HOW TO SAP

How to change SAP script - SE71

noreply@blogger.com (parcelhubkajang) — Tue, 16 Jul 2019 08:16:00 +0000

1. Firstly open SE71. Enter the Form name.

2. Click change

3. Click on Page window

4. You can now change the attributes.

5. Only those highlighted in blue on page window will

enable you to change the attributes

6. To select or highlight, just double click any entries on page window

7. Once you are satisfy with the new changes click on

8. Form > Activate

9. To change the SAP script, click on ‘text element’

10. Now go to > goto> change editor for a better view

11. Here you can perform your adap changes.

12. Once you click save, a transport number will be generated.

13. Remember the transport number as subsequent changes will be save

directly to the new transport request

14. Go to SCC1 to import to different client in the same ever

15. Go to STMS to import to different client in different server

16. To test your new program, go to SE93

STMS – Transport management system. How to do transport for Basis

noreply@blogger.com (parcelhubkajang) — Tue, 16 Jul 2019 08:15:00 +0000

Consultant & Abapers will request transport from client to client. Once request has been approved, Basis will transport the request using T-CODE STMS

1. On the command field, enter STMS. You will see the above screen. Now, click the red color truck on upper left of the screen.

2. Double click on the target system. In this case, I am going to transport from Development server to Production server. I’ll double click on PRD.

3. Press refresh once to update the transport list.

4. Click on the ‘transport request que (Ctrl-F6) if you see a green colored arrow. Press ok when a window popup.
5. Once completed, click on Import request button (Ctrl-F11)

6. Enter your target client. In my case, its client 800.

7. Click on option tab and untick leave transport request in queue for later import. See above picture. Now click ok.

8. Click ok to confirm when a new windows pop up.

9. Transport has been completed.

SAP Basis – Daily check list

noreply@blogger.com (parcelhubkajang) — Tue, 09 Jul 2019 08:13:00 +0000

SAP Logon Connection Test

1. Double click on all above instance to check if you are able to login.
2. If login sucessful, this means server is alive and has no connectivity issue. A new screen will pop up. See below

3. You shall see the above screen. Now you are ready to start your daily check list.

DB12/DB13 Create and Check backup status
1. On the command field, key in DB12 and below screen will be displayed. It shows the summary of the backup status.

2. On command field, enter /nDB13. This T-code is used to perform backup. You can also check the backup status.

3. In DB13, select a desired cell which you plan to perform your backup. Double click on the cell
4. Choose Full database backup to device
5. Backup mode: Offline
6. Device directory: ‘ d:\backup\ (this is just a folder which your backup could be stored)
7. Below is a sample picture.

DB02 Check Database size

1. Use DB02 to check DB size
2. Database current size (GB) is Total DB size – Free space

SM50 Check if instance is running on all servers1. All work process is either running or waiting and none are stopped except CPIC (interprocess communication)
2. Make sure not all dialog work process are used up, otherwise other user cannot make any transaction.

RZ20 Check filling degree of spool used numbers

1. Click on SAP CCMS Monitor Templates
2. Click on SPOOL System
3. System Wide > Spool > SpoolNumbers > UsedNumebrs
4. If value greater then 80% in spool numbers – will lead to system wait until spool reorganisation is done

SM13 Check if update is active

1. Enter SM13 and make sure UPDATE SYSTEM STATUS : Update is active.
2. Make sure client = *, User =* and status = All, Press F8 to execute
3. Click on any entry with error
4. You may have to dig deeper (SM21, ST22, DB02, etc) and work with functional expert to resolve the issue

SM12 Check lock entries with long duration

1. Type SM12 in command field
2. Client = *
3. User name = *
4. Click list.

Its important to notice all values under the time column show the current time. Jobs with earlier date should be immediately investigated. These locks are problematic because it prevents access or changes to the locked records.

ST22 Check and analyze SAP ABAP short Dumps
An ABAP dump (AKA short dump) is generated when a report or transaction terminates as the result of a serious error. The system records the error in the system log. SM21 and write a snapshot (dump) of the program terminiation to a special table (SNAP). This transaction can also be called from the system log (SM21). ABAP dump is used to analyze and determine why the error occured and take corrective action

(no print screen – currenly my SAP has no Runtime errors)

Once Runtime errors is displayed
1. Double click on the entries
2. A detail analysis on the error will be displayed
3. Dump contains the follow information
– Why program has been terminted
– What caused the program termination
– Where in the program code the termination occured
– What you can do to correct the error
– The values of the relevant system fields when the program terminated
– The calls or events that was active when the program terminated
– Any other programs that are affected

SM21 Check and analyze SAP system log for any critical log entries (hourly)
1. Type SM21 into command field
2. Enter the relevant details and execute
3. Look for unusual entries.
4. Double click on the entries for more information

Lastly, a few more userful transaction

1. SM37 – Check and analyze failed background jobs
2. SP01 – Check SPOOL for errors
3. ST06 – CPU & Memory Utilization
4. ST03 – Check for database performance and response time
5. ST11 – Check for core file entries

SAP R/3 Tips and Tricks – Cheat Sheet for Interview Answers - Terminology explain

noreply@blogger.com (parcelhubkajang) — Tue, 02 Jul 2019 08:03:00 +0000

Lately I found a very helpful SAP website.
SAP R/3 Tips and Tricks – by Ricardo Fernandes de Miranda
Below are the topics focus on the website. Visit: http://www.sapfans.com/sapfans/saptips.htm

Logging on without being authorized

Client 066 usually exists in a SAP system due to EarlyWatch services. Often this
client does not have master users. If it is true, anyone can log into the
system using the client 066, user SAP*, and password PASS. Enjoy yourself.

