Comparing User Master Records

The user master record comparison consists of three types of comparison:

●      The profile comparison

With this, the profiles of time-dependent role assignments are updated.

You cannot set time limits for authorization profiles and their entry in user master records.

●      The composite roll area

This updates the role assignments defined in composite roles, that is, added or deleted.

●      The organizational management comparison

This generates the direct role assignments from the indirect role assignments of the organizational management model.

You can also choose the Clean-Ups option to delete invalid, generated profiles, and invalid role assignments.

 

 

Procedure

...

       1.      Start transaction PFUD.

       2.      Specify the roles that you want to use for the comparison.

       3.      Choose one of the following actions:

○       Schedule or check job for the full comparison

Here you can start report PFCG_TIME_DEPENDENCY by specifying the time when the job is to start. The overview displays the status of background jobs that have already been scheduled.

If you schedule the report PFCG_TIME_DEPENDENCY daily before the start of business as a total comparison and it runs error-free, the authorization profiles in the user master are up-to-date every morning.

If you choose this action, all four processes types are always included, regardless of your selection under Processing Type. To execute only certain processing types of the comparison as a background program (for example, with the aim of improving runtime behavior), choose Perform User Master Comparison and the desired processing types. Then choose Save, to schedule a variant of the program RHAUTUPD_NEW.

○       Performing the User Master Comparison

With this action, you start the user master comparison in dialog for individual roles. You can select the required processing types (see 4.).

       4.      If you have selected Perform User Master Comparison, choose one or more of the following processing types:

○       Profile Comparison: Start the profile comparison immediately after generating or importing profiles. If you are using time-dependent role assignments, we recommend that you schedule this daily as a background job. This compares the authorization profiles with the user master records; that is, profiles that are no longer current are deleted from the user master records and the current profiles are entered in the user master records.

○       Composite role comparison: Start the composite role comparison if you make changes to a composite role definition (that is, if you add or delete single roles to a composite role) or import a change. Single-role assignments are compared with the composite role assignments for the user. If you add single roles to the composite role, the single roles are assigned to those users that are assigned the composite role. Conversely, if single role assignments are deleted for the users, the single role is removed from the composite role.

○       HR comparison: Start the HR comparison, if you make changes to your local organizational management model that influence the indirect role assignment or transport these to the system. You can only select this processing type if organizational management is active; that is, if the switch HR_ORG_ACTIVE is set in the table PRGN_CUST to YES.

○       Clean-Ups: Perform clean-ups when you generate or import profiles. Generated profiles that no longer exist are deleted. Regular clean-ups are particularly important if you transport your roles and profiles frequently, as this helps to solve possible inconsistencies quickly.

You can also select the following options:

○       Display error messages: All error messages are displayed on the screen in dialog mode.

○       Replicate local HR assignments in the central system: You can only select this option if you are in a child system of a CUA group and if organizational management is active. This option replicates the role assignments that exist in the child system that originate through relationships in the local organizational management model, for information in the CUA central system. You can display these relationships in the user maintenance (transaction SU01).

 

Editing User Defaults and Options

Both system administrators and individual users can edit user data. The system administrator can edit all data . Users can edit the following user data: Password, Constants, Addresses and Parameters.

The following sections describe the user options that every user can set himself or herself.

Editing Your Own User Data

Users can edit their own data by choosing System ® User profile ® Own data. Choose F1 to display Help on the fields. You can display selectable input values with the possible entry help (F4).

Password

Users can change their current password using the Password button. The password can only be changed once every day.

Fixed Values

Users can set the following default values and can call up information about this with F1:

●      Start menu

The user can specify the name of an area menu from the possible entries help in this field. The SAP Menu then only contains the components of this area menu.

A user needs the credit management transactions for his or her daily work. If the start menu in his or her user data is FRMN, the SAP Menu only displays the credit management transactions.

The system-wide initial menu can be specified in the transaction SSM2.

●      Logon language

The default system language at logon. Users can however choose another language on the logon screen

●      Output device

●      Spool control

●      Personal time zone (different from the company time zone on the Address tab page, crucial with RFC)

●      Date format

●      The format for decimals

●      CATT test status

Address

The user address data fields are self-explanatory. Only the system administrator can edit company addresses.

A time zone is assigned to each company address. User-specific time zones can overlap company time zones (see Defaults above).

