Authorization in SAP HR

Q. What is double verification principle ?

• All critical data is protected
• Authorization to access specific data has to be given

Q. Authorization in SAP?

A. Authorizations control system users’ access to system data and are therefore a fundamental prerequisite for the implementation of business software. There are two main ways to set up authorizations for SAP Human Resources:

• General Authorizations - determines which object data (infotype, subtype) and which access mode (Read, Write ...) the user has an access.
• Single Role       - Individual authorizations either  to screens, infotypes, etc.,
• Composite Role- Group of Single Roles clubbed together and called as composite role

• Structural Authorization: determines to which object/objects in the organizational structure the user has an access. It describes the special authorizations that you can define in Personnel Planning and Development in addition to the basic access authorizations

Q. What is a role and what is it made up of? / How are the authorizations in a role maintained?

A. Role is the way how authorizations are granted in SAP or the activities which are performed by an individual are restricted. A role consists of all the duties performed by an individual in the organization. For e.g., the clerk or the manager or buyer or dispatcher etc.. Two managers of same cadre have same type of duties. Technically a role contains all the items(transactions or tcodes, reports, links) which are needed by an individual in particular position.

In a  role-based authorization system the structure of organization is well defined, the activities performed by each individual are defined clearly and the users are assigned to generic roles (technical)  which contains tcodes necessary for performing the job. There are three types of roles.

• Single roles
• Composite roles
• Derived roles

Q. Composite Role

A. A composite role has many single roles. No authorization data can be maintained in a composite role.  You can enter some menu entries like links to websites, reports only. Tcodes cannot be added. The authorization data has to be maintained only in the single roles.

When you attach a composite roles to a user all the single roles gets attached to him. In the change documents it shows the single profiles that belongs to single roles gets attached to them. Suppose a composite role has 3 single roles. When you attach this composite role to a user then 3 authorizations profiles will get attached to him. The change count  in SUIM will be 3.

Q. Derived Role

A. These roles are derived from already existing roles.The derived roles inherit the menu structure and functions (including transactions etc…) of the referred role.

Q. What is Profile Generator?

A. The Profile Generator tool allows authorization administrators to automatically generate and assign authorization profiles. 

Q. What are the main advantages of the Profile Generator?

A. The Profile Generator tool is used to:

• Select transactions from the company menu
• Retrieve all authorization objects to transactions selected (Via Check ID Tables)
• Generate authorizations once field restrictions have been entered for each authorization object
• Group authorizations in auto-generated profiles

The administrator has only to configure customer-specific settings such as:

• The Company Menu enables transactions available for customer
• The Check ID tables 1) assign the authorization objects that are relevant to a transaction, and 2) assign default values for authorization objects
• Once the configuration is complete, the profile generator will then be capable of managing all tasks, such as selecting the relevant authorization objects for transactions selected.

Q. Are authorization objects or profiles assigned to users?

A. A user's authorizations for the various objects in the SAP R/3 System are determined by authorization
profiles that are assigned in the user master record.

An authorization object is made up of a maximum of 10 authorization fields. For the sake of clarity, the authorization objects are grouped according to applications. 

Authorization profiles are lists of authorization objects and the corresponding authorizations.