Authorization concepts in SAP systems
Customising User and Permissions Management
This approach makes authorization management considerably more efficient, since functional changes do not have a global impact on the entire authorization structure. This ensures the quality of authorizations in the long term. Authorizations in SAP systems enable users to access the applications relevant to their activities. To ensure that processes are mapped securely and correctly, SAP authorizations must be regularly checked and reworked.
Configuration validation is a tool that allows systems to be tested against corporate or organisational requirements and regulations. You can find this tool in the Change Management section of the SAP Solution Manager. This allows you to evaluate security-relevant configurations and critical permissions. This is based on the SAP Solution Manager's Configuration and Change Database (CCDB), which stores all details about the configuration of the connected systems. The configuration data is stored in different configuration stores, depending on the type of configuration. You can evaluate the configuration of the operating system, the database, and profile parameters in the ABAP and Java systems. You will also get an overview of the status of transport orders and support packages. You can also track changes to the configurations of the attached systems in the CCDB. You can also graphically evaluate these changes via an end-to-end analysis in SAP BW; contains information on the number of changes per system, the type of changes and the modification date.
Use Central User Management change documents
For an up-to-date description of the eligibility tests in the EWA, see SAP Note 863362. Updates to these checks are provided by keeping the ST-SER software component, which contains the definition of checks to be performed, up to date and enabling the automatic content update in the SAP Solution Manager.
Alternatively, the maintenance of the authorization objects can also be called up via transaction SU21 (report RSU21_NEW). On the left side the individual classes and objects can be selected around then to the authorization object the existing authorization fields and short descriptions as well as over the button "documentation to the object indicate" also the documentation to the object to be called can.
The possibility of assigning authorizations during the go-live can be additionally secured by using "Shortcut for SAP systems".
This applies to the USR02 and USH02 tables and in more recent releases the USRPWDHISTORY table.
On this basis, determine which organisational characteristics (organisational levels, but also cost centres, organisational units, etc.) represent which parts of the organisation.