Parameters

User parameters supply defaults to SAP fields. If a field is indicated, the system automatically fills in the default value. Depending on the field definition, the entry can also be replaced with a value entered by the user.

The two input fields on the parameter editing screen are described briefly below. For more information, choose F1.

●      Parameter: Enter the parameter ID for which you want to define a default value. You can display all of the parameter IDs defined in the system by choosing F4.

●      Value: Enter the default value for the parameter.

 

Indirect Role Assignment Using Organizational Management (OM)

The employees or users require appropriate authorizations to perform their tasks. As the authorization administrator, you can assign the roles required for this (single and/or composite roles) directly using transactions SU01, SU10, and PFCG or indirectly using the organizational management model.

If the employee changes, you do not need to assign the role to the new employee again, but only the position. In this way, the new employee automatically receives the roles assigned indirectly through the position.

If an employee changes position, the personnel administrator assigns a new position to the employee. This means that the employee loses the authorizations that belonged to his or her old position, and receives the authorizations for his or her new position

 

Prerequisites

●     You have defined an active plan variant in the current client.

●     The infotype 0105 is maintained in the HR system, so that the connection between the employee and the user ID can be created.

●     The Customizing switch HR_ORG_ACTIVE in table PRGN_CUST is set to YES to activate the organizational management for role administration.

●     The evaluation path US_ACTGR (table T77AW) is adjusted.

●     You have shown the Org.Management button (transaction PFCG ® Goto ® Settings ® Complete View).

 

Assigning a Role Indirectly

      1.      Choose Tools ® Administration ® User Maintenance ® PFCG – Roles (transaction PFCG).

      2.       Choose Goto ® Settings ® Total View (Organizational Management and Workflow).

       The Org.Management pushbutton is then displayed on the User tab page. 

       3.      Specify the role that you want to assign indirectly, and choose Display. 

       4.      Choose the Org.Management button on the User tab page.

The Role: User Assignment screen appears. 

       5.      Switch to change mode, and choose the Create Assignment pushbutton.

The system displays the Select processor type dialog box, in which you can select some or all of the following object types, depending on the evaluation path:
position, job, organizational unit, position, work center, and user.

The assignments for the User object type are then completely identical to the assignments maintained on the User tab page.

       6.      Select the object to which the role is to be assigned.

       7.      In the following dialog box, select an available object (for example, using the possible entries help) and choose Create.

The assignments created in this way are called indirect user assignments, as they are not made directly between the user and the role.

These indirect user assignments are stored as gray in the user display and highlighted in color.

 

Status Display and Maintenance

The status display in the Org.Management button shows whether you need to update the indirect user assignments:

●     Green: User assignments are current

●     Red: User assignments are not current, the indirectly assigned users are not completely displayed on the tab page.

 

Comparing the Indirect Role Assignments

You have the following options to update the assignment:

●     Choose Org.Management and then Compare indirect user assignment.

●     Perform the manual user master comparison that also automatically updates the indirectly assigned users.

●     Schedule report PFCG_TIME_DEPENDENCY periodically. This report performs a complete comparison, consisting of organizational management, composite role, and profile comparisons.

●     Create a variant of report RHAUTUPD_NEW (transaction PFUD), in which the HR Organizational Management Comparison indicator is set on the selection screen, and schedule this variant periodically.

●     Call transaction PFUD and set the indicator HR Organizational Management Comparison  on the selection screen

This means that all indirectly assigned users for which the assignment has become valid on the basis of the assignment period are directly assigned to the role, and all directly assigned users for which the assignment has become invalid are removed.

 

Authorization Error Analysis Functions

 

If you have imported the Support Packages from SAP Notes 968915, 1008990, and 1033149, the following special functions are available to you in transactions SU53 and SU56.

Functions in SU53

You can use the print function to print a completely-expanded tree of the authorization data.

You can choose the Other User button to displays the failed authorization check of another user, though only if the user in question has already started transaction SU53 himself or herself.

Functions in SU56

You can use the print function to print a completely-expanded tree of the authorization data to print, or print only all authorization objects with the associated class and the name of the authorization that contains the object.

The input help for Other User/Authorization Object provides all users of the system or all objects from the user buffer of the selected user.

The tree display contains an empty class with an authorization object if there are authorization objects in the user master that are not assigned to any class.

