Authorizations in SAP S/4HANA and SAP Fiori

Multilingual Book

🇺🇸 English (Original) 🇪🇸 Spanish (Translation)

✅ All languages are included in your purchase

Publisher SAP PRESS

Year / Edition 2022 / 1

Pages 625

Authors Alessandro Banzer, Alexander Sambill

Authorizations in SAP S/4HANA and SAP Fiori

Develop a complete authorization concept for SAP S/4HANA and SAP Fiori with this guide! Start by understanding how authorizations work in an ABAP system and exploring the main transactions you’ll use for configuration. Then learn to create roles with Transaction SU24 and the Profile Generator, track and correct missing authorizations with traces, manage users, and more. See how SAP Access Control can be a useful tool to manage authorizations and learn to migrate authorizations to SAP S/4HANA.

Configure and maintain ABAP authorizations for SAP S/4HANA and SAP Fiori
Work with roles, profiles, authorization objects, and system traces
Maintain system users, manage roles with SAP Access Control, and more

You'll learn about:

Authorization Concept:
Create and configure SAP S/4HANA roles that comply with business and legal regulations. Learn to use traces, maintain user master records, and debug authorizations.
Tools and Transactions:
Master essential authorization management tools and transactions, including Transactions SU24, PFCG, SU01, and SAP Access Control.
SAP Fiori:
Design roles and configure frontend and backend authorizations for SAP Fiori.

Key Highlights:

ABAP authorizations
Roles
Transaction SU24
Profile Generator
Authorization traces
User maintenance
SAP Access Control
Debugging
Migration
Xiting Authorizations Management Suite (XAMS)