Specialcopy and paste

Click on the area and press CTRL+Y. It allows you to copy many lines at once
and paste them afterwards.

Long messages on footer

Click on the message and hold the mouse button. After moving the mouse to the
left side.

Direct input logs

The transaction BMV0 (direct input logs) shows all direct input logs.

Graphics on SAPscript

The program RSTXLDMC can be used to upload graphics (file extension .tif on
PC files) into individual standard text.

Adding icons

Check the icon code using transaction ICON. A technical view can be found at
the include named «ICON». Sequences of characters begin and
finish with the symbol @. Even plain files under operating system can contain
those strings.

Filling up an empty date field quickly

Strike the key F4 (or click on matchcode symbol) and press ESCAPE. The current
date is automaticly set.

Setting up module FI/CO without using IMG

Almost all parameters can be set using the transactions ORFA (Asset Accounting),
ORFB (Financial Accounting), and ORKS (Cost Center Accounting).

Displaying check object when not authorized

Soon after the lock try to access the transaction SU53. It reports the last
objects verified and also the respective values.

Table analyses between two systems

The contents of a table between two systems can be checked through the transaction
OY19.

Correction and transport system

The transaction SE10 provides the easiest way to manage any request/transport
and corrections.

General command field formats

/n	Skip to the next record if you are processing one batch input session

Report command field formats

%pri	Print the current report

Helpful reports

RSCLTCOP

Copy tables across clients

Unconditional mode when importing or exporting a request/transport

Run the command R3trans
-u under user «SysID»adm.

Main return codes of tp program

0	Successfully done

Scheduling of system maintenance jobs

RSBTCDEL

Clean the old background
job records

Locking the whole system

Using the command tp locksys «SysID» only the user SAP* will be allowed to login.
The command tp unlocksys «SysID» cancels the lock.

Connection between SAP R/3 and operating system

The command sapevt can be used to trigger an event from the operation system. Thus, a job
previously defined within R/3 will be released.

SQL code help

Run the command oerr ora «error number» under user ora«SysID».

Oracle import and export explanations

Run the command imp help=yes under user ora«SysID». This format can also be used with exp,
impst, and expst.

Of course it does not guarantee a successful implementation. It is a great
deal of summed up aid, though.

Team integration has to be enhanced
Set high standards of performance for implementation team
IT teamsand users have to work closely during the implementation
New ways of thinking and acting must not be discarded
Do not underestimate the user training needs
Project management should be on the critical list
The nearest SAP branch should be your partner
Consultants are not always the key to succeed
Consultants are a good source of knowledge. On the other hand, letting them make configuration
changes the transfer of knowledge will be harmed
Foreign consultants usually do not know country-specific details
Deepening your basis knowledge is always useful
Avoid changing standard R/3 objects as much as possible
Always follow the SAP rules to give names to your own objects
Establish SAP connection as soon as possible
Exchange information with other companies
Focus on interfaces with non-R/3 applications
Plan the whole environment carefully (servers, network, protocols, etc.)
Development and production environment should be totally independent

Some special features allow you wide modifications without changing standard
SAP R/3 objects. Those
techniques are not as widespread as they should be. In fact they are powerful
tools.

Field exit

After entering a value in a field, it can be checked through a field exit. The
system makes the field value available to be checked and changed in an
ABAP/4 function.

User exit

Points previously set in the system that let you evaluate data. The fields available
are also previously defined by SAP. All fields value available can be checked
in an ABAP/4 program.

Validation

It allows solid data entry regarding special rules. According to previous
rules, the system can evaluate an entry and a message can appear on the
user’s terminal if a check statement is not met. A validation step contains
prerequisite statement and check statement. Both of them are defined using
Boolean Logic or calling an ABAP/4 form.

Substitution

Fields contents can be changed using substitution. When data are being entered,
the data can be substituted by another value regarding rules previously
defined. A substitution step contains prerequisite statement, substitution
value and substitution exit. All of them are defined using Boolean Logic
or calling an ABAP/4 form.

Values or ranges of values are specified under a set name. Sets are easier to
create and maintain instead of using tables. They give you more flexibility
when maintaining your system.

Key words

It allows changes on field description according to data element. The short
key word used on most screen to identify the corresponding field contents
can be changed too.

Requirements & formulas

ABAP/4 forms that can be used to handle pricing procedures, rounding rules, copy
and data transport Sales activities.

System gets stuck

It happens mostly when archive area is overloaded. Run the program brarchive
with deletion option to release disk space.

Short dump

Not always the problem is technical. Try to create all SAPoffice users through
transaction SO32 (create all SAPoffice users) and review your application
data carefully.

Field exits are completely ignored

Make sure your SAP profile parameter contains the option abap/fieldexit = yes.

Transaction SE16 (table contents) does not work properly

Make usage of the menu option to regenerate the display program. You can also
try changing key words according to field names. Choose Option -> Parameters
users.

Rollback segments are too small

Before increasing up the rollback segment size you should verify your programs.
Very often the problem belongs to them.

Files for rollback segments are already enormous

Check the rollback segments configuration. It has to match the allocated area
on tablespaces. Changes have to be done using Oracle tools.