The tree display only contains roles or profiles of a reference user for an authorization object if the authorizations are not contained in a role or profile that is directly assigned to the user.

Functions in SU53 and SU56

The search only displays the next hit in the tree display. To obtain all hits in a separate window, use the search in the print preview (Text View button). You can also select sections of the tree in the print preview.

The tree display contains all profiles (composite and single profiles) that are directly assigned to the user and contain the authorization. If the authorization is contained in a single role, which is in turn contained in a composite role, only the single role that is indirectly assigned to the user is displayed.

 

Analyzing Authorizations using the System Trace

To start tracing authorizations, proceed as follows:

1. Choose Tools -> Administration, Monitor -> Traces -> System trace.
2. Choose the trace component Authorization check and then Trace on. The system then automatically writes the trace to disk.
3. To restrict the system trace to your own sessions, choose Edit -> Filter -> General. In the dialog box displayed, enter your user ID in the field Trace for user only.
4. After you have completed your analysis, choose Trace off.
5. To display the results of the analysis, choose Goto -> Files/Analysis or choose the pushbutton File list. Position the cursor on the file that you want to analyze and choose Analyze file.
You will see authorization tests entries in the format <Authorization object>:<Field>=<Value tested>.

You can display a formatted view of an authorization check by double–clicking an entry. (You may need to scroll down in the display to reach the formatted view of the entry.)

If no authorization entries exist or the system displays the message Authorization entries skipped, check that you have set the trace switches correctly. If the switches are correct, then choose Trace file -> Analyze file and ensure that Trace for authorization checks is selected

Transporting Authorization Components

 

There are two different processes for transporting authorization components, roles and user master records, depending on the type of transport:

• Transports between clients (within an SAP System)

• Transports between R/3 Systems

The procedures for both kinds of transport are detailed below.

 

Transport Between Clients

User master records and authorization components are client-dependent. You need to maintain separate user master records and authorization components for each client in your R/3 System.

In the target client, choose Tools ®

Administration ® System administration, Administration ® Client admin. ® Client copy ® Local copy (Transaction SCCL). Here you can transport user master records and authorization profiles from other clients. To do this, enter the profile SAP_USER or choose from the possible entries.

Schedule the transport for background processing during the night. This ensures that data remains consistent.

 

Transport Between SAP Systems

You can copy authorization components, roles and user master records from one SAP System to another. The method of transport depends on the component that you want to transport.

 

Transport Roles

You use Transaction PFCG to transport an role. Enter the role and choose Transport. The system displays a dialog box that queries whether the user assignment and the personalization data should also be transported. Next, enter a transport request. The role is entered in a Customizing request. Use Transaction SE10 to display this.

The authorization profiles are transported along with the roles. Unlike in previous releases, the profiles no longer have to be regenerated in the target system using Transaction SUPC. However, you must compare the user master records for all roles that are imported into the target system.

If the user assignments are also transported, they will replace the entire user assignment of roles in the target system. If you want to lock a system against importing user assignments of roles, you can specify this in the Customizing table PRGN_CUST. You maintain this using Transaction SM30. Add the line USER_REL_IMPORT and the value NO.

You should only transport user assignments to roles if you are not using central user administration.

After the import into the target system, you must compare the user master records for all roles involved. You can do this in two ways:

• Start report PFCG_TIME_DEPENDENCY
• In Transaction PFCG, choose Goto ® Mass compare. Enter the role in the Role field. Choose Complete compare and start the report.

You can also prevent authorization profiles from being transported with the roles using a Customizing entry. In the transport source system, make an entry in table PRGN_CUST called PROFILE_TRANSPORT with the value NO. In this case, you must regenerate the profiles in the target system using Transaction SUPC.

 

Transport Manually-Created Profile

To transport selected profiles, proceed as follows:

1. Choose Tools

® Administration ® User maintenance ® Manual maintenance ® Edit profiles manually. Create a profile list and then choose Profile ® Transport.

Select the profiles you want to transport in the list displayed. You can also select all profiles.

Enter the transport request number for each profile or profile group in the dialog box.

The system asks whether you want to transport just the profile, or the authorizations it contains as well. You can either transport the profile by itself, or include all of its components in the transport request.

The system also transports the documentation for the profiles and authorizations.

When you have finished your selection, you can execute your transport request using the Workbench Organizer.

