This practical guide offers you a detailed introduction to all the essential aspects of SAP Authorization management, as well as the necessary organizational and technical structures and tools. Take advantage of a proven Phase Model to help you navigate through all of the stages leading up to the implementation and deployment of an authorization concept, from the procedural steps required to design the concept, to the production phase, and lastly, to the supervision phase. In addition, you'll quickly learn how to set up authorization via the SAP R/3 Profile Generator.

This book provides in-depth coverage of the special security requirements of the SAP Enterprise Portal as well as the SAP R/3 standards and infrastructure, which serve as a framework to develop and support SAP Authorization concepts.

Highlights

• Special features of the SAP Authorization System
• Fundamental principles of the SAP Authorization concept
• Internal Control System (ICS)
• Best practices for the design phase
• Best practices for the production phase
• Testing of Authorization concepts
• Audit Information System (AIS)
• SAP Enterprise Portal: components, access control and administration, integration, and more!

About the Author(s)

This book was written by a team of highly experienced SAP consultants from IBM Business Consulting Services GmbH. The authors have honed their expertise with many years of experience with SAP technology, especially with regard to the implementation of SAP Authorization concepts.

Table of Contents

Foreword 11

1. Introduction 13

1.1 Regarding the book 13
1.2 SAP R/3-Environment 17
1.3 Complex System Landscapes 27
1.4 Summary 30

2. SAP R/3-Users and Authorization 31

2.1 Introductory remark: Security within the SAP R/3-System 31
2.2 SAP R/3-Users 34
2.3 The SAP R/3-Authorization Concept 45
2.4 System Presetting 64
2.5 Authorization Checks in SAP-Applications 70
2.6 Protection of tables 78
2.7 Protection of reports 81
2.8 Basic Security 83
2.9 HR-Security 89
2.10 Innovations to Release 4.6 99
2.11 Central User Management and Global User Manager 102
2.12 History of SAP-Technologies within the Authorization Environment 104
2.12.1 Background 104
2.13 Summary 107
2.14 Important SAP-Points within the Authorization Environment 111

3. Imbedding in the internal control system 113

3.1 Necessity of an internal control system 114
3.2 Transferal to the control environment 123
3.3 Identification of the conversion 130
3.4 Monitoring and checking the IKS 134

4. Procedure Model for the Design of an Authorization Concept 137

4.1 The IBM-Phase Model 137
4.2 Parties involved 149
4.3 Fundamental Aspects in Detail 154
4.4 Definition of the areas of work 172

5. Procedure model for the realization of an Authorization Concept 179

5.1 Overview 179
5.2 Realization 180
5.3 Test of implemented roles 196
5.4 Setting up of User Master Record 206
5.5 Productive Start 207
5.6 Running Operation 208
5.7 Emergency Concept 214
5.8 Technical Details 216

6. Test of SAP R/3-Authorization Concepts 219

6.1 User Information 220
6.2 Audit Information System 223
6.3 Direct Table Access 239
6.4 Supplementary Test Data Fields 240
6.5 Further Testing Tools 241

7. SAP Enterprise Portal 247

7.1 General Aspects 247
7.2 Components of the Portals 249
7.3 Interaction Portal and SAP R/3 251
7.4 Access Control and Management 254
7.5 Further Security Measures 267

8. Future Developments and Courses 275

8.1 Introductory Remark 275
8.2 Further Subjects Covered 282
8.3 Outlook 284

Appendix

A Authorization Objects 285
B SAP-References 291
C Bibliography 295

Index 299