Extended help under windows does not link correctly

Check the file sapdoccd.ini under your presentation server. It must be
present in the main windows directory and should assign to help files directory.

Release procedure with classification does not work

As a matter of fact you are not the only one to notice it. It hardly works.
Before using release strategy you should apply all notes on OSS. Pray might
be useful too.

Transport area is overloaded

The command tp clearold «SysID» cleans up the transport
area according to parameters previously set on the plain file TPPARAM.

Instance does not establish communication

Shutdown the whole system and check the Interprocess Communication Facilities. Any
references should be found. Either the command IPCS (UNIX) or showipc
«INSTANCE NUMBER» (SAP) show all message queue, semaphore
set and shared memory identifier. Before trying again you have to remove
them using the command IPCRM (UNIX) or cleanipc «INSTANCE
NUMBER» (SAP).

Note:

Research based on version
3.0f under Unix, Oracle data base and Windows.

Simple changes can rise your system security. Usage of SAProuter is a good choice
when correctly implemented. Login through SAP LogonPad (from version 3.0f
onwards) improve the access control. SAP profile parameters shall also
contain:

Rdisp/gui_auto_logout = 1800

The user connection is closed after 30 minutes without usage.

After 3 wrong password the connection is automaticly closed.

After 5 wrong password the user is locked.

Password length at least 6 characters.

Password expires after 3 months.

Indeed these powerful ABAP/4 functions are very interesting and can bring some
advantages. Improve your home development easily. They belong to standard
objects and should never be changed.

Ws_upload

Transfer files from the frontend to the application server.

Ws_download

Transfer files from the application server to the frontend.

Ws_excel

Download files at the frontend in excel format.

Bp_joblog_read

Fetch job log executions.

Rs_send_mail_for_spoollist

Send message from ABAP/4 program to SAPoffice.

Bp_event_raise

Trigger an event from ABAP/4 program.

So_wind_spool_list

Browse printer spool numbers according to user informed.

So_spool_read

Fetch printer spool according to the spool number informed.

G_set_get_all_values

Fetch values from a set.

Rzl_sleep

Hang the current application from 1 to 5 seconds.

Rzl_submit

Submit a remote report.

Ws_execute

Execute an external program on the presentation server.

Ws_file_delete

Delete file at the frontend.

Ws_volume_get

Get the label from a frontend device.

Ws_msg

Create a dialog box in which you display an one-line message.

Popup_to_display_text

Create a dialog box in which you display a two-line message.

Popup_to_confirm_step

Create a dialog box in which you make a question whether the user wishes to perform
the step.

Popup_to_confirm_with_message

Create a dialog box in which you inform the user about a specific decision point
during an action.

Popup_to_confirm_with_value

Create a dialog box in which you make a question whether the user wishes to perform
a processing step with a particular object.

Popup_to_confirm_loss_of_data

Create a dialog box in which you make a question whether the user wishes to perform
a processing step with loss of data.

Popup_to_decide

Create a dialog box in which you require the user between the two processing alternatives,
or to cancel the action.

Popup_to_decide_with_message

Create a dialog box in which you inform the user about a specific decision point
via a diagnosis text.

Information
Technology has many key words and SAP
R/3 has introduced many others. In order to understand even better
this field you should keep in mind those terms.

ALE (Application Link Enabling)

It provides integration for separate R/3 systems, keeping full interaction.
This makes possible distributed enterprise applications.

Application server

The application server is used to run the business application programs in
the R/3 client/server concept. The application modules are loaded from
the data base server to the application server as required. Thus the application
server requires only storage capacity to accommodate UNIX, Swapping and
the SAP runtime environment.

Batch Input

A technique to input data safely. It ensures application data integrity for
background interfaces. It pretends to be someone typing. See also direct
input.

CATT (Computer Aided Test Tool)

It allows you to combine and automate sequences of repeatable transactions
in test procedures. CATT reduces the number of manual tests, and forces
you to test systematically, defining input values and expected test results.

CCMS (Computer Center Management System)

It allows you to monitor, control and configure your R/3 system. This toolset
lets you analyze and distribute client workloads and report on resource
consumption for system components.

Central System

In an R/3 central system, both application and data base software are run
on one computer.

Client

In commercial, organizational and technical terms, a self-contained unit in
an R/3 system with separate master records and its owns set of tables.

Client/Server System

Client/server systems are structured modularly, with components working in a sender/receiver
relationship. Software components can also be used in a client/server relationship.

Communication Server

It provides the connection between local area and wide area networks and may
be either a router, a bridge or a gateway. In R/3 installations, the communication
server must support the TCP/IP protocol over wide area networks.

Company code

The smallest organizational unit for which a complete self-contained set of
accounts can be drawn up for purposes of external reporting. This involves
recording all relevant transactions and generating all supporting documents
for legally-required financial statements, such as balance sheets and profit
and loss statements.

Computer type

The R/3 system supports various computer types of SAP’s platform partners,
such as Bull, DEC, IBM and HP. The suitability of a particular computer
type depends on sufficient CPU performance.

CPI-C (Common Programming Interface-Communications)

Common Programming Interface of Communication has been introduced by IBM as a
high-level interface to SNA/LU6-2. CPI-C has become the subject of the
X/Open stardarlization and is used by SAP to facilitate program-to-program
communication between R/3 and external system. SAP offers CPI-C libraries
based on TCP/IP.

Correction

It contains all the objects that a developer has changed or created. It also
controls customizing that has been maintained.