Transport Manually-Created Authorizations

The procedure for transporting authorizations is the same. First start the authorization maintenance function. Do this by choosing User maintenance

® Authorization. Choose an object class and then Authorization ® Transport.

 

Transporting Authorization Objects and Authorization Object Classes

Whenever you create or change authorization object classes, the system displays a dialog box in which you can enter a change request. Release this request for the desired target system.

 

Transporting User Master Records

You copy user master records using either the tools described above or via central user administration.

 

Transporting Check Indicators and Field Values

You can use Transaction SU25 (Step 3) to transport all check indicators and field values.

Note that the transport overwrites all existing check indicators and field values in the target system.

You can use Transaction SU24 to maintain individual check indicators. You can use the Workbench Organizer to record your changes. By executing the corresponding transport request, you distribute your check indicators to other systems.

 

Transporting Templates

All SAP templates are automatically identical in all systems following an upgrade. You cannot change SAP templates.

The Workbench Organizer records changes to your own templates. Transport the request. The objects in the transport request have the following syntax:

R3TR SUSV <Template Name>

The system transports the template name (in all languages) as well as the maintained data.

 

Reducing Authorization Checks in Transactions

 

You can display the authorization objects associated with each transaction. You can also exclude any of these authorization objects individually from the authorization check. You should have a thorough knowledge of this application and its context before you start.

Proceed as follows:

1. From the initial screen of Transaction SU24, choose Maintain check indicators for transaction codes.
2. Enter either a single transaction code (for example, SE01) or an interval for a range of codes (for example, SE10 to SE38).

   The system displays either a single transaction or a list of transactions. See the note below regarding parameter transactions. If you are dealing with a parameter transaction, the target transaction appears in the right hand column under Tcode (original).

3. Select the required transaction and then choose the appropriate pushbutton.

   The system displays a list of the authorization objects involved along with their Check Indicators.

   Using the pushbuttons, you can display field values for individual objects as well as the SAP-default values for check indicators. SAP-default values you have changed are displayed in color.

   Choose the Info Auth. obj. pushbutton to display a help text for the object that is currently marked.

4. Set the check indicator to N to stop the check. See the note below regarding parameter transactions.
5. Save your settings.

The default values and the check indicator of an authorization object are important for the Profile Generator. These values are only displayed for changing in the Profile Generator if you have set the check indicator to CM (check / maintain).

If you have set authorization checks for your own transactions, you need to enter the authorization objects which you have used into Transaction SU24 manually and also maintain the check indicators.

Authorization objects used in parameter transactions cannot be excluded from a check directly, only using the authorization objects in the corresponding target transaction.

If you want to set the check indicator of parameter Transaction XYZP to N, you need to change the check indicator for the target Transaction XYZE. You can find the name of this transaction in the right-hand column of the transaction overview in Transaction SU24. If you double–click the transaction code, the system goes directly to check indicator maintenance.

If the authorization object for parameter Transaction XYZP is set to C (check) but under the target transaction it is set to CM (check/maintain), the field values which have been maintained for XYZE will be proposed in the Profile Generator. If the authorization object is also set to CM in XYZP, the field values maintained for XYZP will be proposed in the Profile Generator, and the entries for XYZE will be overridden.

When using Transaction SU24 for parameter transactions you can only maintain and/or overwrite the field values of the target transaction.

Globally Deactivating Authorization Checks

You can globally deactivate authorization checks with Transaction AUTH_SWITCH_OBJECTS. The system does not execute any authorization checks for deactivated authorization objects.

You deactivate authorization objects in the tree display by selecting the checkbox to the left of the object. The deactivated authorization objects are then displayed in red. The authorization checks are not ignored in the system until you save your settings.

You cannot globally deactivate authorization objects that begin with "S_" (Basis) or "P_" (HR) in Transaction AUTH_SWITCH_OBJECTS.

Globally deactivating authorization checks considerably reduces authorization maintenance. The system does not insert any authorization data in the Profile Generator for deactivated authorization objects. With Release upgrades, transactions whose authorization data is to be postprocessed are not displayed for postprocessing if the corresponding authorization object is globally deactivated.

If you activate authorization objects that were previously deactivated, note that you may have to postprocess the authorization data for many roles.

