Authorizations in SAP8 Software

Transcription

1 Volker Lehnert, Katharina Bonitz, and Larry Justice Authorizations in SAP8 Software Design and Configuration, ^ ^». Galileo Press. Bonn Boston

2 Foreword 19 Acknowledgments 22 PART I Business Concepts 2.1 Methodical Considerations Approaches for the Business Authorization Concept Persons Involved in the Authorization Concept Compliance Risk Corporate Governance Technical Versus Business Significance of the Authorization Concept Technical Versus Business Roles Example of an Organizational Differentiation Introduction Institutional Organization Concept Object of the Organization Legal Forms of the Organization Organization and Environment Summary Instrumental Organization Concept Specialization (Division of Labor) Organizational Structure Task Analysis 68 7

3 3.5 Consequences of the Examination of the Organization Views of the Organizational Structure in SAP Systems Organizational Management Organization View of External Accounting Organization View of Funds Management Organization View of the Standard Cost Center Hierarchy Organization View of the Profit Center Hierarchy Enterprise Organization Organization View in the Project System Logistical Organization View Integration of the Organization Views with the Authorization Concept Organizational Levels and Structures in SAP ERP Organizational Level "Client" Relevant Organizational Levels of Accounting Relevant Organizational Levels in MM Relevant Organizational Levels in Sales and Distribution Relevant Organizational Levels in Warehouse Management Integration of the Organizational Levels with the Authorization Concept Information on the Methodology in the Project Summary 93 ^^^^^^S^^E^^^^^uL^^^^^^^E^E^^S^^B^E^^^^^ffl^^^^^^^^^H 4.1 Basic Principles of Internal and External Regulations Internal Control System Sources of Law for External Accounting Sources of Law and Effects for the Private Sector Concrete Requirements for the Authorization Concept Data Privacy Laws Legal Definitions Relating to Data Processing Rights of the Person Affected 111 8

4 4.4.3 Recommendations Relating to the ICS Concrete Requirements for the Authorization Concept Compliance versus Data Privacy General Requirements for Authorization Concepts Identity Principle Minimal Principle Job Principle Document Principle in Financial Accounting Document Principle in Authorization Management Separation of Duties Principle Approval Principle Standard Principle Written-Form Principle Control Principle Summary Process Overview The Sales Process The Procurement Process Support Processes Requirements of the Separation of Duties Summary 140 PART II Tools and Authorization Maintenance in the SAP System 6.1 User/Authorization User User Maintenance (ABAP) Transaction Program Authorization Object Transaction 153 9

5 System Check in the Program Flow Authorization Object Role and Role Profiles Authorization Profiles Creating and Maintaining Roles Analysis of Authorization Checks Evaluation of the Authorization Check Analysis in the Program Flow Trace/ Authorization Trace Program Check Additional Role Types in SAP ERP Composite Role Value Role/Functional Role Summary Maintaining and Using the Defaults for the Profile Generator Functions for the Profile Generator Function in the Upgrade Normative Use Using Default Values for Risk Analyses and External Role Maintenance Tools Original State and Maintenance of Default Values Upgrading Authorizations Parameters for Password Rules Customizing Settings for the Menu Concept Authorization Groups Optional Authorization Checks for Authorization Groups Table Authorizations Authorization Groups as Organizational Levels Parameter and Query Transactions Parameter Transaction for Maintaining Tables via Defined Views

6 7.6.2 Parameter Transaction for Viewing Tables Implementing Queries in Transactions Promoting an Authorization Field to an Organizational Level Effects Analysis Procedure for Promoting a Field to an Organizational Level Promoting the Area of Responsibility to an Organizational Level Developer and Authorization Trace Procedure for the Developer and Authorization Trace Creating Authorization Fields and Objects Creating Authorization Fields Creating Authorization Objects Further Transactions of the Authorization Administration Transferring Roles Between Systems or Clients Downloading/Uploading Roles Transporting Roles User Master Comparison Summary 274 ^^^^Ul^^^Hfe«ttM^MM^^»^^^Wi^^^fc^^^^Bi^^^^Mw^^^^^M 8.1 Basic Concept of SAP ERP HCM Organizational Management Technical Prerequisites Technical Implementation Prerequisites Technical Basics of SAP ERP HCM Organizational Management Assigning Roles Evaluation Path User Master Comparison Conceptual Special Feature Summary

