Live SAP Security Training Classes by SAP Experts| Acutesoft
India:+91 (0)8885575549, 040-42627705 | USA: +1 973-619-0109 | UK: +44 207-993-2319 Santosh@acutesoft.com
Select Page

SAP SECURITIES

SAP SECURITY ONLINE TRAINING

SAP SECURITY ONLINE TRAINING IN INDIA, USA & UK

SAP SECURITY ONLINE TRAINING IN CANADA

SAP SECURITY ONLINE TRAINING IN AUSTRALIA

SAP SECURITY ONLINE TRAINING

SAP SECUITY COURSE CURRICULUM

Download [PDF]

  • Overview of the GRC
      Introduction to ERP
      Security Introduction
      SAP Project Lifecycle
      Default user-id’s and clients
      User types
      Creating user-id’s
      Overview of SAP Security (Roles and Profiles)
      Authorization concepts, transactions, authorization objects
      Introduction to Profile Generator
      Introduction to Composite and derived roles
      Practical exercise building roles, composite and derived
      Adding Missing Authorisation Objects
      System Trace and SU53
      Inactivating Authorisation objects
      Creating and assigning users to roles
      use of PFCG_TIME_DEPENDENCY
      use of User Groups in Security
      How SU25,SU24 and PFCG are linked
      Use of se16 and S_TABU_DIS
      Use of SM30 and SM31
      Continue review of Useful tables for security
      Use of Compare
      Use of SUIM reports
      System security settings SCC4,SCC1,SE03,SE06
      Use of SE11,SE54,and security table groups
      use of SUPC
      Audit requirements
      USMM Report
      License_admin tool
      User classification
      Transporting roles
      Use of SAP_ALL and SAP_NEW
      How to delete Roles
      Use of SAP* and DDIC
      USR*,AGR*,USH* Tables
      Evaluation Reports RSUSR002,RSUSR040,RSUSR003
  • Overview of the SAP-HR SECURITY
      Overview of SAP-HR Security
      Pre-requisites to implement HR Security
      Indirect assignment of standard HR Roles to Organizational Objects
      Creating structural profiles and assigning to users
      Executing report in SA38 for comparing users in structural
  • profiles Overview SAP-BI SECURITY
      Overview of Analysis Authorisations
      Difference between OLTP and OLAP
      Overview of info objects, info cubes and hierarchies
      Administrative workbench Authorisations
      Report level Authorisations at infoobject,infocube and Info provider level
  • Overview of the GRC
      Overview of SOX
      Overview of SOD
      Introduction to GRC AC 5.3
      Introduction of different components in GRC AC
      Risk Analysis Remediation process in GRC AC
      Compliant User Provisioning (CUP)
      Enterprise Role Management (ERM)
      Super User Privilege Management(SPM)
      Background Jobs for GRC 5.3

SAP SECURITY INTRODUCTION

  • The term ‘Basis’ when used in the context of SAP technology refers to the application layer of the SAP system. When you think about the role a ‘Basis Adminstrator’ has, it should include system administration tasks such as managing the database, transporting development and configuration objects from one SAP system to another, monitoring system performance to ensure no interruption in system stability occurs in the SAP production environment, installing and upgrading the software on the servers, and system security.
  • Security refers to both application security in the SAP Runtime environment and the system access outside the SAP Runtime environment. The user accounts defined for users in the SAP Runtime environment are secured by roles that grant authorizations to them. SAP Authorizations control access to transactions (Business Process Activities), or what can be performed within a specific business process step. For example, a user may be able to create sales orders, but only for their specific sales area, sales office and customer.
  • The SAP authorization concept is based upon the logical relationship between a user ID and the range of system authorizations with which it can be associated.The architecture of the authorization system is based upon the utilization of several individuals but related logical components: Profiles, Objects, Fields, and Authorizations. The user ID refers exclusively to profiles. Each profile grants a set of specific system access authorizations to user.

Composite Profiles

  • Composite profiles refer to the various employee roles available in the corporation (for instance: Purchasing / Receiving Clerk or Accounts Agent). As the name suggests, composite profiles may contain multiple user IDs necessary to perform all the business operations associated with a particular role. A composite profile may encapsulate another composite profile(s). In practice, a model composite profile should be recognized for each possible role in the organization, which may be used to produce hybrid composite profiles.
  • The over existence of the hybrids can defy the very purpose of composite profiles and they should be created only when specific needs arise.

