Authorizations in SAP Software: Design and Configuration

Volker Lehnert has worked at SAP for eight years. He has worked for SAP (Switzerland) AG since 2008, where he is a consultant on all topics concerning the authorization system, and continuously returns the authorization system to its core questions: business functions, organizational concepts, and legal requirements. Within this scope, his consulting work focuses on authorization concepts, SAP BusinessObjects Access Control, and the processes of User Life Cycle Management. Furthermore, Volker Lehnert is co-author of the data privacy guideline of the German-speaking SAP User Group (DSAG). Katharina Bonitz has worked as a technology consultant at SAP Deutschland AG since 2006, where her work focuses on the authorization concepts in the CRM environment. She works in national and international projects and regularly holds authorization workshops. She received a degree in engineeringfrom Leipzig University of Applied Sciences, Germany. Katharina Bonitz is the author of Chapter 13, User Management Engine, Chapter 15, Authorizationsin SAP CRM, and Chapter 16, Authorizations in SAP SRM.

Introduction
PART I Business Concepts
Introduction and Concept Definition
Methodical Considerations
Compliance
Risk
Corporate Governance
Technical Versus Business Significance of the Authorization Concept
Technical Versus Business Roles
Organization and Authorizations
Example of an Organizational Differentiation
Introduction
Institutional Organization Concept
Instrumental Organization Concept
Consequences of the Examination of the Organization
Views of the Organizational Structure in SAP Systems
Organizational Levels and Structures in SAP ERP
Information on the Methodology in the Project
Summary
Legal Framework
Standardization Framework
Basic Principles of Internal and External Regulations
Internal Control System
Sources of Law for External Accounting
Data Privacy Laws
General Requirements for Authorization Concepts
Summary
Authorizations in the Process View
Process Overview
The Sales Process
The Procurement Process
Support Processes
Requirements of the Separation of Duties
Summary
PART II Tools and Authorization Maintenance in the SAP System
Basic Technical Principles of Authorization Maintenance
User/Authorization
Transaction Program Authorization Object
Role and Role Profiles
Analysis of Authorization Checks
Additional Role Types in SAP ERP
Summary
System Settings and Customizing
Maintaining and Using the Defaults for the Profile Generator
Upgrading Authorizations
Parameters for Password Rules
Customizing Settings for the Menu Concept
Authorization Groups
Parameter and Query Transactions
Promoting an Authorization Field to an Organizational Level
Developer and Authorization Trace
Creating Authorization Fields and Objects
Further Transactions of the Authorization Administration
Transferring Roles Between Systems or Clients
User Master Comparison
Role Assignment via Organizational Management
Basic Concept of SAP ERP HCM Organizational Management
Technical Prerequisites
Technical Implementation
Conceptual Special Feature
Summary
Automated Organizational Differentiation: The Role Generator
Challenge and Solution Approach
Implementation Example for the Area Role Concept
Integration, Restrictions, and Prospects
Summary
Central Administration of Users and Management of Authorizations
Basic Principles
Central User Administration
SAP BusinessObjects Access Control Compliant User Provisioning
SAP NetWeaver Identity Management
Summary
Authorizations: Standards and Analysis
Standards and Their Analysis
Critical Transactions and Objects
General Evaluations of Technical Standards
Summary
SAP BusinessObjects Access Control
Basic Principles
Risk Analysis and Remediation
Enterprise Role Management
Compliant User Provisioning
Superuser Privilege Management
Risk Terminator
Summary
User Management Engine
Overview of the UME
Authorization Concept of SAP NetWeaver AS Java
User and Role Administration Using the UME
Summary
PART III Authorization in Specific SAP Solutions
Authorizations in SAP ERP HCM
Basic Principles
Special Requirements of SAP ERP HCM
Authorizations and Roles
Authorization Main Switch
Organizational Management and Indirect Role Assignment
Structural Authorizations
Context-Sensitive Authorizations
Summary
Authorizations in SAP CRM
Basic Principles
Dependencies Between Business Role and PFCG Roles
Creating PFCG Roles Depending on the Business Roles
Assigning Business Roles and PFCG Roles
Sample Scenarios for Authorizations in SAP CRM
Troubleshooting in the CRM Web Client
Access Control Engine
Summary
Authorizations in SAP SRM
Basic Principles
Authorization Assignment in SAP SRM
Summary
Authorizations in SAP NetWeaver BW
OLTP Authorizations
Analysis Authorizations
Modeling Authorizations in SAP NetWeaver BW
Summary
Processes in SAP ERP
Specific Authorizations
Basic Principles
Authorizations in Financial Accounting
Authorizations in Controlling
Authorizations in Logistics (General)
Authorizations in Purchasing
Authorizations in Sales and Distribution
Authorizations in Technical Processes
Summary
Project Concepts and Approaches
Authorization Concept in the Project Context
Procedure Model
SAP Best Practices Template Role Concept
Content of an Authorization Concept
Summary
Appendices
List of Abbreviations
Glossary
Bibliography
The Authors
Index