If you reactivate authorization objects, these objects are not contained in any roles. In this case, call Transaction PCFG and choose Read old status and compare with the new data in the tab Authorizations in expert mode to generate profiles. Maintain any authorization values that are missing and then regenerate the profile.

You can transport the settings in Transaction AUTH_SWITCH_OBJECTS. During the transport, for reasons of security the system transports the inactive (saved) version of the deactivated authorization objects. You activate the deactivated authorization objects by choosing Authorization objects ® Activate data.

To save or activate deactivated authorization objects, you require authorization for object S_USER_OBJ. For reasons of security, you should assign authorizations for saving and activating the deactivated authorization objects for various users. It makes sense to deactivate the authorization checks only if at least two people agree on this.

The option to globally deactivate authorization checks is controlled by system parameter auth/object_disabling_active. This parameter is set by default.

Role Maintenance: Tips and Tricks

Limiting Activities by Time

Even if you are not using HR-Org. you can still take advantage of the option to assign roles to users for a limited period of time. This is useful, for example for your end of year procedure, where inventory activities should only be permitted for a limited time.

Choose Tools -> Administration -> User maintenance -> Roles.

Under the tab User, you can set the assignment validity period.

To put a time–delimited assignment of an activity group to a user master record into effect, you must first execute a comparison.

The authorization profile is only entered or deleted in the user master record automatically if you have scheduled the background report to run periodically.

Job scheduling is also important for ensuring role consistency after an import.

SAP recommends that you schedule background program PFCG_TIME_DEPENDENCY for these cases.

User assignment

Never insert generated profiles directly into the user master record (Transaction SU01). Assign the role to the user in the Roles tab in transaction SU01 or choose the User tab in role maintenance (PFCG) and enter the user to whom you want to assign the role or profile.

If you then compare the user master records, the system inserts the generated profile in the user master record.

Do not assign any authorizations for modules you have not yet installed

If you intend to gradually add modules to your system, it is important you do not assign any authorizations for those modules you have not yet installed. This ensures that you cannot accidentally change data in your production system you may need at a later stage.

Leave the corresponding authorizations or organizational levels open. Do not set the

Check Indicator in Transaction SU24 to No check.

 

Initial authorization assignment

You want to create a user in the test system who can do "almost anything": typically, such users cannot create a user master record or change authorization profiles.

The fastest way to set up this user is as follows:

1. Create a role.
2. In Authorizations, choose Change authorization data and then Edit ->

Insert -> Full authorization.

Expand the Basis administration object class.
This contains the authorization objects generally regarded as critical.

Deactivate all authorizations which begin with User master maintenance and any others which you regard as critical. You need the authorization User master maintenance: User groups (S_USER_GRP) with the value * in the fields CLASS and ACTVT for transaction SU24.

Generate the profile and assign the authorizations to a user under User.

You assign the role you have just created to users entering them in Role.

 

Comparing User Master Records

 

You can set a time limit on the assignment of roles to user master records. As a result some data will become invalid on a particular day, whilst other data becomes valid.

You cannot set time limits for authorization profiles and their entry in user master records.

To ensure that only authorization profiles which are valid are contained in the user master record each day, you must execute a daily profile comparison.

So that changes in the user master record are effective, you should execute the comparison before the user logs on.

 

There are two ways to execute the comparison.

1. As a background job before the start of each day.

   If report PFCG_TIME_DEPENDENCY is run every night, the authorization profiles in the user master will be current each morning (assuming that the job has run correctly). The best procedure is to schedule this as a periodic background job.

   Report PFCG_TIME_DEPENDENCY must also have run after each import of roles from other systems.

2. Using Transaction PFUD, Compare User Master

As an administrator, it is recommended that you use this transaction regularly to check that no errors have occurred in the background job. Any such errors can then be corrected manually.

To ensure that the authorization profiles in the user master records are always current, you should always execute a complete comparison of all roles (by choosing Complete comparison).

Following the comparison the system displays a log which includes any errors that occurred (background processing log for background report).

You have the following options in Transaction PFUD:

• Schedule or check job for the full comparison

Here you can start report PFCG_TIME_DEPENDENCY by specifying the time when the job is to start. The overview displays the status of jobs that have already been scheduled.

• Manual profile selection

Before comparing the user master record, you can select the profiles that are to be compared. The system displays an overview of the user master records to which profiles have been added, or from which profiles have been removed, during the comparison. If you deselect the relevant checkbox, you can exclude the profiles that should not be included in the user master record comparison. You start the comparison by choosing User master comp.