View Full Table of Contents

Preface
- Target Audience
- Structure of This Book
- Acknowledgments
1 Introduction to SAP Authorizations
- 1.1 What Are Authorizations?
- 1.2 User Access in the SAP System
- 1.3 Evolution of Authorizations from SAP ERP to SAP S/4HANA
  - 1.3.1 SAP ERP
  - 1.3.2 SAP S/4HANA
  - 1.3.3 SAP S/4HANA Deployments
  - 1.3.4 Other SAP Cloud Solutions
- 1.4 SAP Fiori (Presentation Layer)
- 1.5 Native Authorizations in SAP HANA (Database Layer)
- 1.6 Hybrid System Landscapes and Implications on Authorizations
  - 1.6.1 Business Roles and SAP Business Technology Platform
  - 1.6.2 SAP Cloud Identity Access Governance
  - 1.6.3 Access Provisioning in Hybrid Landscapes
  - 1.6.4 Access Risk Analysis in Hybrid Landscapes
- 1.7 Summary
2 ABAP Authorization Concept
- 2.1 Influences on the SAP Authorization Concept
- 2.2 Basic Principles for an SAP Authorizations Concept
- 2.3 ABAP Authorizations
  - 2.3.1 Components
  - 2.3.2 Authorization Default Values
  - 2.3.3 Code-Based Namespaces
  - 2.3.4 Creating Custom Authorizations
  - 2.3.5 Creating Custom Organizational Levels
- 2.4 Roles and Profiles
  - 2.4.1 Roles
  - 2.4.2 Profiles
- 2.5 Users
  - 2.5.1 User Master Record
  - 2.5.2 User Buffer
  - 2.5.3 User Types and Maintenance
- 2.6 Authority Checks
  - 2.6.1 Locking Status Checks
  - 2.6.2 Application Start Checks
  - 2.6.3 Transaction Start Plausibility Checks
  - 2.6.4 Parameter Checks
  - 2.6.5 Kernel Checks
  - 2.6.6 Program Code Authority Checks
  - 2.6.7 SAP System Authorization Check Processing
  - 2.6.8 Switchable Authorizations
  - 2.6.9 Deactivating Authorization Checks
- 2.7 Critical Authorizations
  - 2.7.1 Critical Access Scenarios
  - 2.7.2 Audit-Focused Authorization Objects
- 2.8 Authorizations in SAP ERP Human Capital Management
  - 2.8.1 Business Transactions and Authorization Components
  - 2.8.2 All-Access in SAP ERP Human Capital Management
- 2.9 Different Transaction Types
  - 2.9.1 Overview of Available Transactions
  - 2.9.2 Creating Custom Transactions
  - 2.9.3 Locking and Unlocking Transactions
- 2.10 SAP System Check for Security Flaws
  - 2.10.1 System Configuration Analysis
  - 2.10.2 Document Analysis
  - 2.10.3 Roles Analysis
  - 2.10.4 User Analysis
- 2.11 Customizing of SAP Security Settings
  - 2.11.1 Table PRGN_CUST
  - 2.11.2 Table SSM_CUST
  - 2.11.3 Table USR_CUST
- 2.12 Summary
3 Designing Authorization Concepts
- 3.1 Role Design Approaches
- 3.2 Role Types
  - 3.2.1 Single Roles
  - 3.2.2 Composite Roles
  - 3.2.3 Enabler Roles
  - 3.2.4 Authorization Templates and Standard Roles
  - 3.2.5 Comparison of the Role Design Concepts
- 3.3 Segregation of Duties
- 3.4 Determining When to Use Enabler Roles
- 3.5 Role Naming Convention
- 3.6 Summary
4 Xiting Authorizations Management Suite
- 4.1 Overview
- 4.2 Xiting Role Designer
  - 4.2.1 Capabilities
  - 4.2.2 Analysis and Design
  - 4.2.3 Reporting Options of Xiting Role Designer
  - 4.2.4 Reporting Options for Menu Objects
  - 4.2.5 Reporting Options for Business Data
- 4.3 Xiting ABAP Alchemist
- 4.4 Xiting Role Replicator
  - 4.4.1 Bulk Processing of Users, Roles, and Authorizations
  - 4.4.2 OrgSet Replication
- 4.5 Xiting Role Builder
- 4.6 Xiting Times
- 4.7 Xiting Role Profiler
- 4.8 Xiting Security Architect
- 4.9 Summary
5 Transaction SU24: Authorization Default Values
- 5.1 Overview
  - 5.1.1 What Are SAP Authorization Default Values?
  - 5.1.2 Technical Background of Authorization Default Values
  - 5.1.3 Helpful Tables
  - 5.1.4 System Layer Alignment
- 5.2 Transaction SU24 Maintenance
  - 5.2.1 Instruments of Transaction SU24
  - 5.2.2 Proposal and Check Indicator Statuses
  - 5.2.3 Maintenance of Default Values and Check Indicators
  - 5.2.4 Comparison between SAP Data and Customer Data
- 5.3 Transaction SU24N
  - 5.3.1 General Changes
  - 5.3.2 Maintaining a Description for Transaction SU24 Data
  - 5.3.3 Default Data Variants
- 5.4 Populating Data from Traces
- 5.5 Best Practice Maintenance of Transaction SU24
  - 5.5.1 Authorization Field Maintenance
  - 5.5.2 List Navigation
  - 5.5.3 Menu Navigation
  - 5.5.4 Navigation Considerations
  - 5.5.5 Cockpit Transactions
- 5.6 Upgrading Authorization Default Values
  - 5.6.1 Importance of Upgrading
  - 5.6.2 Report SU24_AUTO_REPAIR
  - 5.6.3 Related Applications and Tables for a Transaction SU25 Upgrade
  - 5.6.4 Performing the Upgrade for Default Values
  - 5.6.5 Troubleshooting
- 5.7 Transaction SU24 Optimization Tools
- 5.8 Xiting Authorizations Management Suite: Transaction SU24 Optimization Tools
  - 5.8.1 Xiting Role Profiler
  - 5.8.2 Xiting ABAP Alchemist
  - 5.8.3 Xiting Role Builder SU24 Checkman
- 5.9 Summary
6 Role Maintenance in Transaction PFCG
- 6.1 Navigation within Transaction PFCG