A system to help SAP employees to give comprehensive support to their clients.

Data base server

The data base server stores the SAP application programs and data in the R/3
client/server concept. It also handles the SAP update program and batch
jobs.

Direct Input

A recent technique to input data safely. It ensures application data integrity
for background interfaces. See also batch input.

Dispatcher

The system R/3 agent that identifies the type of task (on-line, update, batch,
etc.) and sends the job to an idle work process.

EarlyWatch

It is a service that entails having your R/3 installation regularly inspected
by SAP employees, in other to ensure high system availability and high
data throughput at all time.

Ethernet

It is a LAN architecture using bus topology. The transmission speed is 10
MBit/s.

FDDI (Fiber Distributed Data Interchange)

It is a local high-speed network with ring topology based on light wave conductors.
The transmission speed is 100 MBit/s.

Field status

Indicator that specifies whether a field can take an entry in the entry screen or
if it must be filled.

Firewall It is a means of controlling access through a public network to a privatenetwork.
FTP (File Transfer Protocol)

It is the most commonly used file transmission protocol of the TCP/IP protocol
family.

GUI (Graphic User Interface)

A graphical interface used by SAP environment as part of the three tiers.
It is normally called user frontend.

IDES (International Demonstration and Education System)

It is a model of an international firm. It is a separate demonstration and
education system for speeding up the pilot process.

IMG (Implementation Management Guide)

It is a hierarchical structure that reflects the R/3 component hierarchy and
contains every configuration activity. Released from version 3.0 onwards.

Instance

It means application server and each one has its own set of work processes.

IDoc (Intermediate Document)

An IDoc is a data container for data exchange between SAP systems or between
an SAP system and an external system.

ITS (Internet Transaction Server)

It links the R/3 application server with one or more Web servers, thus enabling
the R/3 to communicate with the Internet.

Kernel

It means a standard core previously configured. A set of default parameters
delivered with the system.

LAN (Local
Area Network)

It is a network foa a tightly limited area with high level data transmission
performance. Common LANs include Ethernet, Token Ring and FDDI. These LANs
support different transport protocols, such as TCP/IP and IPX.

Matchcode

A tool for finding specific record. It is made up of search terms. It is
used to find possible entries for an input field.

Number range

A range of numbers that are laid down per file for the assignment of document
numbers. It can be internal (carried out automatically by the system) or
external (carried out manually by the user).

It is a technique introduced by Microsoft to incorporate objects of one application
into another.

OSS (Online Service System)

SAP’s Online Service System offers fast and effective help for R/3 System problems.
It is also the basic element of communications between customers, partners,
and SAP.

Repair

It contains all the objects that a developer has changed but the originals
of the objects are located in another system.

A way to implement communication between application programs via Abap/4
function call.

Semaphores

When a work process locks a resource, it sets a semaphore. Another work process
that also wants to access it must then wait.

SysID

A set of three letters or number that identify a system. Some sets are not
allowed because they are used by SAP. They are informed when the system
is installed.

TCP/IP

It
is the most widely used transport protocol for open systems. R/3 clients
and servers communicate using TCP/IP.

Telnet

It provides terminal access to hosts using TCP/IP protocol. It is a well-known
command among Systems Administrators.

Token Ring

It is a LAN architecture with ring topology. The transmission speed is 4 MBit/s
or 16 MBit/s. This involves a ‘free token’ which circles the loop picking
up transmissions. The receiver station places a confirmation bit into the
busy token. As soon as the busy token reaches the sender station again,
it is converted back to a free token and sent on to the next station.

Transport

It is a request to transport objects from the software development environment,
identified as the source system, to the specified target system.

WAN (Wide Area Networks)

They are normally operated either by the telephone company or by private companies
that offer leased lines, switched lines or packet lines.

Work process

Work processes perform the bulk of the processing carried out by SAP systems.
They perform dialog steps in user transactions and carry out updates, lock
management, printing services, and so on.

Workbench

The ABAP/4 Workbench, a graphical programming environment, is used to create
application programs. The programming tools are accessed using buttons,
dialogs and windows.

Workflow

It consists of time and logical sequence of work items, which are precessed
by human agents or mechanical processing units.

X.25

It is a standardized network access protocol for the packet switching network.
The maximum transmission speed is 64 KBit/s.

BDOC and IDOC – What are they?

noreply@blogger.com (parcelhubkajang) — Tue, 25 Jun 2019 08:02:00 +0000

What BDOCS and IDOCS.

IDOCS are intermediate documents (normally in text file format) which are used as between SAP and non-SAP system. In a real work, a company may have different systems. So IDOCS are used as a vehicle encapsulate these data so these systems can exchange information.

Eg: During POS, IDOCS are generated and it includes price, number of items, description and etc. Then its transfer ASYNCHRONOUSLY to SAP system. Think of it like excel exporting a file to *.csv and then Outlook can read the *.csv file.

BDOCS on the other hand, is the CRM version of IDOCS. BAPI is another SAP intermediate documents but its used for SYNCHRONOUS transactions.

In the computer world, we called such activity as ELECTONIC DATA INTERCHANCE (EDI)

SAP Basis: How to Check ABAP Dumps Message Type X

noreply@blogger.com (parcelhubkajang) — Tue, 18 Jun 2019 08:01:00 +0000

Steps:

Execute ST22 > Double click on any entries
Go to Source Code Extract
Locate “>>>>” and you will see Message X041 in this example. Take note of the Message class and number.
Now open SE91. Enter the details we found from Source Code Extract in ST22:
-Message Class: RD
-Message Number: 041
Click Display
Here, we determine what the message indicates
Now we know that the ABAP Dump message type X is due Extract Structure does not exist at the time of transport. Informed the ABAP consultant or Function consultant about this issue.