User Ids

  • User ids allow access to SAP applications. Each user must have a corresponding profile specifically assigned. In many situations, multiple composite profiles can be assigned to a user ID, depending on the role(s) an individual user is responsible for, in the business processes.

Authorizations

  • Authorizations are the key building blocks of SAP security. Authorization is the process of assigning values to fields present in authorization objects. In SAP, access to all system functionality is achieved through a complex array of authorizations. Sometimes users find that they lack the necessary authorizations to perform a certain function in the system, in which case the message: “You are not authorized…” is displayed at the bottom of the screen. An authorization process may ask for second associated authorization process which in turn asks for third and so on. For example, the task of paying a vendor invoice may require 10 different authorizations.

Security Configuration in SAP

  • Security configuration and administration in SAP is a multi-phase process. Four key security components are required to ensure the adequate security, privacy, and integrity of information. The phases are as follows:

User Authentication

  • The first phase comprises confirmation of user identity and results in authentication of user. Unauthorized access to SAP system is prevented through this initial check. This ensures system integrity by regulating secure access through genuine user authentication.

Creating and Assigning Authorization Profiles

  • A Profile Generator (PG) is used to automatically generate and assign authorization profiles. This tool was released with SAP version 3.1g and above. The administrator can also create authorization profiles manually.

Auditing and Monitoring

  • In this subsequent phase, a track of the authorizations created (previous phase) is kept. Detailed accounts of system events are used to record the actions of a user corresponding to that unique user account identifier. Auditing/Monitoring activities should be in compliance with enterprise�s overall IT strategy and should be performed on a weekly, monthly, quarterly, and yearly basis.

Using System Logs and Security Audit Logs

  • The system log records critical information important events. Each individual application server maintains local log files to which the information is written periodically. The security audit log records areas such as successful and unsuccessful dialog log-on attempts, RFC log-on attempts, changes to user master records, and transaction starts.

Monitoring Change Requests

  • All change requests need to be properly reviewed and controlled prior to being applied. This formal process needs to be detailed enough to ensure that separation of duties and other control features are not breached. Strong integration knowledge of the SAP system is required for this review. Critical profiles, authorizations, and transactions need to be identified and treated even more carefully.

DEMO VIDEOS:

UPCOMING DEMOS:

For updated Schedules please contact
calls

SAP SECURITY INTERVIEW QUESTIONS

  • How many fields can be present in one Authorization object?
      10 fields.
  • Which T-Codes are used to see overview of the Authorization Object and Profile details?
      SU03 – overview of any authorization Object
      SU02 – to see the details of profiles.
      SU21 also provides the same editing structure as SU03 but we can create a new authorization object using
      SU21. Here, we need to click on “Display Object Documentation” button to see the documentation for the authorization Object and we need t>o click on “Permitted activity values” to see the list of permitted activities for the fields.
      These details are fetched from table TACT.
  • How to restrict the user access to one particular table in display mode ?
      If the system is BASIS 700, we can use the authorization object S_TABU_NAM. In this auth. Object, we can maintain the values for required activity and the table name. If the system version is lower than 700, and the table is z* table then Create a new authorization Group using SE54.
      Assign the table in question to the newly created authorization Group in table TDDAT using SM30.
      If the table is SAP standard table then we can restrict user access by creating new tcode in SE93.
  • How to check the table Logs ?
      we need to check if the logging is activated for table using tcode SE13. If table logging is enabled then we can see the table logs in t-code SCU3.
  • What’s the basic difference in between SU22 & SU24 ?
      SU22 displays and updates the values in tables USOBT and USOBX, while SU24 does the same in tables USOBT_C and USOBX_C. The _C stands for Customer. The profile generator gets its data from the _C tables. In the USOBT and USOBX tables the values are the SAP standard values as shown in SU24. With SU25 one can (initially) transfer the USOBT values to the USOBT_C table.
  • What is the difference between USOBX_C and USOBT_C ?
      The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority- check command programmed). This table also determines which authorization checks are maintained in the Profile Generator. The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.
  • What does user compare do ?
      If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report PFCG_TIME_DEPENDENCY on a daily or by executing the t-code PFUD.
  • Can we convert Authorization field to Organizational field ?
      Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATE. Use SE38 or SA38 to run the above report.

