Quries on roles and profiles

[BASIS24x7]

Hi members,

Please provide me some info on the following

1.What is the difference between role and a profile?
2.What is the use of role templates?
3. What is the different between single role & composite role?
4. What profile versions?
5. Is it possible to change role template? How?
6. Please expalin the personalization tab within a role.
7. How to insert missing authorization? Ways?
8. Is there a table for authorisations where I can quickly see the values entered in a group of fields?
In particular I am looking to find the field values for P_ORGIN across a number of authorisation profiles, without having to drill down on each profile and authorisation.
9. Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?
10. I have a requirement to make SPRO read only. As you know it has a tree like structure and to make it read only seems like impossible.
11. How can i do a mass delete of the roles without deleing the new roles.
Hope everyone will go through these and come up with the solutions

Regards
pavan

[sangy]

Hi sir,
I have created a role with three tcodes-SU01,SU10,PFCG,now if i want to restrict the tcode su01 to only display, i did the following setps

1.I have created A role with 3 TCodes in the menu tag.

2.In authorisations tab -->under the object S_USER_GRP the activity field has been set to 03 or display.

3.I saved the role and assigned to a user.

4.When i tried logging to that user the user can only access the display field for the Tcode su01,but the tcode su10 is also restricted.

Is there any other method to restrict the authorizations for the user transactions with out affecting the other tcodes .

Thanks & Regards,
Sangeeth Kumar.

[debashree dutta]

Profile versions are nothing but when u modify a profile paarameter through a RZ10 and generate a new profile is created with a different version and it is stored in the database.

[debashree dutta]

Personalization is a way to save information that could be common to a user role... E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role. it is a way for SAP to address the ambiguity of its concept of user group and roles i.e, is "usergroup" a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access?

[yshashidher]

Hi Pavan,

Very nice questions are posted. Can u send the answers also.
I am weak in Security. These questions very helpful to me.
And another request is send some more questions on security
as well as Database.

Its very useful to so many guys who are in searching.

Thanks,
shashi

[hussainsaber]

Hi ALL,

I would like to Congratulate every1 involved and participating in this Forum.

Yes, special thanks to Rashed Bhai, Javed Bhai, Pawan and sorry if I am missing any particular name in the list.

Difference between Role and Profile is a basic Interview question for Basis resources.

Kindly, reply it this way "Role is always dependent on Profile for any type of Authorization. Whereas Profile can be Independently assigned as Authorization as per the requirement." Normally every Profile should be associated to a Role. According to Security only ROLES should be assigned to Users.

Br,
Saber Hussain

[BASIS24x7]

Thanks for the replies,

you as a experienced person and being part of this forum will help many people. hope you will always post the replies and help people learn more things

regards
pavan

[hussaini]

hi

saber hussain

u hav joined this forum thats great to see u here !!!

these questions are also too frequently asked

regards

mohammed

[meetmuqeet]

hi pavan

There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then relase the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.

To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

best regards
MOHAMMED ABDUL MUQEET

[meetmuqeet]

hi pavan

There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then relase the transport and import them into all clients and systems.

It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.

To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.

best regards
MOHAMMED ABDUL MUQEET