Most common SPOOL error encountered by BASIS. How do we resolve this issue?

noreply@blogger.com (parcelhubkajang) — Tue, 11 Jun 2019 08:00:00 +0000

Steps

Execute SM37. You found an error Job. When you double click you found
You saw the below error
This error is caused by job spooler is not defined when job creation hence it picks up the job owner’s default output device.
Since the default output device is no populated on master user record, the job log can’t find the print parameter.
To resolve the issue, please populate the output device and select your preference for your SAP spool request via transaction code SU3.
For Output device, you can choose one of SAP printer which has been defined in SAP (you can look at via transaction code SPAD)
Recommendation: please do not select LOCL if you want to opt ‘Output immediately’. Moreover, this output device is not good for network performance
Select ‘Output immediately’ if you want to immediate print for every spool request that you create in SAP. Recommendation: do not select this.
Select ‘Delete After Output’ if you want SAP to delete every spool that you create. Recommendation: do not select this. You can manage your spools e.g. printing, reprinting, deletion, etc via transaction code SP01 as below:

3 SAP HANA Security Best Practices

noreply@blogger.com (parcelhubkajang) — Fri, 07 Jun 2019 08:18:00 +0000

1 – Operate on a least access rights model. The more access an employee has, the more potential damage they could do to your organization — either through an inadvertent breach or an intentional leak. Because SAP applications play such an integral role in the organization financials, businesses need to restrict each user to the information needed to do their job.

Even display access or access to seemingly innocuous information can potentially expose the organization, and needs to be controlled in line with SAP HANA security best practices. For example, a glance at a bill of materials could show competitors what products the company is working on, or even what it takes to construct a cutting edge project from the ground up.

2 – Ensure you have the right expertise. In previous versions of SAP, all users would interact through the SAP GUI, and use it to access a wide range of SAP applications and development tools. With SAP HANA, users who needs direct access to the database will leverage SAP HANA Studio or SAP Web IDE. Traditionally SAP permissions are controlled via “transactions” and “authorizations.” Inside an SAP HANA database, however, they’re called “privileges.”

They’re conceptually similar but the implementation is different. An ABAP backend Netweaver administrator will have a rather large learning curve to understand how the administration is performed within the SAP HANA database. For example, administration in a HANA database is performed via SQL statements, which can be generated via SAP HANA Studio or SAP Web IDE. This is one of many reasons organizations should consider moving to an IT managed services model after an SAP HANA migration.

3 – Understand how HANA handles objects. HANA applications are built out of development objects, which are stored in the HANA repository. When user and role administration is performed as design-time objects, the roles are owned by the technical user, so personnel can change without affecting the objects. That means they can be transported and versioned, even if the database user changes.

If roles are created as runtime objects, however, they’re associated with the database user — i.e. the actual person who created the role. If that person leaves the organization and is deleted from the database, their role creations and assignments are deleted with them, which can be catastrophic.

Stay safe in SAP HANA. Although security principles vary little between applications, the implementations and knowledge base required do. SAP HANA security best practices require a combination of security expertise and experience and HANA-specific knowledge. Whether you’re looking for an SAP security services partner, or just need someone to get your admin up to speed, contact us to learn how Symmetry can help.

Source https://symmetrycorp.com/blog/3-sap-hana-security-best-practices/

Video - SAP HANA Creating a User with Schema access

noreply@blogger.com (parcelhubkajang) — Thu, 06 Jun 2019 08:36:00 +0000

https://www.youtube.com/watch?v=L_ICwmBycdQ

How to create user in SAP

noreply@blogger.com (parcelhubkajang) — Tue, 04 Jun 2019 07:54:00 +0000

Steps

Execute SU01
Enter user name and press CREATE (notepad)
Enter necessary details such as Firstname and Lastname
Click on Logon Data Tab and enter password a password eg: enjoysap123
Click Save (floppy disk icon). Now you can informed the user that his/her account has been created.

How to create User in SAP HANA - Assign Role and Activate User

noreply@blogger.com (parcelhubkajang) — Sun, 02 Jun 2019 08:27:00 +0000

SAP HANA Security is to protect important data from unauthorized access and ensures that the standards and compliance meet as security standard adopted by the company.

SAP HANA Provide following security-related feature –

User and Role Management
Authorization
Authentication
Encryption of data in Persistence Layer
Encryption of data in Network Layer

CREATE USER IN SAP HANA

Create User in SAP HANA- only database user with ROLE ADMIN privileges can create user and role in SAP HANA.
Step 1) To create new user in SAP HANA Studio go to security tab as shown below and follow the following steps;
1. Go to security node.
2. Select Users (Right Click) -> New User.
Step 2) A user creation screen appear.
1. Enter User Name.
2. Enter Password for the user.
3. These are authentication mechanism, by default User name / password is used for authentication.

By Clicking on the deploy Button user will be created.

2. Define and Create Role

A role is a collection of privileges that can be granted to other users or role. The role includes privileges for database object & application and depending on the nature of the job.

It is a standard mechanism to grant privileges. Privileges can be directly granted to the user. There are many standard roles (e.g. MODELLING, MONITORING, etc.) available in SAP HANA database.