7 I ^filiellss^^hml^y MM 9.1 Challenge and Solution Approach Role Generator OM Area Role Concept Combining Area Roles and OAA Implementation Example for the Area Role Concept Integration, Restrictions, and Prospects Summary 307 [tk^^ffi^sm^^ijb^tts^sil^^^^^me^^^^^^^sk^^^^^^^s^^^ey ^^B^^SH^^H^sl^S^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ffl 10.1 Basic Principles Business Background User Lifecycle Management SAP Solutions for the Central Administration of Users Central User Administration Procedure for Setting up the CUA Integration with Organizational Management of SAP ERP HCM Integration with SAP BusinessObjects Access Control SAP BusinessObjects Access Control Compliant User Provisioning SAP NetWeaver Identity Management Relevant Technical Details Functionality Technical Architecture Integration of SAP BusinessObjects Access Control Summary 345 IIIIk^^ 11.1 Standards and Their Analysis

8 Programming Role Instead of Profile Definition of the Role Through Transactions Using Defaults Table Authorizations Program Execution Authorizations Derivation Programming Guideline Critical Transactions and Objects General Evaluations of Technical Standards User Information System Table-Based Analysis of Authorizations Summary Basic Principles Risk Analysis and Remediation Enterprise Role Management Compliant User Provisioning Superuser Privilege Management Risk Terminator Summary User Management Engine Overview of the UME UME Functions UME Architecture User Interface of the UME Configuration of the UME Authorization Concept of SAP NetWeaver AS Java UME Roles UME Actions UME Group J2EE Security Roles User and Role Administration Using the UME Prerequisites for User and Role Administration

9 Administration of Users User Types Administration of UME Roles Administration of UME Groups Tracing and Logging Summary 406 PART III Authorization in Specific SAP Solutions ^^^^^^^^^^^^^^^^^^^^^^m. -,,,., Rg Basic Principles Special Requirements of SAP ERP HCM Authorizations and Roles Authorization-Relevant Attributes in SAP ERP HCM Personnel Action Example Authorization Main Switch Organizational Management and Indirect Role Assignment Structural Authorizations The Structural Authorization Profile Evaluation Path Structural Authorizations and Performance Context-Sensitive Authorizations Summary Basic Principles The SAP CRM User Interface: CRM Web Client Creating Business Roles forthecrmweb Client Dependencies Between Business Role and PFCG Roles Creating PFCG Roles Depending on the Business Roles

10 Prerequisites for Creating PFCG Roles Creating PFCG Roles Assigning Business Roles and PFCG Roles Sample Scenarios for Authorizations in SAP CRM Authorizing Interface Components Authorizing Transaction Launcher Links Authorizing Master Data Authorizing Business Transactions Authorizing Attribute Sets Authorizing Marketing Elements Troubleshooting in the CRM Web Client Access Control Engine Summary 507 s 16.1 Basic Principles Authorization Assignment in SAP SRM Authorizations of User Interface Menus Authorizations of Typical Business Processes Summary 531 s 17.1 OLTP Authorizations Analysis Authorizations Basic Principles Barrier Principle Transaction RSECADMIN Authorization Maintenance Assignment to Users: Transactions RSU01 andsuol Analysis and Authorization Log Generation Authorization Migration Modeling Authorizations in SAP NetWeaver BW InfoProvider-Based Models Characteristic-Based Models

11 Mixed Models Summary Basic Principles Master and Transaction Data Organizational Levels Authorizations in Financial Accounting Organizational Differentiation Criteria Master Data Postings Payment Run Authorizations in Controlling Organizational Differentiation Criteria Maintaining Master Data Postings Old and New Authorization Concept in Controlling Authorizations in Logistics (General) Organizational Differentiation Criteria Material Master/Material Type Authorizations in Purchasing Maintaining Master Data Procurement Processing Authorizations in Sales and Distribution Maintaining Master Data Sales Processing Authorizations in Technical Processes Segregation of Duties in Authorization Management Segregation of Duties in the Transport System RFC Authorizations Debugging Authorizations Client Change Change Logging Batch Authorizations Summary

12 User Authorization 19.1 Authorization Concept in the Project Context Procedure Model Logical Approach Implementation Redesign Concrete Procedure SAP Best Practices Template Role Concept SAP Best Practices SAP Template Roles Methodical Procedure of the SAP Best Practices Role Concept Combination with SAP BusinessObjects Access Control Content of an Authorization Concept Introduction and Standardization Framework of the Concept Technical Context Risk Evaluation Person Authorization Management Organizational Differentiation Process Documentation Role Documentation Summary 642 ^3M^^^E^^^^^^^^^^^^^^^^^^^^^^^S^^^^^^ffl^P^ff,fl :i%^^ff^3^^ A List of Abbreviations 645 B Glossary 649 C Bibliography 661 D The Authors 663 Index