  - 6.1.1 Initial Screen of Transaction PFCG
  - 6.1.2 Single Role Maintenance Options and Tabs
  - 6.1.3 Composite Role Maintenance Options and Tabs
- 6.2 Creation of Different Roles
  - 6.2.1 Role Building and Naming
  - 6.2.2 Single Roles
  - 6.2.3 Composite Roles
  - 6.2.4 Reference and Derived Roles
  - 6.2.5 Customizing Roles
  - 6.2.6 Role Templates
  - 6.2.7 Assigning and Removing Roles via Transaction PFCG
- 6.3 Role Menu Objects
  - 6.3.1 Different Maintainable Applications
  - 6.3.2 Using Transaction SU24 Variants
  - 6.3.3 Role Menu Comparison
- 6.4 Authorization Maintenance in Roles
  - 6.4.1 Authorization Maintenance Buttons
  - 6.4.2 Authorization Object Statuses
  - 6.4.3 Authorization Object Update Status Texts
  - 6.4.4 Maintenance of Organizational Levels
  - 6.4.5 Where-Used Lists
  - 6.4.6 Authorization Templates and Other Authorization Insert Options
  - 6.4.7 Import of Traces to Roles
- 6.5 Sustainable Role Building
  - 6.5.1 Best Practice Presettings for Role Maintenance
  - 6.5.2 Best Practice Role and Authorization Maintenance
  - 6.5.3 Role Profile Generation
- 6.6 Role Versions
- 6.7 Roles Overview Status
- 6.8 Selected Mass Maintenance Options for Roles
  - 6.8.1 Mass Role Maintenance
  - 6.8.2 Mass Generation of Role Profiles
  - 6.8.3 Mass User Comparison of Roles
- 6.9 Transfer of Roles
- 6.10 Xiting Authorizations Management Suite: Virtual Role Design with Xiting Role Designer
  - 6.10.1 Project Cockpit
  - 6.10.2 Design Cockpit
  - 6.10.3 Reports Cockpit
- 6.11 Summary
7 Authorization Analysis, Trace Tools, and Authorization Debugging
- 7.1 Overview
  - 7.1.1 Analysis Tools
  - 7.1.2 Selected Authorization Trace Return Codes
  - 7.1.3 Activation of Profile Parameters
  - 7.1.4 Trace Tool Use Cases
- 7.2 Transaction SU53
  - 7.2.1 Description
  - 7.2.2 Authorization Check Failures Evaluation
- 7.3 Transactions ST01/STAUTHTRACE
  - 7.3.1 Description
  - 7.3.2 Trace Evaluation for an Authorization Error
- 7.4 Transaction STUSOBTRACE
  - 7.4.1 Description
  - 7.4.2 Authorization Default Value Maintenance
- 7.5 Transaction STUSERTRACE
  - 7.5.1 Evaluation of Specific Job Functions
  - 7.5.2 Using Transaction STSIMAUTHCHECK
- 7.6 Authorization Debugging
- 7.7 Xiting Authorizations Management Suite: Enhanced Trace Evaluation
  - 7.7.1 Description
  - 7.7.2 Rapidly Analyze Authorization Failure
- 7.8 Summary
8 SAP Fiori Authorizations
- 8.1 Overview
  - 8.1.1 Principles of SAP Fiori
  - 8.1.2 SAP Fiori End-User Applications
- 8.2 SAP Fiori Architecture
- 8.3 Deployment Options
  - 8.3.1 Embedded Deployment
  - 8.3.2 Central Hub Deployment
  - 8.3.3 SAP Launchpad Service
- 8.4 SAP Fiori Apps Reference Library
  - 8.4.1 Overview
  - 8.4.2 Technical Components
- 8.5 SAP Fiori Administrative Tools
  - 8.5.1 SAP Fiori Launchpad Designer
  - 8.5.2 SAP Fiori Launchpad Content Manager
  - 8.5.3 SAP Fiori Launchpad App Manager
  - 8.5.4 Manage Spaces and Pages App
- 8.6 OData Services
  - 8.6.1 Description
  - 8.6.2 Activation of OData Services in Backend Servers
  - 8.6.3 Overview of Activated Services
- 8.7 SAP Fiori Concept Implementation
  - 8.7.1 Technical and Business Catalogs
  - 8.7.2 Business Groups
  - 8.7.3 Business Spaces and Pages
  - 8.7.4 SAP Fiori Launchpad Personalization
- 8.8 Frontend/Backend Server Authorizations
  - 8.8.1 SAP Fiori Role Concept
  - 8.8.2 Role Building Preparation
  - 8.8.3 Role Building for SAP Fiori Applications in the Embedded Deployment
- 8.9 Troubleshooting Tools for SAP Fiori
- 8.10 Xiting Authorizations Management Suite: Tool-Driven SAP Fiori Objects Implementation and Analysis
  - 8.10.1 Xiting Role Replicator
  - 8.10.2 Xiting Role Profiler
- 8.11 Summary
9 User Maintenance
- 9.1 Maintenance of the User Master Record
  - 9.1.1 Different User Types
  - 9.1.2 Creating and Maintaining a User
  - 9.1.3 Copying a User
  - 9.1.4 Change Documents for Users
  - 9.1.5 Mass User Changes with Transaction SU10
  - 9.1.6 Inactive Users
- 9.2 Password Rules
- 9.3 The User Buffer
- 9.4 User Naming Conventions
- 9.5 User Classification
- 9.6 User-Related Tables
- 9.7 User Access Reviews
- 9.8 User Lock Status
- 9.9 Security Policies
- 9.10 Securing Default Accounts
- 9.11 Maintaining User Groups
- 9.12 Central User Administration
  - 9.12.1 Overview
  - 9.12.2 Distribution Parameters for Fields (Transaction SCUM)
  - 9.12.3 Central User Administration-Related Tables
- 9.13 SAP Usage Data for Users
- 9.14 Summary
10 Access Governance with SAP Access Control and SAP Cloud Identity Access Governance
- 10.1 SAP Access Control
- 10.2 SAP Cloud Identity Access Governance
  - 10.2.1 Core Functionalities
  - 10.2.2 Key Capabilities of SAP Cloud Identity Access Governance
  - 10.2.3 Integrated Identity Access Governance for Hybrid Landscapes