We can use the standard role as a template for creating a custom role.

A role can contain following privileges –

System Privileges for administrative and development task (CATALOG READ, AUDIT ADMIN, etc.)
Object Privileges for database objects (SELECT, INSERT, DELETE, etc.)
Analytic Privileges for SAP HANA Information View
Package Privileges on repository packages (REPO.READ, REPO.EDIT_NATIVE_OBJECTS, etc.)
Application Privileges for SAP HANA XS applications.
Privileges on the user (For Debugging of procedure).

CREATE ROLE IN SAP HANA

Step 1) In this step,

Go to Security node in SAP HANA System.
Select Role Node (Right Click) and select New Role.

Step 2) A role creation screen is displayed.

Give Role name under New Role Block.
Select Granted Role tab, and click "+" Icon to add Standard Role or exiting role.
Select Desired role (e.g. MODELLING, MONITORING, etc.)

STEP 3) In this step,

Selected Role is added in Granted Roles Tab.
Privileges can be assign to the user directly by selecting System Privileges, object Privileges, Analytic Privileges, Package Privileges, etc.
Click on deploy icon to create Role.

Tick option "Grantable to other users and roles", if you want to assign this role to other user and role.

GRANT AND ASSING ROLE TO USER IN SAP HANA

STEP 1) In this step, we will Assign Role "MODELLING_VIEW" to another user "ABHI_TEST".

Go to User sub-node under Security node and double click it. User window will show.
Click on Granted roles "+" Icon.
A pop-up will appear, Search Role name which will be assign to the user.

STEP 2) In this step, role "MODELLING_VIEW" will be added under Role.

STEP 3) In this step,

Click on Deploy Button.
A Message " User 'ABHI_TEST" changed is displayed.

RESET SAP HANA USER PASSWORD

If user password needs to reset, then go to User sub-node under Security node and double click it. User window will show.

STEP 1) In this step,

Enter new password.
Enter Confirm password.

STEP 2) In this step,

Click on Deploy Button.
A message "User 'ABHI_TEST" changed is displayed.

REACTIVATE / DEACTIVATE SAP HANA USERS

Go to User sub-node under Security node and double click it. User window will show.

There is De-Activate User icon. Click on it

A confirmation message "Popup" will appear. Click on 'Yes' Button.

A message "User 'ABHI_TEST' deactivated" will be displayed. The De-Activate icon changes with name "Activate user". Now we can activate user from the same icon.

Source:
https://www.guru99.com/sap-hana-security.html

What is SAP Authorization?

noreply@blogger.com (parcelhubkajang) — Sun, 02 Jun 2019 07:53:00 +0000

Authorization in SAP means giving users access right to a T-Code. Using T-Code PFCG allows Basis to change user’s authorization inside a T-Code. By adjusting the object you also can control user’s activity such as display, edit, or change certain field in the T-Code.

A Role Is created with the profile generator and allows the automatic generation of an authorization profile. The role contains the authorization data and the logon menu for the user.

When we have a few roles, we can group them up as Composite role.

SAP How to Step by Step Guide with Screen Shot

noreply@blogger.com (parcelhubkajang) — Fri, 31 May 2019 07:52:00 +0000

1. When user receive an authorization error such as the below dialog box, request the user to enter /nSU56 or /nSU53 to display more details on the authrization issue.

2. In Su56, expend the menu and you will see the object value and transaction type. In this scenario we know user do not have authorization on object value “0111” and transaction “V”

3. We now know that user is not authorized for object “C_PROJ_TCD”, value “0111” and type “V”.

4. Use T-Code S_BCE_68001425 to search for the authorization object. In this scenario we enter the username and authorization object and it will display the role.

5. Below is the results. Now we have to find the correct role which we need to give authorization too. If you are not sure, consult with your consultant.

6. Open /nPFCG to edit the role.

7. Enter the role name.

8. Click on Authorization tab and click “display authorization data”

9. Expend the menu and locate the object or use the “FIND” button to search for object “C_PROJ_TCD”

10. Below are the authorization you need to provide accordingly.

11. In this case, we select “0111 which is Basic WBS dates”

12. Save

13. Click on generate profile button

14. Now do user comparison

15. Ask user to re-login and try the transaction again.

Addtional InfoIf you know the Authorization object and would like to search which transaction is using it, you can open this transaction from SAP menu.

Backup database to a tape drive using DB13

noreply@blogger.com (parcelhubkajang) — Tue, 14 May 2019 08:14:00 +0000

In this scenario, we will backup the Database (DB2) to a tape drive and then perform archive once backup is completed.

1. Enter T-Code DB13 into the command field.

2. Choose at what date and what time to perform the backup. Click the ADD button.

3. You will see the above screen.

4. Fill in the details of the backup to be performed.
Action: Full Database Backup to Device
Backup Mode: Online
Device/ Directory: file:////tape0

5. Click Add

6. Now enter the backup tape into the tape drive.

In this case, full backup job has been schedule and will be perform at 2:00AM. Once completed, you will have to perform archive inactive Log Files to Tape. To do so, please follow:-

*Please take note that each archive command is different. Since I am using DB2, I’ll use the IBM D2 command line utility

