HOW TO SAP

How to create User in SAP HANA - Assign Role and Activate User

SAP HANA Security is to protect important data from unauthorized access and ensures that the standards and compliance meet as security standard adopted by the company.

SAP HANA Provide following security-related feature –

User and Role Management
Authorization
Authentication
Encryption of data in Persistence Layer
Encryption of data in Network Layer

CREATE USER IN SAP HANA

Create User in SAP HANA- only database user with ROLE ADMIN privileges can create user and role in SAP HANA.
Step 1) To create new user in SAP HANA Studio go to security tab as shown below and follow the following steps;
1. Go to security node.
2. Select Users (Right Click) -> New User.
Step 2) A user creation screen appear.
1. Enter User Name.
2. Enter Password for the user.
3. These are authentication mechanism, by default User name / password is used for authentication.

By Clicking on the deploy Button user will be created.

2. Define and Create Role

A role is a collection of privileges that can be granted to other users or role. The role includes privileges for database object & application and depending on the nature of the job.

It is a standard mechanism to grant privileges. Privileges can be directly granted to the user. There are many standard roles (e.g. MODELLING, MONITORING, etc.) available in SAP HANA database.

We can use the standard role as a template for creating a custom role.

A role can contain following privileges –

System Privileges for administrative and development task (CATALOG READ, AUDIT ADMIN, etc.)
Object Privileges for database objects (SELECT, INSERT, DELETE, etc.)
Analytic Privileges for SAP HANA Information View
Package Privileges on repository packages (REPO.READ, REPO.EDIT_NATIVE_OBJECTS, etc.)
Application Privileges for SAP HANA XS applications.
Privileges on the user (For Debugging of procedure).

CREATE ROLE IN SAP HANA

Step 1) In this step,

Go to Security node in SAP HANA System.
Select Role Node (Right Click) and select New Role.

Step 2) A role creation screen is displayed.

Give Role name under New Role Block.
Select Granted Role tab, and click "+" Icon to add Standard Role or exiting role.
Select Desired role (e.g. MODELLING, MONITORING, etc.)

STEP 3) In this step,

Selected Role is added in Granted Roles Tab.
Privileges can be assign to the user directly by selecting System Privileges, object Privileges, Analytic Privileges, Package Privileges, etc.
Click on deploy icon to create Role.

Tick option "Grantable to other users and roles", if you want to assign this role to other user and role.

GRANT AND ASSING ROLE TO USER IN SAP HANA

STEP 1) In this step, we will Assign Role "MODELLING_VIEW" to another user "ABHI_TEST".

Go to User sub-node under Security node and double click it. User window will show.
Click on Granted roles "+" Icon.
A pop-up will appear, Search Role name which will be assign to the user.

STEP 2) In this step, role "MODELLING_VIEW" will be added under Role.

STEP 3) In this step,

Click on Deploy Button.
A Message " User 'ABHI_TEST" changed is displayed.

RESET SAP HANA USER PASSWORD

If user password needs to reset, then go to User sub-node under Security node and double click it. User window will show.

STEP 1) In this step,

Enter new password.
Enter Confirm password.

STEP 2) In this step,

Click on Deploy Button.
A message "User 'ABHI_TEST" changed is displayed.

REACTIVATE / DEACTIVATE SAP HANA USERS

Go to User sub-node under Security node and double click it. User window will show.

There is De-Activate User icon. Click on it

A confirmation message "Popup" will appear. Click on 'Yes' Button.

A message "User 'ABHI_TEST' deactivated" will be displayed. The De-Activate icon changes with name "Activate user". Now we can activate user from the same icon.

Source:
https://www.guru99.com/sap-hana-security.html

What is SAP Authorization?

June 02, 2019 Authorization, security,

Authorization in SAP means giving users access right to a T-Code. Using T-Code PFCG allows Basis to change user’s authorization inside a T-Code. By adjusting the object you also can control user’s activity such as display, edit, or change certain field in the T-Code.

A Role Is created with the profile generator and allows the automatic generation of an authorization profile. The role contains the authorization data and the logon menu for the user.

When we have a few roles, we can group them up as Composite role.

SAP How to Step by Step Guide with Screen Shot

May 31, 2019 Authorization, security, su53, su56,

1. When user receive an authorization error such as the below dialog box, request the user to enter /nSU56 or /nSU53 to display more details on the authrization issue.

2. In Su56, expend the menu and you will see the object value and transaction type. In this scenario we know user do not have authorization on object value “0111” and transaction “V”

3. We now know that user is not authorized for object “C_PROJ_TCD”, value “0111” and type “V”.

4. Use T-Code S_BCE_68001425 to search for the authorization object. In this scenario we enter the username and authorization object and it will display the role.

5. Below is the results. Now we have to find the correct role which we need to give authorization too. If you are not sure, consult with your consultant.

6. Open /nPFCG to edit the role.

7. Enter the role name.

8. Click on Authorization tab and click “display authorization data”

9. Expend the menu and locate the object or use the “FIND” button to search for object “C_PROJ_TCD”

10. Below are the authorization you need to provide accordingly.

11. In this case, we select “0111 which is Basic WBS dates”

12. Save

13. Click on generate profile button

14. Now do user comparison

15. Ask user to re-login and try the transaction again.

Addtional InfoIf you know the Authorization object and would like to search which transaction is using it, you can open this transaction from SAP menu.

Backup database to a tape drive using DB13

May 14, 2019 backup, BASIS, db13, db2, tape,

In this scenario, we will backup the Database (DB2) to a tape drive and then perform archive once backup is completed.

1. Enter T-Code DB13 into the command field.

2. Choose at what date and what time to perform the backup. Click the ADD button.

3. You will see the above screen.

4. Fill in the details of the backup to be performed.
Action: Full Database Backup to Device
Backup Mode: Online
Device/ Directory: file:////tape0

5. Click Add

6. Now enter the backup tape into the tape drive.

In this case, full backup job has been schedule and will be perform at 2:00AM. Once completed, you will have to perform archive inactive Log Files to Tape. To do so, please follow:-

*Please take note that each archive command is different. Since I am using DB2, I’ll use the IBM D2 command line utility

1. Eject Insert the correct tape cartridge for the day into the tape drive.

2. Go to Start > All Programs > IBM DB2 > Command Line Tools > Command Window

3.You will see the above command window

4. Enter db2tapemgr DB PRD DOUBLE STORE on \\.\TAPE0 FORCE

5. It would take a while until archive backup log is complete.

6. Once completed, you can eject the tape using db2tapemgr EJECT TAPE \\.\TAPE0 on the command window.

You have succesfully perform backup and archive log to a tap

How to Delete duplicated roles from user

January 01, 2018 Authorization, interview, security,

Run the report PRGN_COMPRESS_TIMES Continue Reading