To compare the user master records belonging to selected users, first position the cursor on a user name and then choose Select user. You execute the comparison by choosing User master comp.

The status display for the user master comparison is only set to green once the comparison is executed.

• Complete comparison

With a complete comparison, all invalid authorization profiles are removed from the user master record and all new authorization profiles are inserted in the user master record.

The options Add new profiles, Delete expired authorization profiles and Output error messages are related to the actions described above.

You can also specify whether or not HR Organizational Management should be included in the comparison (Reconcile with HR Organizational Management).

 

SAP default users and passwords

1.
Product	Business Connector
Version	4.7
User ID	Administrator
Password	manage
Level	Administrator

2.
Product	Business Connector
Version	4.7
User ID	Developer
Password	isdev

3.
Product	Business Connector
Version	4.7
User ID	Replicator
Password	iscopy

4.
Product	ITS
User ID	itsadmin
Password	init

5.
Product	SAP
Version	R/3
User ID	SAP*
Password	06071992

6.
Product	SAP
Version	R/3
User ID	SAPCPIC
Password	admin

7.
Product	SAP
Version	R/3
User ID	DDIC
Password	19920706

8.
Product	SAP
Version	R/3
User ID	EARLYWATCH
Password	SUPPORT

9.
Product	SAP
Version	R/3
User ID	TMSADM

10.
Product	SAP
Client	000, 001, 066
User ID	SAP*
Password	06071992

11.
Product	SAP
Client	000, 001
User ID	DDIC
Password	19920706

12.
Product	SAP
Client	000
User ID	SAPCPIC
Password	admin

13.
Product	SAP
Client	066
User ID	EARLYWATCH
Password	SUPPORT

14.
Product	SAP Local Database
User ID	SAPR3
Password	SAP

15.
Product	Visual Composer
User ID	ctb_admin
Password	sap123
Level	Administrator

16.
Product	xMII
User ID	xmi_demo
Password	sap123

17.
Product	R/3
User ID	SAP*
Password	PASS
Level	Administrator

Important SAP Security Notes

Collective Security Note: 1394093

1394100 Access to RFC-enabled modules via SOAP

1375125 Report BEFG_TEMPLATE_CREATE must not be used in production

1363371 FS-CD: Missing authorization checks SAPRGEN_CD

1362972 Industry Solution Migration Workbench: Authorization check

1361038 Report RJ-JXINI generates unnecessary source code

1357370 No authorization check for editor

1356215 Missing authorization check in EMMACLS generation program

1355614 IS-M/ PMD: Obsolete source code in master data generator

1237762 ABAP systems: Protection against password hash attacks

821875 Security settings in the message server

2383 – Documentation: description of “super user” SAP*

2467 – Password rules and preventing incorrect logons

13202 – Security aspects in ABAP programming

26909 – SE16 – Security

68048 – Deactivating the automatic SAP* user

862989 – New password rules as of SAP NetWeaver 2004s (NW ABAP 7.0)

874738 – New password hash calculation procedure (code version E)

991968 – Value list for login/password_hash_algorithm

1023437 – ABAP syst: Downwardly incompatible passwords (since NW2004s)

1133739 – Security note: Security gap in Data Browser (SE16)

