This blog contains experience gained over the years of implementing (and de-implementing) large scale IT applications/software.

Category: Netweaver

Controlling FUGR Access

If you have a super user role in your production system, it’s quite possible that use of the SUPRN_INS_OR_DEL_PROFILE or BAPI_USER_PROFILES_ASSIGN function modules could be used from SE37 to give SAP_ALL and then proceed to get around other restrictions.
Since SUIM relies upon S_DEVELOP and activity 16, you can’t just remove it unless you leave the admins to find their own way to the underlying transactions.
Instead, you could lock down the S_DEVELOP authorisation object by removing access to the specific function group (FUGR).
When editing the authorisations of a role, set one of the S_DEVELOP authorisation objects to exclude FUGR (and DEBUG):
Activity = 03 & 16 (Display & Execute)
Package = *
Object Type =
4              to DE
DEVC     to FU
FUGS     to Z
Z              to $TM
Then add another S_DEVELOP authorisation object “MANUALLY”.
Set this to exclude the SUPR, SUPRN and SU_USER function groups:
Activity = 03 & 16 (Display & Execute)
Package = *
Object Name =
0              to SUNI
SURI      to SURI-SU_UPGTOOLS
SU_USER_GRP_SURFACE to Z*
Z*           to $*
Object Type = FUGR

SAP_ALL modified role

Have you got a SAP Development system where the developers insist they have SAP_ALL, but you know this is just wrong.

Well, here’s a neat solution that removes certain authorisations like user admin in SU01 and adjusting auditing (SM19), RFC admin (SM59) etc.

Using transaction PFCG, create a new single role.
Add a description and save the role.
On the Authorisations tab generate a new profile and then edit the authorisations “Change Authorization Data“.
Do not select any Templates.
From the “Authorizations” screen, select “Edit -> Insert Authorization(s) -> from profile…“.
On the popup, enter profile “SAP_ALL”.

Now adjust the profile as required.
I usually adjust the following authorisation objects:

S_ADMI_FCD – BTCH, FONT, SM21, SP01
S_OSS1_CTL – 16
S_USER_AGR – 03, 08
S_USER_AUT – 03, 08
S_USER_GRP – 03, 08
S_USER_OBJ – [NO AUTH]
S_USER_PRO – 03, 08
S_USER_SAS – [NO AUTH]
S_USER_SYS – 03
s_XMB_ACT – [DEPENDS ON USAGE OF XI/PI]
S_TRANSPRT – [CREATE TASKS, SEPARATE ROLE FOR CREATE TRANSPORTS]
S_IDOCPART – 03
S_IDOCPORT – 03
S_SCD0 – 08, 12

You can then save and assign the role to the developers.

All Reports & Transactions Under SUIM

The list below is useful if you are constructing a roll to house the SUIM capabilities:

Users by System S_BIE_59000198

Users by Roles S_BIE_59000199

Users by Profiles S_BIE_59000197

Users by Address Data S_BCE_68001393

Users by Complex Selection Criteria S_BCE_68001400

By user ID S_BCE_68001394

By Role S_BCE_68001399

By Profiles S_BCE_68001395

By Authorizations S_BCE_68001396

By Authorization Values S_BCE_68001397

By Transaction Authorizations S_BCE_68001398

By Critical Combinations of Authorizations at Transaction Start S_BCE_68001401

With Unsuccessful Logons S_BCE_68001402

By Logon Date and Password Change RSUSR200

List of Users With Critical Authorizations S_BCE_68001403

With Critical Authorizations (New Version) S_BCE_68002111

Roles by Complex Selection Criteria S_BCE_68001425

By Role Name S_BCE_68001418

By User Assignment S_BCE_68001419

By Transaction Assignment S_BCE_68001420

By MiniApp S_BIE_59000249

By Profile Assignment S_BCE_68001421

By Authorization Object S_BCE_68001422

By Authorization Values S_BCE_68001423

By Change Dates S_BCE_68001424

Profiles by Complex Selection Criteria S_BCE_68001409

By Profile Name or Text S_BCE_68001767

By Profiles Contained S_BCE_68001404

By Authorizations S_BCE_68001405

By Authorization Values S_BCE_68001406

By Last Change S_BCE_68001407

By Role S_BCE_68001408

Authorizations by Complex Selection Criteria S_BCE_68001417

By Object S_BCE_68001414

By Values S_BCE_68001415

By Last Change S_BCE_68001416

Authorization Objects by Complex Selection Criteria S_BCE_68001413

By Object Name, Text S_BCE_68001410

By Object Class S_BCE_68001411

By Field, Text S_BCE_68001412

Executable Transactions (All Selection Options) S_BCE_68001429

Executable for User S_BCE_68001426

Executable for Role S_BCE_68002041

Executable with Profile S_BCE_68001427

Executable with Authorization S_BCE_68001428

From users S_BCE_68001430

from Roles S_BCE_68001777

From profiles S_BCE_68001431

From authorizations S_BCE_68001432

In Users S_BCE_68001399

In Users S_BCE_68001395

In Roles S_BCE_68001421

In Composite Profiles S_BCE_68001404

In Users S_BCE_68001396

In Profiles S_BCE_68001405

In Users S_BCE_68001397

In Roles S_BCE_68001423

In Profiles S_BCE_68001406

In Authorizations S_BCE_68001415

In Programs S_BCE_68002030

For Users S_BCE_68001439

for Role Assignment RSSCD100_PFCG_USER

For Roles RSSCD100_PFCG

For Profiles S_BCE_68001440

For Authorizations S_BCE_68001441

SAP Authorisation Objects Naming Convention

The first letter of SAP authorisation objects is intelligently coded to represent the SAP module for which it belongs:
e.g. F_KNA1_BUK

A   Assets Accounting
C   Classification System
E   Consolidation
F   Financial Accounting
G   Special Ledger
K   Controlling
L   Logistic execution
M   Materials Management
P   Human Resources
S   Basis
V   Sales and Distribution

If the second character is an underline, then this indicates this authorisation object is a SAP standard one.

Use transaction SU03, SU21 or table TOBJ, to list the authorisation objects in the system and drill-down into the authorisation fields and their possible values.

If using the tables, you may need the other related tables to pull the texts: TOBJ, TOBC (classes), TOBJT.

SAP Users With Roles Not Assigned via Composite Roles

Have you ever needed to list SAP roles that are assigned to user accounts, but show only the single roles that are directly assigned (not single roles inherited through composite roles)?

Here’s how you can do it:
Using SE16, get the records from AGR_USERS table with field COL_FLAG=’ ‘

Relate this to USR02 table BNAME field to decide if the user account is locked (valid) or not in use anymore.

I’ve also discovered this can be done in transaction S_BCE_68001394 (Users by User ID).  You just input * into the user ID field, execute the report and then sort the two columns for “Direct Assignment” and “Role Type”.  This will give you the Single roles assigned directly.