Role maintenance.

Open the Edit menu and choose Create restore point to start the creation of a restore point.

To remove the restore point : open the Edit menu and choose Clear restore point to clear the restore point.

To rollback changes to the restore point : open the Edit menu and choose Rollback from the menu, to return to situation as it existed on the moment of creation of the restore point.

Once a restore point is created for a role, the restore point icon appears next to its name (the same icon next to the Create restore point menu item). The icon tooltip shows the restore point creation date.

Compare authorizations

The left pane of the form shows the derived roles and their authorizations, the right pane show the master role with its authorizations.

Composite role. (top)

Attributes. (top)

Name:
The name of the role must be unique.
The role naming is important to derive master roles automatically based on domains and codification (see more)

Short description:
A short description regarding the role.

Description:
A more elaborate description of the role.

Parent role:
The master role from which the role is derived.

Note:
The parent role will be empty for master roles.

Reference role:
The reference role is used when deriving roles or updating (complete) authorizations.
The role will copy the authorizations of the reference role and apply the codification to it.
(instead of copying from the parent role and applying the codification).

Template role:

The template role provides the role with authorizations for derived roles that have divided cells.

Logical system:
The logical system the role belongs to.
(When using naming convention this can be placed in sync with the role name.(see more))

Module:
The module (SAP) the role belongs to.
(When using naming convention this can be placed in sync with the role name.(see more))

Sub module:
The sub module the role belongs to.

Department:
(only for composite) The department of the role.

Sub department:
(only for composite) The sub department of the role.

Profile name:
The profile name for this role.

Sox classification:
drop down list from which the sox classification for this role can be selected.

Composite role:

Indicate if a role is single or composite

Non derivable:
Activating this checkbox will prevent you to add domains to the master role and therefore will prevent the role from being derived.

Filter for NWBC:

Filter role for NetWeaver Business Client.

This option can be mass edited.

The type of role radio buttons:

Display
Update

The data type radio buttons:

Not defined
Master data
Transactional data
Customizing data
System administration data

Related data. (top)

What

single

composite

Transactions

The inactive (Locked) checkbox indicates a transaction is locked in SAP.
This information is captured in the master data.

The No authorization restrictions checkbox can be used to indicate that there are no authorization restrictions.

The Executed checkbox is available after updating STAD information based on imported periods.

Tip:
It is not required that the transaction code exists in the concept.
Information about the transaction (description/locked) will be loaded if found in the resources.

only editable in master role

Σ Transactions

Summary of all transactions from the single roles attached to this composite.

Authorizations

Authorizations are the restrictions set on authorization object field level.
These will eventually (after profile generation) restrict the user in actions inside the SAP system. (more information)

Domains

List of domains for which this role can be derived.

The Icon indicating the role has been derived for this domain - icon in front of the domain indicates the role is already derived for the domain.

A red exclamation mark ( ! ) in front of the domain indicates the domain has no indicator, so deriving roles for that domain will not work.

Note:
Right click the domains tab and click Load codification domains to automatically populate with all domains based on codification.
This can also be done for multiple roles at the same time. (here)

only editable in master role

Σ Domains

Summary of all domains from the single roles attached to this composite.

Derived roles

List of derived roles based on the roles parent role.

only in master role

Single roles

List of single roles attached to the composite role.

You can activate or deactivate single roles in the list.

Note:
The SoD engine will not take into account the deactivated single roles.

Composite roles

List of composite roles where to the single role belongs.

Users

List of users having this role.

You can choose to work with the validation period for the user assignment.

Note:
The SoD engine will not take into account inactive relations.

Tip:
It is not required that the user id exists inside the concept,
information (first name, last name) will be loaded if found.

Queries

List of queries related to the role.

Queries can be added manually but it is better to assign your queries based on a result set.

You can also perform this action for all roles in the role query overview.

Note:
Right click the queries tab and choose how to load the queries automatically.

Σ Queries

Summary of all queries from the single roles attached to this composite.

Σ Users

Summary of all users that have the single role either directly, or via a composite role.

Norm

In the norm tab you can set the norm for a query hit.

RC Queries

List of queries that is found in the result container for this query.

Processes

List of processes that are related to the role.

Complementary roles

List of complementary roles,
some role assignments require the user to have other roles (in different system) these complementary roles can be defined here.

Query view

With the query views you can display the queries related to the role on different crossings and compare them. (right with left)

e.a. in a composite role the Σ of RCD queries of the single roles and the RCD queries of the composite role, this will result in differences that show the accumulation of access rights.

SoD

You can do an SoD run for this particular role. All SoD conflicts flagged as use in role SoD run will be run.

Note:
A role can be split in a navigation role that has the t-codes, and an authorization role, that has the authorizations.
The t-codes role can show the menu with the t-codes, the authorizations role can hide the menu

Role maintenance.

Single role. (top)

Role restore point.

Compare authorizations

Composite role. (top)

Delete roles. (top)