Authorization for testing, SAP security note 591395

SAP security note 591395, "Authorization for Testing". Below are the symptom and SAP recommended solution.

Description

Symptom

Existing authorizations in roles and profiles that contain the discreet activity '03' ("Display") no longer authorize users to execute development objects. However, if a full authorization ('*') for the activity is contained in authorizations for the S_DEVELOP authorization object, the behavior does not change because the full authorization also includes the new activity '16' ("Execute").

Activity '16' ("Execute") is already defined for the S_DEVELOP authorization object in all releases as of Release 4.0B. Therefore, you do not need to adjust the authorization object.

Solution

The existing display authorization is no longer sufficient to execute (test) development objects. To resolve this, adjust the existing roles and profiles by assigning an additional execution authorization where necessary.

a. Adjusting existing single profiles

• Start transaction SUIM and select Profiles > Profiles by Complex Selection Criteria. Select the "Active version" and "Maint. version" checkboxes and the "Single prof." checkbox. Under "Selection by values – Authorization object 1", enter S_DEVELOP and select "Entry values". Enter * (with quotation marks) under "Activity" and the object type (e.g., FUGR) without quotation marks under "Object type". Profiles with full authorization do not need changes.
• Start a new session of SUIM and select Profiles > Profiles by Complex Selection Criteria. Enter the profiles from the first step to exclude and * to include other profiles. Under "Selection by values – Authorization object 1", enter S_DEVELOP and select "Entry values". Enter 03 under "Activity" and the object type under "Object type". Modify these profiles by assigning the '16' execute authorization as needed.

b. Adjusting existing roles

• Start transaction SUIM and select Roles > Roles by Complex Selection Criteria. Under "Selection according to authorization values – Authorization object 1", enter S_DEVELOP and select "Entry values". Enter * (with quotation marks) under "Activity" and the object type without quotation marks under "Object type". These roles do not need changes.
• Start a new session of SUIM and select Roles > Roles by Complex Selection Criteria. Enter the roles from the first step to exclude and * to include other roles. Under "Selection according to authorization values – Authorization object 1", enter S_DEVELOP and select "Entry values". Enter 03 under "Activity" and the object type under "Object type". Modify these roles by assigning the '16' execute authorization as needed.

If a role or profile contains a '02' change authorization in addition to a '03' display authorization, it is recommended to also assign a '16' execute authorization. Use transaction SUIM to determine combinations of display and change authorizations for the S_DEVELOP authorization object. Note that the S_DEVELOP authorization object with activity '03' only (Display) does not exclude debugging.

Reason and prerequisites

Valid as of Basis Release 6.40.