    Organizational level fields should only be created before you start setting up your system. If you create

      organizational level fields later, you might have to do an impact analysis. The authentication data may have to be post processed in roles.
      The fields “Activity”, “ACTVT” and “Transaction code”, “TCD” cannot be converted into an organizational level field.
      In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field which is now to become the organizational level field are removed and entered into the organizational level data of the role.
  • What is user buffer ?
      When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
      A user would fail an authorization check if:
      The authorization object does not exist in the user buffer The values checked by the application are not assigned to the authorization object in the user buffer The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.
  • How to create users?
      Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional. Click here for turotial on creating sap user id
  • What is the difference between USOBX_C and USOBT_C?
      The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator. The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.
  • What authorization are required to create and maintain user master records?
      The following authorization objects are required to create and maintain user master records:
      S_USER_GRP: User Master Maintenance: Assign user groups
      S_USER_PRO: User Master Maintenance: Assign authorization profile
      S_USER_AUT: User Master Maintenance: Create and maintain authorizations
  • List R/3 User Types
      Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
      A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
      System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
      A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.
  • What is a derived role?
      Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
      The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
      Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.
  • What is a composite role?
      A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
      Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
      Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
      The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.
  • What does user compare do?
      If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a daily.
  • Can we convert Authorization field to Org, field
      Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or ZPFCG_ORGFIELD_CREATE Use SE38 or SA38 to run the above report.
      Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be post processed in roles.
      The fields “Activity”, “ACTVT” and “Transaction code”, “TCD” cannot be converted into an organizational level field.
      In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization field which is now to become the organizational level field are removed and entered into the organizational level data of the role.
  • How many profiles can be assigned to any user master record.
      Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This table contains both information on the change status of a user and also the list of the profile names that were assigned to the user. The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since the first two characters are intended for the change flag, 3748 characters remain for the list of the profile names per user. Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312 profiles per user.
  • How to reset SAP* password from oracle database.
      Logon to your database with orasid as user id and run this sql delete from sapSID.usr02 where bname=’SAP*’ and mandt=’XXX’; commit;
  • What is difference between role and profile.
      A role act as container that collect transaction and generates the associated profile. The profile generator (PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should be done using PFCG.
  • What is user buffer?
      When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user. Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.
      A user would fail an authorization check if:
      The authorization object does not exist in the user buffer
      The values checked by the application are not assigned to the authorization object in the user buffer
      The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.
  • How to find out all the users who got SU01 ?
      You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
      Go to the Selection by Authorization Value.
      In Object 1 put S_TCODE and hit enter. And put SU01 in Transaction code and hit execute (clock with check) button.
  • How to find out all the roles for one composite role or a selection of composite roles?
      Execute SE16N
      Table AGR_AGRS
      Composite roles You can put multiple composite roles using the more button
  • How to find out all the derived roles for one or more Master (Parent) roles?
      Execute SE16N
      Table AGR_DEFINE
      Use either agr_name field or Parent_agr field.
  • How do I restrict access to files through AL11?
      A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization for S_DATASET as mentioned below
      Activity 33
      Physical file name /tmp/*
      Program Name with Search Help *
  • How can I add one role to many users?
      SU10. If you have less than 16 users then you can paste the userids.
      If you have more than 16 users – Click on Authorization data and click on next to users and upload from clipboard .
      Hit the change button and go to the role tab and add the roles to be assigned and hit save.
  • What are the Best practices for locking expired users?
      Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.
  • How can be the password rules enforced ?
      Password rules can be enforced using profile parameter. Follow the link to learn more about the profile parameter.
  • How to remove duplicate roles with different start and end date from user master?
      You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 365841 for more info.
  • How come the users have authorization in PFCG, but user still complains with no authorization?
      Make sure the user master is compared. May be the there is a user buffer overflow Also check the
      profile- Follow the instruction below.
      SUIM > User by complex criteria.
      Put the userid of user who is having issue.
      Execute
      Double click on the user id and expand the tree. Select the profile in question and see if the authorization is correct or not. If not do the role reorg in PFCG and see if that helps.