- 10.3 Understanding the Ruleset
  - 10.3.1 Ruleset Components
  - 10.3.2 Ruleset Architecture
  - 10.3.3 SAP Standard Rulesets
  - 10.3.4 Organizational Rules
  - 10.3.5 Simulating Risk During Role Building with the Risk Terminator
- 10.4 Segregation of Duties Management Process
  - 10.4.1 Phases of Segregation of Duties Management
  - 10.4.2 Remediation and Mitigation of Risks
  - 10.4.3 Continuous Segregation of Duties Monitoring
- 10.5 Custom Transactions for the Ruleset
  - 10.5.1 Analyzing Custom Transactions
  - 10.5.2 Enhanced Analysis with Xiting ABAP Alchemist
- 10.6 Business Roles
- 10.7 User Access Review
- 10.8 Roles for Firefighters
  - 10.8.1 Defining Appropriate Usage
  - 10.8.2 Firefighter Types
  - 10.8.3 Provisioning Strategies for Firefighters
- 10.9 Impact to Governance, Risk, and Compliance When Migrating and Upgrading SAP Systems
- 10.10 Summary
11 Interface Authorizations and Hardening of Interfaces
- 11.1 Remote Function Call Security
  - 11.1.1 Overview
  - 11.1.2 Trusted and Untrusted Remote Function Calls
  - 11.1.3 Challenges and Risks with Remote System Connections
  - 11.1.4 Authorization Objects to Secure Your Remote Connections
  - 11.1.5 Remote Function Call Callback Whitelisting
  - 11.1.6 Remote Function Call Connections with Logon Data
- 11.2 Best Practices
  - 11.2.1 Golden Rules
  - 11.2.2 Interface User Best Practices
  - 11.2.3 Interface Authorizations Best Practices
- 11.3 SAP Unified Connectivity
  - 11.3.1 How Unified Connectivity Works
  - 11.3.2 Unified Connectivity and Authorizations
- 11.4 Xiting Authorizations Management Suite: Automated and Risk-Free Role Testing and Go-Live
- 11.5 Summary
12 Migrating Authorizations to SAP S/4HANA
- 12.1 Overview
  - 12.1.1 Simplifications within SAP S/4HANA
  - 12.1.2 SAP S/4HANA Data Management Architecture
- 12.2 SAP HANA Database
  - 12.2.1 User Types
  - 12.2.2 SAP HANA Authorizations
- 12.3 SAP S/4HANA Deployment Options
  - 12.3.1 SAP S/4HANA Cloud
  - 12.3.2 SAP S/4HANA Cloud, Extended Edition
  - 12.3.3 SAP S/4HANA Cloud, Private Edition
  - 12.3.4 SAP S/4HANA: Managed by SAP HANA Enterprise Cloud
  - 12.3.5 SAP S/4HANA: On-Premise or Managed by Hyperscale Cloud Providers
  - 12.3.6 Comparison of SAP S/4HANA Deployment Options
- 12.4 Business Process Changes through SAP S/4HANA
- 12.5 Core Data Services in SAP S/4HANA
  - 12.5.1 ABAP versus SAP HANA Core Data Services Views
  - 12.5.2 Security in ABAP Core Data Services
  - 12.5.3 ABAP Core Data Services View Troubleshooting
- 12.6 Preparing for an SAP S/4HANA Migration
  - 12.6.1 Migration Considerations
  - 12.6.2 SAP S/4HANA Approaches
  - 12.6.3 Simplification Item Check
  - 12.6.4 SAP Readiness Check
  - 12.6.5 SAP Best Practices Explorer
  - 12.6.6 SAP S/4HANA Migration Cockpit
  - 12.6.7 Custom Code Validation
  - 12.6.8 Regulatory Requirements and Compliance
- 12.7 Migrating Authorizations to SAP S/4HANA with Standard SAP Tools
  - 12.7.1 Project Administration and Basis Activities
  - 12.7.2 Analyzing Current Role Concepts
  - 12.7.3 Upgrading and Maintaining Authorization Default Values
  - 12.7.4 Analyzing SAP S/4HANA-Related Role Changes
  - 12.7.5 Evaluating and Defining Job Function Roles
  - 12.7.6 Transition and Enhancement of Roles for SAP S/4HANA
  - 12.7.7 Testing Your Authorization Concept
  - 12.7.8 Go-Live and Project Documentation
- 12.8 Xiting Authorizations Management Suite: Helpful SAP S/4HANA Migration Features
  - 12.8.1 Comprehensive Usage Data Collection
  - 12.8.2 Role Changes through the Simplification List
  - 12.8.3 Security Concept
- 12.9 Summary
13 Migrating Authorizations to SAP S/4HANA with the Xiting Authorizations Management Suite
- 13.1 SAP S/4HANA Migration Strategies with the Xiting Authorizations Management Suite
  - 13.1.1 Greenfield Migrations
  - 13.1.2 Brownfield Migrations
- 13.2 Preparation Phase: Role Concept Validation
  - 13.2.1 Verifying Role Concept Quality
  - 13.2.2 Authorization Default Values Compliance
  - 13.2.3 Consistency Verification of the Inheritance Concept
- 13.3 Design Phase: Conceptual Role Migration
  - 13.3.1 Virtual Role Concept Design
  - 13.3.2 Analyzing SAP S/4HANA-Related Role Changes
  - 13.3.3 SAP Fiori Analysis
- 13.4 Implementation Phase: SAP S/4HANA Role Implementation
  - 13.4.1 Role Migration to SAP S/4HANA
  - 13.4.2 Extension of Roles with New SAP S/4HANA Functions
  - 13.4.3 Template Roles Replication
- 13.5 Validation Phase: SAP S/4HANA Role Concept Analysis
  - 13.5.1 Defining and Preparing Test Scenarios
  - 13.5.2 Evaluating and Implementing of Test Results
- 13.6 Activation Phase: Role Concept-Protected Go-Live
  - 13.6.1 End-User Cloning
  - 13.6.2 Authorization Backups
- 13.7 Summary
The Authors
Index

