Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table AGR_1252
Role Type in the role here and hit execute.
You can always download all the information to spreadsheet also using 
Friday, February 8, 2008
How can I check all the Organization value for any role?
How to find out all the derived roles for one or more Master (Parent) roles?
Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table AGR_DEFINE
Use either agr_name field or Parent_agr field.
How to find out all the roles for one composite role or a selection of composite roles?
Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table AGR_AGRS
Composite roles You can put multiple composite roles using the more button
How to find out all the users who got SU01 ?
Q. How to find out all the users who got SU01 ?
A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
How to find out all roles with T-code SU01?
Q. How to find out all roles with T-code SU01?
A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.
You can also get this information directly from table, if you have access to SE16 or SE16N. Execute SE16N
Table AGR_1251
Object S_TCODE
VALUE (low) SU01
What is user buffer?
Q. What is user buffer?
A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
A user would fail an authorization check if:
* The authorization object does not exist in the user buffer.
* The values checked by the application are not assigned to the authorization object in the user buffer.
* The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.
What is difference between role and profile.
Q. What is difference between role and profile.
A. A role act as container that collect transaction and generates the associated profile. The profile generator (PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should be done using PFCG.
How to reset SAP* password from oracle database.
Q. How to reset SAP* password from oracle database.
A. Logon to your database with orasid as user id and run this sqldelete from sapSID.usr02
where bname='SAP*' and mandt='XXX';commit;
Where mandt is the client.
Now you can login to the client using sap* and password pass
Can you add a composite role to another composite role?
Q. Can you add a composite role to another composite role?
A. No
How many profiles can be assigned to any user master record.
Q. How many profiles can be assigned to any user master record.
A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This table contains both information on the change status of a user and also the list of the profile names that were assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since the first two characters are intended for the change flag, 3748 characters remain for the list of the profile names per user. Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312 profiles per user.
Can we convert Authorization field to Org, field
Q. Can we convert Authorization field to Org, field
A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATEUse SE38 or SA38 to run the above report.
* Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be postprocessed in roles.
* The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level field.
In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field which is now to become the organizational level field are removed and entered into the organizational level data of the role.
Note: Table for Org Element- USORGRefer to Note 323817 for more detail.
What is a composite role?
Q What is a composite role?
A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.
What is a derived role?
Q What is a derived role?
A. Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.
List R/3 User Types
Q List R/3 User Types
1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
2. A Service user - Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
3. System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.
What authorization are required to create and maintain user master records?
Q What authorization are required to create and maintain user master records?
A. The following authorization objects are required to create and maintain user master records:
S_USER_GRP: User Master Maintenance: Assign user groups
S_USER_PRO: User Master Maintenance: Assign authorization profile
S_USER_AUT: User Master Maintenance: Create and maintain authorizations
What is the difference between USOBX_C and USOBT_C?
Q What is the difference between USOBX_C and USOBT_C?
A. The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.
How to create users?
Q How to create users?
A. Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional.
Click here for turotial on creating sap user id
SAP Security T-codes
Q. SAP Security T-codes
A. Frequently used security T-codes
SU01 Create/ Change User SU01 Create/ Change User PFCG Maintain RolesSU10 Mass ChangesSU01D Display UserSUIM ReportsST01 TraceSU53 Authorization analysis.
Click here for all Security T-codes
Monday, January 21, 2008
Why do you get "GetProcessList failed: 80004005" error while starting SAP console management
A. You have selected one of the Process List nodes in the tree. Then you closed MMC and clicked "Yes" in the dialog "Save console settings to SAPMMC?". Now when you open again the MMC and those processes are not started, you get this error. Solution: Start MMC and select SAP Systems in the tree. Then close it and choose "Yes" in the dialog "Save console settings to SAPMMC?". Now you won't get this annoying error on every start. SAP Security Interview Questions
User cannot print
A. See if the user has proper authoriztion. check SAP user setup, check SPAD, check spools, check unix queue or print queue at the os level, etc
User cannot connect to SAP
A. Check SAP logon settings, ping the host, check message server, check dispatcher, etc
Can I use special characters in my lock argument (especially the ‘at’ sign (@))?