1. Eject Insert the correct tape cartridge for the day into the tape drive.

2. Go to Start > All Programs > IBM DB2 > Command Line Tools > Command Window

3.You will see the above command window

4. Enter db2tapemgr DB PRD DOUBLE STORE on \\.\TAPE0 FORCE

5. It would take a while until archive backup log is complete.

6. Once completed, you can eject the tape using db2tapemgr EJECT TAPE \\.\TAPE0 on the command window.

You have succesfully perform backup and archive log to a tap

How to Delete duplicated roles from user

noreply@blogger.com (parcelhubkajang) — Mon, 01 Jan 2018 15:55:00 +0000

Run the report PRGN_COMPRESS_TIMES

SAP GRC Access Control Explain

noreply@blogger.com (parcelhubkajang) — Thu, 28 Dec 2017 15:54:00 +0000

SAP GRC Access Control consists of the following modules:

Compliant User Provisioning (CUP)

Risk Analysis and Remediation (RAR)

Enterprise Role Management (ERM)

Superuser Privilege Management (SPM)

Compliant User Provisioning (CUP)

CUP provides the workflow engine to drive compliant user and role maintenance processes within the SAP environment. These processes are auditable and verifiable, with clear, configurable processes for approval, SoD checking and provisioning.

Risk Analysis and Remediation (RAR)

RAR is the repository for definitions of SOD (segregation of duties rules). As well as using the rules to check if user and role administration activities could introduce risks to your business, RAR reports on the risks within the system – presenting them in a graphical format within a web browser.

Enterprise Role Management (ERM)

ERM rigorously applies naming conventions and validations to role creation, reducing management effort and the risk of segregation of duties violations. To use ERM you have to define structured working methods.

Superuser Privilege Management (SPM)

Previously known as Firefighter, SPM lets you assign 'emergency user' status to normal support users, giving them extended access for exceptional circumstances. A notification is linked to the use of this extended access. And all activities are logged during its use to reduce the risk of unauthorised activities taking place. SPM is one of the simplest Access Control components to deploy.

SAP Security Authorization Interview question

noreply@blogger.com (parcelhubkajang) — Sat, 23 Dec 2017 15:53:00 +0000

How do you determine what organization value to be given to user?
Refer request form, change request, functional team, copy from sample user, consult their subordinate or manager. Some business sense is needed. Never give more values then requested.
How would you map a tcode to user?
Check request form. Investigate the user's role function. Research the function of the tcode. Do not give any tcode which that is not needed by the user in business point of view.
What background or periodic job security consultant should know?
- Daily check on sap* and ddic user. It should be locked times (unless there is upgrade)
- Run RSUSR006 to check locked users.
- Check is production client is lock against direct changes
- Check on sap_all profile. No one should have it.
Single Role Naming conventionSample : MY1XFCSOA or MY1XFCSOD
Explain:
- MY (country code)
- 1X (domain - which correspond to org level value excel sheet)
- FCSO (abbreviation of the function role - Finance Create sales order)
- A (activity type - A means change, D means display)
Max profile?
-312
How to check how much profiles a user have?- Table USR04
System parameter used by security- login/no_automatic_user_sapstar
- Login/failed_to_user_lock
- Login/fails_to_session_end
- Login/gui_auto_logout
- many more, google for results.
Why sap* cannot be used?- SAP is design not to check authorization for user sap*
- Who ever has sap* get control over the whole system
Tcode frequently use
- SUIM, PFCG, SU01, SU53 and google for more
What is SU24- Remove and add authorization object check (to be display in PFCG)
- Use to standardized common authorization object to be pulled in a role
What is a derived role- A child role derived from master template
Authorization object
- A collection of authorization field.
How to check user access issue- SU53, ST01
User do not have access but SUIM search indicates authorization givenReason:
- Max profile reach
- Didn't relogin
- Did not perform user comparison
Which tables shows what profile a user have?- UST04
PFCG tables- agr_agrs, agr_1251, agr_1252, USR02 and etc
How to transport a role- PFCG > there is a transport truck icon. Alternately, use mass transport from the menu
Convert field to org level- Run program PFCG_ORGFIELD_CREATE
What is GRC- Governance Risk and Compliance
- Help company to put in place a set of policy and control to be SOX compliance
Components of GRC- CUP (Compliance user provision - enable self request for role and also approval)
- RAR (Risk Analysis and Remediation - check SOD, generate report and propose solution)
- ERM (Enterprise role Management - Assist in role designing)
- SPM ( Super privileged management - profile super user access like firecoll and mitigation)
Why do single roles sometimes has more profile
- When there are more then 150 object in a profile, SAP auto generates new profile

End of SAP Security Authorization Interview question

SAP SECURITY - Create authorization object and assign to user

noreply@blogger.com (parcelhubkajang) — Thu, 21 Dec 2017 15:52:00 +0000

Authorization Objects are used to manipulate the current user's privileges for specific data selection and activities from within a program.

We could always create our own authorization objects and implement it in our own abap programs. As an example, we will create our own authorization field similar to TCD used in S_TCODE

Steps to create authorization field

1. Go to transaction code SU20

2. Click the create new button on the application toolbar.

3. Enter "ZTCODE" in the Field Name and "TCODE" in the Data Element, then hit Enter.

4. Click the save button on the system toolbar.

Next step is to create the authorization class and authorization object

Steps to create authorization class

1. Go to transaction code SU21

2. Click on the Create button's drop down icon and select "Object Class".

3. Enter "ZTRN" on the Object Class field.

4. Give it a description and save it.

Steps to create authorization object

1. Again in SU21, in the list of authorization class(folder icon), click the one that we've created(ZTRN).

2. Click on the Create buttodrop down, this time selecting "Authorization Object".

3. Enter "Z_TCODE" on the Object field and give it a description.

4. On the authorization fields section, enter ACTVT and ZTCODE. ACTVT is used to set and limit the activity of the user, while the ZTCODE is the authorization field that we've created earlier which is

responsible for holding a list of tcodes.