1392352 Cross-site scripting

1388864 ABAP web services authorization check does not work

1388729 SE80 authorization check in RS_TOOL_ACCESS

1375125 Report BEFG_TEMPLATE_CREATE must not be used in production

1363371 FS-CD: Missing authorization checks SAPRGEN_CD

1362972 Industry Solution Migration Workbench: Authorization check

1361038 Report RJ-JXINI generates unnecessary source code

1357370 No authorization check for editor

1356215 Missing authorization check in EMMACLS generation program

1355614 IS-M/ PMD: Obsolete source code in master data generator

1342183 Security information: Transaction FIAAHELP

1340457 Encoding fix for technical hidden fields

1339620 Cross Site Scripting (XSS) in cFolders

1339326 F&R: Remove hardcoded user name branches in code (security)

1336947 Security correction: Username hard coded

1335926 Some Fields are susceptible to Cross-site scripting

1335103 Security correction: removal of hardcoded user names

1334396 Security Checks: Removal of hardcoded user names

1334244 Some Fields are susceptible to Cross-site scripting.

1333668 Security Checks: Model Mix Planning

1330776 Files transferrable to EPS inbox w/o auth.

1329090 Deactivate parameter sap-wd-ssrConsole

1327917 Authorizatn check for transactions FPSEC1/FPSEC2/FPSEC3

1315883 RSUSR003: Standard passwords for hash code versions H and I

1306604 /SAPAPO/MC62 authorization for creating CVCs

1304803 Security note: Changing a transport without authorization

1302928 Field Level Authorizations Not Being Checked in CASE

1298160 Security note: Forbidden program execution possible

1294675 Location: Authorization Check for Planning Version

1294431 Anchor links are generated with unwanted HTTP href address

1292875 Cross Site Scripting (XSS) in cFolders

1287570 BBP_QUOT: Cross-Site Scripting ( XSS )

1275278 Security: HTML Encoding missing over the inputField tooltip

1271688 Security: Authorization check for technical help

1267878 Cross-site scripting error in BBP_POC

1262016 Authorization check for deleting CVCs (/SAPAPO/MC62) 2.

1261319 Help Center user name in the URL

1259881 Prevent “Webadmin” task from system admin

1259414 Cross Site Scripting:PCUI Stored JavaScript Vulnerability

1243004 Security Note: Missing SYSLOG entries for ABAP Debugging

1235367 Authorization check for deleting CVCs (/SAPAPO/MC62)

1232490 Authorization check SE80 for where-used list

1168813 Program DISPLAY_FUNC_INCLUDE

1167258 Program RS_REPAIR_SOURCE

1159009 RSDB2CMD switched to RSBDCOS0

1158063 P18:Security Note:RSSM_EXEC_COMMAND converted to RSBDCOS0

1151557 External theme root not html escaped

1146690 Passwords in SLD ABAP API

1143177 Cache settings incorrect for WebDynpro ABAP

1142067 Missing authorization check for hidden functions

1136823 SOBJ: Display of object directory permits changes

1136770 Security note: ICF system login

1133739 Security note: Security gap in Data Browser (SE16)

1120760 Security note: Missing authorization check for Web services

1115699 CO-OM Tools: SE16N: Adapting to SE16

1085326 Security Note: Check for ‘System -> Status’ (SE80)

1058531 BBPSC: Cross-site scripting error

0957038 Security gap in cross-site scripting

863362 Security checks in the SAP Early Watch Alert

Security Tip: Use RSECNOTE for Automatic checks for security notes, check SAP Note: 888889

FAQs on Central User Administration

What is Central User Administration, and what can I do with it?

Central User Administration (CUA) consists of one central system where you maintain user master records, and any number of child systems to which changes in the data are distributed automatically. This gives you an overview in the central system of all user data in the entire system landscape.

CUA data is distributed asynchronously between the application systems in an Application Link Enabling (ALE) environment. The central system in the CUA ALE environment is linked to each child system in both directions. The child systems are not linked to one another. When distributing data from the CUA and one system is down, ALE technology tries at regular intervals to send the data until it is successful. You can also manually trigger IDocs to be sent.

For users, you can do the following centrally:

• Create, lock, change, assign roles, assign profiles
• Set in which systems field attributes can be changed

Users are distributed via ALE. Passwords are not distributed, but can be reset to initial. Otherwise, passwords can only be changed locally.

Authorization objects and fields reside locally, not in the central system. Therefore, before you assign roles and profiles centrally, they have to be created and tested in the development systems and transported to the production system. You then assign users per logical system.

From which release is CUA available?

Central User Administration is a standard part of SAP user management. It first became available with R/3 Release 4.5, but SAP recommends that you implement Basis Release 4.6C or higher for the central system. Client systems between R/3 Release 4.5 and Web Application Server Release 6.20 can connect to the CUA by means of Application Link Enabling (ALE). You can integrate systems with different releases, for example, you can have CUA running under 4.6C with one child system running under 4.5B and another under 6.20. However, SAP recommends that the central system in any given configuration has the highest release.

Can the users on systems with SAP R/3 4.0 and lower be administered with Central User Administration on SAP R/3 4.5 and higher?

No.

Do I have to maintain roles in the Central User Administration (CUA) once CUA is used?