A. The ‘at’ symbol is used as a wildcard in SAP locks (enqueues). In other words, it can stand for any other character during collision checks. For example, the parameter value 12345@ locks the quantities 123450 to 123459, 12345a to 12345z, and 12345A to 12345Z, and all other values with any special character in the 6th character position. This is described in detail in the section Lock Collisions.In order to prevent the wildcard mechanism from being activated in SAP locks when it is not required, you need to ensure when enqueue function modules are called that key value parameters do not contain any wildcard characters. If key values that you want to use to lock individual entities do contain wildcard characters, you have to replace the wildcards with different characters before the enqueue is called.
Is a lock table built if an enqueue work process is not started on the enqueue server in the instance profile?
A. Yes, because the work processes on the enqueue server use the lock table directly, and not via the enqueue process. The latter is only responsible for lock requests from external application servers.
The following message is displayed in the diagnosis details in SM12:Lock management operation mode Internal lock management in same process What does
Q. The following message is displayed in the diagnosis details in SM12:Lock management operation mode Internal lock management in same process What does this message mean and what are the other options?
A. "Internal lock management in same work process" in the diagnosis function means that you are logged onto the enqueue server and your work process can access the lock table straight away. You do not have to delegate enqueue requests to an enqueue process on a remote enqueue server. If you are logged onto an application server that is not an enqueue server, the diagnosis function will provide you with the name of the enqueue server. Each SAP System has exactly one application server that functions as an enqueue server. This enqueue server maintains the lock table, which is located in a shared memory segment. All of the work processes on the enqueue server can access the lock table. All work processes on other application servers delegate their enqueue requests to a special enqueue work process on the enqueue server. This procedure is configured automatically. The parameter line "rdisp/enqname =" in the default profile DEFAULT.PFL indicates which application server is currently acting as the enqueue server. When an application server detects that its name matches the name of the enqueue server, it creates the lock table and all of its work processes process enqueue requests inline. If an application server detects that its name does not match the name of the enqueue server, it sends all enqueue requests to the enqueue server. Work processes of the type "enqueue" guarantee that incoming requests are processed immediately. One enqueue process is usually sufficient. In very large SAP Systems with many application servers, a second process can be beneficial. However, it is not expedient to define more than two enqueue processes. If the transaction SM50 -> [CPU] shows that only the first enqueue process is being used, the bottleneck is due to something else.
What should I do first if a problem arises?
A. Use the diagnosis functions:sm12 Extras ® Diagnosis and thensm12 Extras ® Diagnosis in updateIf a problem is reported, back up the trace files dev_w*, dev_disp, dev_eq* and check the Syslog.
How fast are lock operations?
A. In work processes on the enqueue server, a few 100 microseconds. In work processes of external application servers you have to include network communications and process changes. Depending on CPU and network load this amounts to a few milliseconds.
Can locks exist directly after startup?
A. Yes, the saved locks, which were inherited by the update task, are reloaded to the lock table during startup (see first question).
Where is the lock table stored?
A. In the main memory (shared memory) of the enqueue server. All work processes on the enqueue server has access to the table. External application servers execute their lock operations in the enqueue process on the enqueue server. Communication in this case takes place via the relevant dispatchers and the message server.
The enqueue server is a single-point-of-failure in the SAP System. Can I guarantee high availability for the Enqueue Server?
A. To guarantee this you must use the standalone Enqueue Server with the Replication Server. This is described in the documentation Standalone Enqueue Server.
SAP note 524816 contains the prerequisites that must be fulfilled for using the standalone Enqueue Servers with the Replication Server.
What happens to locks when the enqueue server is restarted?