5. On the Further Authorization Object Settings, click on "Permitted activities" button. Here we will select the specific activities that we want to be available for our authorization object.

6. As an example, we will select 01(Create), 02(Change), and 03(Display).

7. Save and Exit.

Now we're done creating our own authorization object, let us now use and assign it to a user.

Steps to create a role

1. Go to transaction code PFCG.

2. Enter "ZAUTHTEST" on Role field and click the "Single Role" button.

3. Now give it a description, click the save button and click the Authorization tab.

4. Click the "Change Authorization Data" button inside the authorization tab.

5. Then click the "Manually" button on the application toolbar and type in the name of the authorization object that we've created earlier("Z_TCODE") and press enter.

6. Expand all the nodes, double click on the input field of the Activity and select activity 01 and 02.

7. Enter the tcode of our own abap program in ZTCODE field, in our example I used "ZCOMM" .

8. And also don't forget to add the S_TCODE authorization object and enter ZCOMM on it's field.

9. Now Click on the Generate button in the application toolbar and press enter on the pop-up screen.

10. press the back button and assign a specific user on the user tab and click User Comparison button.

11. Now create another role by repeating steps 1 to 9 but this time select activity 03 on step 6.

12. Then assign this 2nd role to another user.

SAP SECURITY INTERVIEW - FIND USER ID FROM TABLE PA0105

noreply@blogger.com (parcelhubkajang) — Tue, 19 Dec 2017 15:51:00 +0000

You only have Personal Number (PERNR) or Email (USRID_LONG) as reference
SE16 > PA0105
Now enter PERNR or USRID_LONG
SUBTY must be 0001
Now execute

SAP SECURITY - MASS CHANGE USER LICENSE VIA SU10

noreply@blogger.com (parcelhubkajang) — Mon, 18 Dec 2017 15:49:00 +0000

SU10 > Authorization Data > User > Multiple Selection
Choose copy from txt file (if you have it in txt format) or clip board (if you click copy paste)
Click Copy and it will bring you back to previous screen
Click Execute
Select All user
Click Transfer
You will get back to SU10 main screen again
Click Change
License data Tab > Select your desired user license from drop down list
REMEMBER TO CHECK "CHANGE"
Now Save and continue
Once finish, log will be displayed for your reference

Organizational Level Authorization Field

noreply@blogger.com (parcelhubkajang) — Sun, 17 Dec 2017 15:49:00 +0000

ARBPL Work Center
PLVAR Plan Version
KOKRS Controlling Area
BUKRS Company Code
PRCTR Profit center
IWERK Planning Plant
SWERK Maintenance Plant
EKGRP Purchasing Group
EKORG Purchasing Org.
WERKS Plant
VKORG Sales Organization
VTWEG Distribution Channel
SPART Division
VSTEL Shipping Point
LGORT Stor. Loc.

BERID MRP Area

SAP SECURITY - MASS CHANGE USER LICENSE VIA SU10

noreply@blogger.com (parcelhubkajang) — Sat, 16 Dec 2017 15:48:00 +0000

SU10 > Authorization Data > User > Multiple Selection
Choose copy from txt file (if you have it in txt format) or clip board (if you click copy paste)
Click Copy and it will bring you back to previous screen
Click Execute
Select All user
Click Transfer
You will get back to SU10 main screen again
Click Change
License data Tab > Select your desired user license from drop down list
REMEMBER TO CHECK "CHANGE"
Now Save and continue
Once finish, log will be displayed for your reference

SAP SECURITY : GRC maintaining Workflow CUA system

noreply@blogger.com (parcelhubkajang) — Fri, 15 Dec 2017 15:47:00 +0000

Open http://domain.com/useradmin
Login with an adminsitrator
Enter an user ID and click Go
Default only display 5 row. To change go to
Upper right of the browser and select 'SHOW ALL'
Done

GRC does not process report real time. It has to be schedule as a job for RAR reporting to work.

noreply@blogger.com (parcelhubkajang) — Wed, 13 Dec 2017 15:43:00 +0000

Schedule USER, ROLE, PROFILE SYNCHRONIZATION. This job is used for Batch Risk Analysis job later for reporting
GRC > CONFIGURATION > SCHEDULE JOB > Check only the 3 below > Then click schedule button at the bottom
Give a Job name > You may specify any options you like > Click Schedule. In our case, it will run weekly starting from 6th Oct 2011
Now schedule a new job > Select the 4 check box below > Click Schedule at the bottom
Same as before, just specify a job name and any option you like. Now click schedule again.
To check if the job you schedule is ready or running, just click "SEARCH"
Then enter the search criteria and result will show as below:

SAP SECURITY EXPORTING USER EMAIL

noreply@blogger.com (parcelhubkajang) — Mon, 11 Dec 2017 15:42:00 +0000

To extract user's email, you may search from table USR21 and ADR6

SE16 > USR21 and enter user ID
Copy the PERNR (personal number)
SE16 > ADR6 and paste the PERNR
You will get a list of email addres

Alternatively, you may replace Table ADR6 with PA0105 but this table only exist in HR system.