use the USOBT_CD and USOBX_CD tables. We recommend that you run the SU24_AUTO_REPAIR correction report regularly. This report cleans up inconsistencies and adds missing modification flags in the transaction SU24 data that may turn up as errors when the transaction SU25 is executed. Read SAP Note 1539556 for this. Modification flags are added to the records in transaction SU24, if they have been modified by you. You can see these flags in the USOBT_C and USOBX_C tables.
Authorizations in a company are usually not assigned to individuals, but to roles. A role describes jobs or positions within the organization. One or more persons can hold a role and thus have the access authorizations assigned to the role. The authorization profile (the number of authorizations) of a role contains all authorization objects that are required to execute the transactions. By means of a profile generator (transaction PFCG) the creation of the authorization profile can be automated in SAP.
SAP S/4HANA® migration audit
The report RSUSR008_009_NEW (List of users with critical permissions) is provided starting with SAP Web Application Server 6.20 with the following support packages: Release 6.20, starting with SAPKB62039 Release 6.40, starting with SAPKB64003 You can continue using the old reports RSUSR008 and RSUSR009 until release 6.40. The RSUSR008_009_NEW report is delivered with the old SAI proposals for critical credentials already used in the RSUSR009 report.
Define explicit code-level permission checks whenever you start transactions from ABAP programmes or access critical functions or data. This is the easiest and most effective defence to protect your business applications from misuse, because programming-level permission checks can ensure two things: Incomplete or incorrect validation of the executed transaction start permissions will result in compliance violations. Complex permission checks can also be performed adequately for the parameterized use of CALL TRANSACTION.
Assigning a role for a limited period of time is done in seconds with "Shortcut for SAP systems" and allows you to quickly continue your go-live.
With apm Suite you will never lose track of your compliance in SAP authorization management.
If you want to know more about SAP authorizations, visit the website www.sap-corner.de.
The next step is to maintain the SU24 transaction proposal values for the respective customer transaction.