SAP Basis

Unit 11: Basics of User Administration ADM100
Lesson:
354
Authorization Concept
Lesson Duration: 60 minutes
Lesson Overview
In this lesson, the terms authorization object, authorization profile,
authorization check, and role are discussed in a common context. The
focus here is on role maintenance; that is, on creating a role.
Lesson Objectives
After completing this lesson, you will be able to:
• Copy, create, and maintain roles
• Maintain the assignment of roles and users
Participants often do not understand the meaning of the differentiation
between roles and profiles. A role is primarily a functional description,
such as HR employee. At this point, there is no consideration of the
required technical authorizations for editing tables or data. The technical
realization of the role, in the form of concrete authorizations is achieved
through the authorization profile associated with the role. If you assign
a role to a user without performing a user master comparison, the user
does not have any of the authorizations that belong to this role. You
would be creating a pseudo-user that was assigned the role but to which
no profile was assigned. This user can only log on and off the system, but
cannot perform any actions in the system.
The advantages of this two-level approach are, on one hand, the
opportunity to implement a security checking principle requiring at
least two persons, that is, an administrator is authorized to assign a
role to users, and another user is authorized to perform a user master
comparison. On the other hand, it also allows administrators to maintain
a time dependency for authorizations of a user.
Business Example
The authorizations for users are created using roles and profiles. The
administrator creates the roles, and the system supports him or her in
creating the associated authorizations.
414 © 2003 SAP AG. All rights reserved. 2003/Q3