ℹ️ How to purchase this book?

This product has a special price upon request. You can start your order or clarify any doubts using the Contact for Price button on the page.

We have also prepared a step-by-step guide to explain how to easily request your quote.

Read the guide here →

Disclaimer

SAP, other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Our Company is not affiliated to SAP SE or any of its affiliated companies including but not limited to: Sybase, Business Objects, Hybris, Ariba and SuccessFactors. All other names, brands, logos, etc. are registered trade or service marks of their respective owners.

Home > SAP Books > Multilingual Books > Authorizations in SAP S/4HANA and SAP Fiori

Authorizations in SAP S/4HANA and SAP Fiori

Name: Authorizations in SAP S/4HANA and SAP Fiori
Brand: SAP
SKU: BOOK-SAPPRESS-EBOOK-2022-9781493220373
Availability: InStock

Warranty

Receive the product you were expecting or we will refund your money

Would you like to see a sample of the course or book?

If you need a sample of the course or book, request it in the chat below and we will be happy to provide it to you.

1 installment of $0.00 USD without interest		Total $0.00 USD
2 installments of $0.00 USD without interest		Total $0.00 USD
3 installments of $0.00 USD without interest		Total $0.00 USD
4 installments of $0.00 USD without interest		Total $0.00 USD
5 installments of $0.00 USD without interest		Total $0.00 USD
6 installments of $0.00 USD without interest		Total $0.00 USD

Authorizations in SAP S/4HANA and SAP Fiori

You'll learn about:

Key Highlights:

ℹ️ How to purchase this book?

Disclaimer

Authorizations in SAP S/4HANA and SAP Fiori

Related products