Analyze user buffer SU56
Grant permission for external services from SAP CRM
When programming your permission check, always check the SY-SUBRC return code and define what should happen in the event of a non-successful permission check, i.e. if SY-SUBRC is not equal to 0. In most cases, an error message occurs and the programme is cancelled.
If you only want to translate the description of the role, it is recommended to record the PFCG transaction and to change the source language of the role using the Z_ROLE_SET_MASTERLANG report before the LSMW script runs through. The report on how to change the source language can be found in SAP Note 854311. Similarly, you can use the SECATT (Extended Computer Aided Test Tool, eCATT) transaction to perform the translation instead of the LSMW transaction.
Create order through role-based permissions
You probably know this. You find a specific customising table and you don't find it. Include the tables in the guide and they are easy to find. Customising is used by almost every SAP customer. Custom customising tables are created and standard programmes are extended. A custom programme that uses customising is written quickly. Project printing often lacks the time for sufficient documentation, for example in the SAP Solution Manager. The easiest way is to find customising tables where they are in the SAP standard: in the SAP Introductory Guide (IMG).
For this very reason, there is a solution to automate the checking of authorizations with regard to critical authorizations and segregation of duties by means of tool support. This gives the authorization administrators more time to correct any errors that occur instead of having to search for them first.
If you get into the situation that authorizations are required that were not considered in the role concept, "Shortcut for SAP systems" allows you to assign the complete authorization for the respective authorization object.
You can also find some useful tips from practice on the subject of SAP authorizations on the page www.sap-corner.de.
As already mentioned, it is assumed that no production-related data is kept in the development system, so the data listed below is considered to be the most sensitive.
Authorization-relevant check patterns for such a scan are, for example, "AUTHORITY-CHECK" or SQL statements such as SELECT, UPDATE or DELETE.