HOW TO SAP

SAP Security Authorization Interview question

December 23, 2017  
  1. How do you determine what organization value to be given to user?
    Refer request form, change request, functional team, copy from sample user, consult their subordinate or manager. Some business sense is needed. Never give more values then requested.
  2. How would you map a tcode to user?
    Check request form. Investigate the user's role function. Research the function of the tcode. Do not give any tcode which that is not needed by the user in business point of view.
  3. What background or periodic job security consultant should know?
    - Daily check on sap* and ddic user. It should be locked times (unless there is upgrade)
    - Run RSUSR006 to check locked users.
    - Check is production client is lock against direct changes
    - Check on sap_all profile. No one should have it.
  4. Single Role Naming conventionSample : MY1XFCSOA or MY1XFCSOD
    Explain:
    - MY (country code)
    - 1X (domain - which correspond to org level value excel sheet)
    - FCSO (abbreviation of the function role - Finance Create sales order)
    - A (activity type - A means change, D means display)
  5. Max profile?
    -312
  6. How to check how much profiles a user have?- Table USR04
  7. System parameter used by security- login/no_automatic_user_sapstar
    - Login/failed_to_user_lock
    - Login/fails_to_session_end
    - Login/gui_auto_logout
    - many more, google for results.
  8. Why sap* cannot be used?- SAP is design not to check authorization for user sap*
    - Who ever has sap* get control over the whole system
  9. Tcode frequently use
    - SUIM, PFCG, SU01, SU53 and google for more
  10. What is SU24- Remove and add authorization object check (to be display in PFCG)
    - Use to standardized common authorization object to be pulled in a role
  11. What is a derived role- A child role derived from master template
  12. Authorization object
    - A collection of authorization field.
  13. How to check user access issue- SU53, ST01
  14. User do not have access but SUIM search indicates authorization givenReason:
    - Max profile reach
    - Didn't relogin
    - Did not perform user comparison
  15. Which tables shows what profile a user have?- UST04
  16. PFCG tables- agr_agrs, agr_1251, agr_1252, USR02 and etc
  17. How to transport a role- PFCG > there is a transport truck icon. Alternately, use mass transport from the menu
  18. Convert field to org level- Run program PFCG_ORGFIELD_CREATE
  19. What is GRC- Governance Risk and Compliance
    - Help company to put in place a set of policy and control to be SOX compliance
  20. Components of GRC- CUP (Compliance user provision - enable self request for role and also approval)
    - RAR (Risk Analysis and Remediation - check SOD, generate report and propose solution)
    - ERM (Enterprise role Management - Assist in role designing)
    - SPM ( Super privileged management - profile super user access like firecoll and mitigation)
  21. Why do single roles sometimes has more profile
    - When there are more then 150 object in a profile, SAP auto generates new profile


End of SAP Security Authorization Interview question
 Continue Reading

SAP SECURITY - Create authorization object and assign to user

December 21, 2017  
Authorization Objects are used to manipulate the current user's privileges for specific data selection and activities from within a program.

We could always create our own authorization objects and implement it in our own abap programs. As an example, we will create our own authorization field similar to TCD used in S_TCODE 

Steps to create authorization field
1. Go to transaction code SU20
2. Click the create new button on the application toolbar.
3. Enter "ZTCODE" in the Field Name and "TCODE" in the Data Element, then hit Enter.
4. Click the save button on the system toolbar.
Next step is to create the authorization class and authorization object

Steps to create authorization class
1. Go to transaction code SU21
2. Click on the Create button's drop down icon and select "Object Class".
3. Enter "ZTRN" on the Object Class field.
4. Give it a description and save it.

Steps to create authorization object
1. Again in SU21, in the list of authorization class(folder icon), click the one that we've created(ZTRN).
2. Click on the Create buttodrop down, this time selecting "Authorization Object".
3. Enter "Z_TCODE" on the Object field and give it a description.
4. On the authorization fields section, enter ACTVT and ZTCODE. ACTVT is used to set and limit the activity of the user, while the ZTCODE is the authorization field that we've created earlier which is
responsible for holding a list of tcodes.
5. On the Further Authorization Object Settings, click on "Permitted activities" button. Here we will select the specific activities that we want to be available for our authorization object.
6. As an example, we will select 01(Create), 02(Change), and 03(Display).
7. Save and Exit.

Now we're done creating our own authorization object, let us now use and assign it to a user.

Steps to create a role
1. Go to transaction code PFCG.
2. Enter "ZAUTHTEST" on Role field and click the "Single Role" button.
3. Now give it a description, click the save button and click the Authorization tab.
4. Click the "Change Authorization Data" button inside the authorization tab.
5. Then click the "Manually" button on the application toolbar and type in the name of the authorization object that we've created earlier("Z_TCODE") and press enter.
6. Expand all the nodes, double click on the input field of the Activity and select activity 01 and 02.
7. Enter the tcode of our own abap program in ZTCODE field, in our example I used "ZCOMM" .
8. And also don't forget to add the S_TCODE authorization object and enter ZCOMM on it's field.
9. Now Click on the Generate button in the application toolbar and press enter on the pop-up screen.
10. press the back button and assign a specific user on the user tab and click User Comparison button.
11. Now create another role by repeating steps 1 to 9 but this time select activity 03 on step 6.
12. Then assign this 2nd role to another user.
 Continue Reading

SAP SECURITY INTERVIEW - FIND USER ID FROM TABLE PA0105

December 19, 2017  

  1. You only  have Personal Number (PERNR) or Email (USRID_LONG) as reference
  2. SE16 > PA0105 
  3. Now enter PERNR or USRID_LONG
  4. SUBTY must be 0001
  5. Now execute


 Continue Reading

SAP SECURITY - MASS CHANGE USER LICENSE VIA SU10

December 18, 2017  







  1. SU10 > Authorization Data > User > Multiple Selection
  2. Choose copy from txt file (if you have it in txt format) or clip board (if you click copy paste)
  3. Click Copy and it will bring you back to previous screen
  4. Click Execute
  5. Select All user
  6. Click Transfer
  7. You will get back to SU10 main screen again
  8. Click Change
  9. License data Tab > Select your desired user license from drop down list
  10. REMEMBER TO CHECK "CHANGE"
  11. Now Save and continue
  12. Once finish, log will be displayed for your reference
 Continue Reading

Organizational Level Authorization Field

December 17, 2017  

ARBPL Work Center
PLVAR Plan Version
KOKRS Controlling Area
BUKRS Company Code
PRCTR Profit center
IWERK Planning Plant
SWERK Maintenance Plant
EKGRP Purchasing Group
EKORG Purchasing Org.
WERKS Plant
VKORG Sales Organization
VTWEG Distribution Channel
SPART Division
VSTEL Shipping Point
LGORT Stor. Loc.


BERID MRP Area
 Continue Reading
Subscribe to: Posts (Atom)
Designed By: Blogger Templates | Templatelib