The system offers you a reasonable degree of flexibility about where you maintain roles. If you are using this feature to assign a role to objects in the organizational structure, such as positions, users, and so on, you should keep in mind the target systems and where you would like to maintain the allocation to the organizational structure.

Does CUA provide me with single sign-on functionality?

Setting up a CUA system does not provide any form of single sign-on functionality. For information on single sign-on using SAP Logon Tickets, see the documentation in the SAP Help Portal under mySAP Technology Components -> SAP Web Application Server -> Security -> SAP Web Application Server Security ->User Authentication.

Can I migrate existing users to CUA?

To set up a CUA, you use the migration tool provided (transaction SCUG) to migrate existing local users. At present, users’ company addresses have to be synchronized manually, see SAP Note 439122. As soon as an automatic synchronization function for company addresses is complete, it will be available for all releases of CUA.

What should my system landscape look like with CUA?

SAP recommends that you have a standalone Web Application Server with the CUA in one client. This configuration has the following benefits: Basis-only upgrades are possible (which gives you access to new functions quickly). It is easier to apply patches.

How does CUA integrate with HR Organizational Management?

We are working on this, and at present there are two scenarios in which you can successfully use HR Organizational Management and Central User Administration together:

HR-Org in the child systems of the CUA, and local role assignment

In this scenario, both direct role assignment (transactions SU01, SU10, and so on) and assignment via the HR organizational structure are performed locally. You need to set the switch in transaction SCUM of the central system to local role assignment. HR-Org in the central CUA system, and global role assignment In this scenario, both direct and indirect role assignment are performed only in the central system. To do this, the HR organizational model has to be migrated from the HR system to the central system (for more information on how to do this, see the documentation on role maintenance). In this scenario, single roles for a specific target system cannot be assigned via the HR organizational structure. You can, however, assign collective roles that consist of single roles for specific target systems.

How can I link indirect role assignment using organizational management in HR with central user administration?

There are two scenarios in which you can successfully use HR Organizational Management and Central User Administration together:

1. HR-Org in the child systems of the CUA, and local role assignment: Both direct role assignment (transactions SU01, SU10, and so on) and assignment via the HR organizational structure are performed locally. You need to set the switch in transaction SCUM of the central system to local role assignment.
2. HR-Org in the central CUA system, and global role assignment: Both direct and indirect role assignment are performed only in the central system. To do this, the HR organizational model has to be migrated from the HR system to the central system (for notes on how to do this, see the CUA documentation). In this scenario, single roles for a specific target system cannot be assigned via the HR organizational structure. You can, however, assign collective roles that consist of single roles for specific target systems.

Where can I create Internet users?

You can no longer create Internet users in transaction SU05. You now create reference users in transaction SU01 with the appropriate user type. However, you can use transaction HRUSER to create Employee Self Service users.

Can I use CUA with the SAP Enterprise Portal?

The mySAP Enterprise Portal uses CUA to integrate with user management information defined in existing SAP systems. CUA enables administrators to store all SAP user data in a central system that can be synchronized with the corporate LDAP directory. This synchronization functionality is available in Web Application Server 6.10 and above.

Can I use CUA with the License Administration Workbench?

There is a development planned for the WebAS release higher than 6.30 to use the CUA to distribute the user classification required by the system measurement tools, including the License Administration Workbench (LAW). To use this functionality, you will need a minimum of WebAS release higher than 6.30 for the central system and WebAS 6.20 plus the relevant support package for the client systems. In general, you can run the LAW and CUA in the same central system, but the two do not communicate directly. No license measurement is carried out by the CUA itself, because the LAW requires more information than the CUA can provide, for example, with regard to engines (an engine is a chargeable software component that is not exclusively calculated for each user).

Where can I find more information?

You can find the complete documentation in the SAP Help Portal (http://help.sap.com) under mySAP Technology Components -> SAP Web Application Server -> Security-> Users and Roles. Of particular interest for integration with HR Organizational Management is Users and Roles -> Role Maintenance -> Indirect Role Assignment Using HR-ORG.

There is an SAPTutor and a cookbook on CUA available at http://service.sap.com/security, under Security in Detail -> Identity Management. If you are experiencing difficulties with CUA, see the composite SAP Note 159885. If you have any questions regarding CUA or other security issues, feel free to contact the SAP Security Team at security@sap.com.