SAP Security: Troubleshooting Authorization Errors

SAP Security: Troubleshooting SAP Authorization Errors

SAP has provided some important tools for troubleshooting or analyzing the authorization errors. Those are system trace (ST01) and authorization error analysis (SU53). These two tools are most frequently used to determine the authorization errors.

System Trace (ST01):

ST01 transaction code is used to execute the system trace functionality. This will record the authorization checks for the users. The system trace option is executed in the application server where the transaction code is executing by the user. Basically trace and transaction to be traced should be on the same application server. The system trace records each and every authorization object, fields and field values. 

To use system trace functionality Go to Tools-->Administration-->Monitoring-->Trace-->System Trace or execute transaction ST01.

Select the Authorization check box under the Trace Components to record the security authorizations.


There is an option for filtering the security trace for a particular user. For this option, click on the General Filters and enter the user id that requires security trace. This will record the authorizations particular to that user.


Once the security trace is done, the trace needs to analyzed. Click on the Analysis tab in ST01 transaction code. Below screen appears. Click on execute icon to see the details of security trace.


Below is the detailed sample output of the system security trace.



Authorization error analysis (SU53):

This is the another functionality provided by SAP for analyzing the authorization errors. SU53 transaction code is used for this functionality. This will display only the last failed authorization checks.

This will compare the user's authorizations with the user buffer. User buffer is where it contains all the authorizations that are assigned to user. This user buffer loads when the user log on to the system. SU56 transaction code displays the user buffer. It contains what are all the transaction codes are assigned to user master record.

User has to execute /nSU53 immediately after getting the authorization error and sent to user administrator for analysis. Below is a sample screen shot of SU53.


Watch the below demo video on how to take system trace using ST01.




Location: Chicago, IL, USA

Comments

Post a Comment

Popular posts from this blog

SAP Security: Critical Authorization Objects

SAP Security: Critical Authorization Objects 1. S_TABU_DIS: This authorization object enables authorization check for displaying or modifying the table content. For accessing the table data, users use SE16, SM30 or SM31 transaction codes. This object contains two fields, DICBERCLS (authorization group) and ACTCT. 2. S_RFC: This authorization object enables authorization check for remote function call to access program modules (function modules). This authorization object contains three fields, RFC_TYPE, RFC_NAME and ACTCT. 3. S_DATASET: This authorization object enable file access at operating system level. This gives permission to access files from ABAP programs. This object contains three fields, File name, Program and Activity. 4. S_ADMI_FCD: This authorization objects enable access to various administrator activities like system monitoring, spool administration, client creations, update administration etc. This object contains one field, system administration functions. 5. S_DE...
Read more

SAP Security: How to set auto Logoff for Inactive users in SAP

Image
How to set auto Logoff for Inactive users in SAP SAP provides an options for logging of inactive users in SAP automatically. Inactive means if there is no activity for a specific period of time. By setting the auto logoff improves the security in the SAP system. The auto logoff options is not active in the system by default. This needs to be activated using the profile parameter called rdisp/gui_auto_logout. The value for this parameter should be set in the form of seconds. The inactive users are logout of the system after the specific time period that is set in the parameter. The SAP system doesn't save the data before auto logoff and it does not popup any prompt before auto logoff. Procedure to set the value in the Profile parameter: Execute transaction code RZ10 Select the DEFAULT profile from the selection menu. Select the Extended maintenance and click on change icon. Click on the create parameter icon as shown below. Enter the new parameter name as rdisp/gui_auto_logout and c...
Read more

SAP GRC Security Consultant Roles and Responsibilities

SAP GRC Security Consultant Roles and Responsibilities 1. SAP GRC Consultant should have a knowledge on Governance, Risk and Compliance products. 2. Should have a thorough knowledge as well as experience in relation between ERP and GRC systems. 3. Should have an experience in configuring and supporting of GRC components like ARA, ARM, BRM and EAM. 4. GRC consultant should be having good understanding of GRC architecture. 5. Should be having hands on experience in user provisioning, role management, risk analysis, emergency access management and monitoring. 6. Should have experience in pre installation, post installation, connector settings, rule building and MSMP workflows and BRF+ in the ARM and BRM components. 7. Should have experience in end to end implementation of GRC Access Controls. 8. Should have experience in designing and developing the SAP business process. 9. Should be able to gather business requirements and implement the same in the GRC AC modules like ARA, ARM, BRM and E...
Read more