A. If they have not been saved to disk in the backup file, they will be lost. The locks that are inherited by the update task when COMMIT WORK is executed after CALL FUNCTION .. IN UPDATE TASK are saved to the disk. The locks are saved to disk when the update request becomes valid, that is, with the COMMIT WORK. Each time the enqueue server is restarted, the lock entries saved on the disk are reloaded to the lock table. A lock is saved to disk at the point at which the backup flag is set.
How do you display all active users in your system?
A. To display the overview of all active users on the instance where you are logged on, use transaction SM04. For a user overview of the whole system, call transaction AL08.
How do you display the server name?
A. To display the server name, use transaction SM51. Information about the process types is also displayed. For further information, select one of the instances and choose Processes. Alternatively, to display the system processes, use transaction SM66.
How do you check the work process from UNIX?
A. Use the following commands.
- To check all the work processes: ps -ef grep grep dw
- To check the message server: ps -ef grep grep ms
- To check the SAP OS collector: ps -ef grep sapos
Sunday, January 20, 2008
How do you display the server name?
A. To display the server name, use transaction SM51. Information about the process types is also displayed. For further information, select one of the instances and choose Processes. Alternatively, to display the system processes, use transaction SM66.
How do you check the work process from UNIX?
- To check all the work processes : ps -ef grep grep dw
- To check the message server : ps -ef grep grep ms
- To check the SAP OS collector : ps -ef grep sapos
What are the step involved before stopping R/3 system
A) Before stopping any R/3 system following steps are basic steps to be
performed.
- Before the R/3 System is stopped, the R/3 System administrator should check the:
- Check if any background jobs from any application server are active or have been triggered externally. Use transaction SM37
- Check if the background work process BTC is running in any application server.
- Check if any update records are open when the system is stopped, the records are rolled back and set to status init. At startup, the records are processed again.
- The administrator must decide whether to interrupt the jobs or wait until they are finished.
- Give system users advance warning of the system shutdown. To create a system message, you can use transaction SM02.
- Before shutting down the system, use transaction SM04 to check whether users are still logged on, and ask them to log off.
- The R/3 System administrator and administrators of external systems should also inform one another about data transfers between their respective systems.
In what sequence are profile parameter read?
A. R/3 processes read the appropriate parameters from a C source in the R/3
kernel
- The default profile /usr/sap//SYS/profile/DEFAULT.PFL is read; profile values already defined in the C source are replaced with the values in the default profile
- The instance profile /usr/sap//SYS/profile/__ is read; profile values already defined in the default profile or in the C source are replaced with the values defined in the instance profile
- This procedure ensures that system parameter values reflect the instance profile and the values in the default profile and the C source.
How do you start SAP R/3?
A. To start R/3, run the shell script startsap from the home directory of user adm. startsap starts the saposcol process, which is the statistics collector for operating system resource data, if it is not yet running.
- startsap calls the script startdb, which starts the database if it is not already started.
- startsap then starts the central instance. The R/3 System administrator can start additional instances and application servers.
To start the instances independently of the database, use the script startsap. startsap has the following options:
- startsap r3: Checks if the database is running; if it is, only the instance is started
- startsap db: Starts only the database
- startsap all: Default entry; starts both the database and the R/3 instance
What are the different type of work process ?
A. The following work process in SAP R/3
- Dialog (D): each dispatcher needs at least 2 dialog work processes (not shown
above) - Spool (S): at least 1 per R/3 System (more than 1 per dispatcher allowed)
- Update (V): at least 1 per R/3 System (more than 1 per dispatcher allowed)
- Background (B): at least 2 per R/3 System (more than 1 per dispatcher allowed)
- Enqueue (E): exactly 1 per R/3 System (only 1 E work process is required and
allowed)
What is client 000 in SAP R/3?
A. Client 000 is defined as the SAP standard and the customer cannot change it. This client serves as a copy template for the creation of further clients.
Subscribe to:
Posts (Atom)
