System Guides
HYBRID LANDSCAPE SURVEILLANCE STRATEGY
Another major topic is the migration of SAP systems, both locally from one data center to another and from one operating system to another or from one database type to another. As a rule, the SWPM tool is used here again.
If you now want to change the permission data, you will be asked for values for the appropriate organisation levels. First enter a tilde (~) and define the value later in the derived roles. Maintain the permissions you want and then generate the master role. Adding the organisational level to the master role Step 2: Define derived roles Create derived roles Assign the master role After you have created the master role, it is the derived roles that are in the process. To do this, re-enter a suitable role name via the PFCG. In our example, it is called "findepartment_d01". For a better overview, it is usually useful to name and number the derivatives after the master roles. You can also define the roles according to a different scheme. After you have created the role, you must then enter the master role in the Derive from Role field in the Description tab. Confirm the Auto Enquiries. Customise the Organisation Levels Now go to the "Menu" tab. There you can see that the data from the master role was automatically copied. Since the role has not yet been generated, the Permissions tab is currently highlighted in red. Therefore, call "Change Permissions Data". The first call should automatically open a dialogue to maintain the organisational levels, as they are still empty. If this is not the case, or if you would like to adjust the organisational levels again in a later case, you can also access them via the button Ordende (see screenshot). If everything worked well, you can now see that the permissions were also automatically taken from the master role. If you generate the role, the permission tab will also appear green. Congratulations, you have successfully created a derived role! Repeat step 2 with the additional derivatives to adjust the organisation levels accordingly.
Aufbau der SAP Basis
An SAP HANA system lives on applications. When you develop these applications, you should think about securing them early. Using HTTPS instead of HTTP is one of the basics. In addition, you ensure secure authentication and implement a Secure Software Development Lifecycle to ensure backup in your own developments. In your applications, you better start to check them for risks early on and run this backup process regularly. You can analyse and restrict access to source code later. Create a risk register and address security vulnerabilities in a risk-based manner. The later you discover a risk, the more expensive the fix will be. Further information on SAP Security in addition to the article can be found here. Do you have any further questions or suggestions concerning this topic? Would you like us to go further on the subject? I look forward to your feedback!
To add additional permissions for defined groups in the launchpad to PFCG roles, follow the steps described above. This time, you only select a "SAP Fiori tile group" instead of a "SAP Fiori tile catalogue". There are very few differences between permissions. Fiori Eligibility for OData Services The launch authorisation for the OData service stored in the backend from a Fiori app is queried on both the front-end and back-end servers when the application is launched. Therefore, this permission must be added to the appropriate role on both servers. The typical sequence of clicking on a Fiori app in the launchpad triggers the following steps: 1) When selecting the tile, the app Fiori implementation is called 2) The app retrieves dynamic data from the HTTP endpoint of the OData service on the frontend server from 3) An RFC call to the gateway activation of the backend system is followed, retrieving the relevant business logic 4) Now the Fiori permission for the corresponding OData service is queried on the backend 5) If this was successful the appropriate business logic permissions are queried in the OData service. To add the Fiori permission to run a OData service for an app to a role, please perform the following steps: In the PFCG, open the appropriate role in Change mode, perform steps on the following screenshot: 1) Select Menu tab 2) Arrow next to the "Transaction" button click 3) Select Permissions proposal.
"Shortcut for SAP Systems" makes many tasks in the area of the SAP basis much easier.
The logging of data changes in tables using transports should also be active.
It is now possible to mark the assignment of the role as correct or incorrect.