Authorizations for Cross-Database Comparison (CDC)

Transcription

1 Authorizations for Cross-Database Comparison (CDC) Solution Manager 7.1 and 7.2 June 7, 2016 Customer

2 Agenda Introduction / Overview Authorization Objects and Roles Further Authorizations 2013 SAP AG. All rights reserved. Customer 2

3 Introduction / Overview

4 Introduction Reasons for authorization checks in CDC Comparisons may extract and store sensitive data Change of comparisons (for example filter criteria or connections) may lead to access to critical data Critical actions like development tasks are executed in the managed systems ( source systems ) 2013 SAP AG. All rights reserved. Customer 4

5 CDC workflow and authorization overview Define Comparison The authorization to create and change comparisons is checked in SAP Solution manager. The authorization to access local data dictionary is checked in the managed system or remote database. Generate Coding Transport Coding The authorization to start the generation is checked in the SAP Solution Manager. The developer authorization is checked in the managed development SAP system. Standard transport mechanism in SAP ABAP-based systems Only relevant for source type ABAP, which needs a generation of specific extractor coding Execute Comparison The authorization to execute this comparison is checked in SAP Solution Manager. The managed SAP system checks whether the source tables can be displayed by the RFC-user. Remote database connection is checked in SAP Solution Manager. Display Comparison Results The authorization to display the comparison result is checked in SAP Solution Manager. Change Comparison The authorization to redefine a comparison is checked in SAP Solution Manager SAP AG. All rights reserved. Customer 5

6 Authorization Objects and Roles Required on SAP Solution Manager to use the CDC Application

7 Terminology of CDC in Solution Manager systems 7.1 and 7.2 With the introduction of the new streamlined CDC user interface in Solution Manager 7.2, there was also a slight terminology change: Purpose Terminology in 7.1 Terminology in 7.2 Authorization object Technical Data Model and fixed filters of a Comparison ( design-time settings ) Connection parameters and variable filters of a Comparison ( run-time settings ) Comparison Object Data Model SM_CDC_OBJ Comparison Instance Comparison SM_CDC_INS This presentation is valid for both Solution Manager 7.1 and Solution Manager 7.2. The explained authorization objects are identical to guarantee a smooth upgrade without the need of changing the authorization concept. However, in 7.2 you should note that the maintenance of the Data Model and the Comparison happens on one screen. So for most user interactions you need authorizations for both authorization objects (at least display authorization). This is how also the standard template roles are designed SAP AG. All rights reserved. Customer 7

8 Authorization Object for Comparison Object Maintenance (7.1) Authorization Object for Data Model Maintenance (7.2) Authorization Object SM_CDC_OBJ Restriction to specific Comparison Object / Data Model names via authorization field CDC_OBJ_N Restriction to certain Source Types via authorization field CDC_S_TYPE Restriction to certain Connections via authorization field CDC_CONN Restriction to selected Activities via authorization field ACTVT 01 Creation of a new Comparison Object / Data Model 02 Change of an existing Comparison Object / Data Model 03 Display of a Comparison Object / Data Model 06 Deletion of a Comparison Object / Data Model 07 Generation of extractors, e.g. ABAP function modules 36 Creation of a Comparison (Instance) for a given Comparison Object / Data Model 2013 SAP AG. All rights reserved. Customer 8

9 Authorization Object for Comparison Instance Maintenance (7.1) Authorization Object for Comparison Maintenance (7.2) Authorization Object SM_CDC_INS Restriction to specific Comparison Instances / Comparison names via authorization field CDC_INST Restriction to certain Source Types via authorization field CDC_S_TYPE Restriction to certain Connections via authorization field CDC_CONN Restriction to selected Activities via authorization field ACTVT 01 Creation of a new Comparison (Instance) 02 Change of an existing Comparison (Instance) 03 Display of a Comparison (Instance) 06 Deletion of a Comparison (Instance) 16 Execution of a Comparison (Instance) = Comparison Run 35 Display results of a Comparison Run 65 Reorganize old results of Comparison Runs 2013 SAP AG. All rights reserved. Customer 9

10 Old template roles for CDC in Solution Manager systems earlier than 7.1 SPS9 Template role SAP_CDC_ADMIN Full authorization for creation and execution of Comparison Objects and Comparison Instances Template role SAP_CDC_DISPLAY For display users, all display authorizations, but no modelling and execution 2013 SAP AG. All rights reserved. Customer 10

11 New template roles for CDC starting with Solution Manager 7.1 SPS9 and in Solution Manager 7.2 Template role SAP_CDC_OBJECT_MODELER * For developing Comparison Objects / Data Models: The Object Modeler can create/change/delete the data modeling and generation, but is not allowed to create a runnable instance of it Template role SAP_CDC_INSTANCE_CREATOR * For creating/developing Comparison Instances / Comparisons: The Instance Creator can display and use an existing data model in order to create/change/delete comparisons, but cannot change the data model itself Template role SAP_CDC_INSTANCE_EXECUTER The Instance Executer can execute and reorganize the comparison run, but can neither output the result, nor change the comparison and its data model Template role SAP_CDC_INSTANCE_ANALYZER The Instance Analyzer can output the result (business data), but cannot execute the run himself, nor change the comparison and its data model * In 7.2, a user typically has a combination of the two roles SAP_CDC_OBJECT_MODELER and SAP_CDC_INSTANCE_CREATOR 2013 SAP AG. All rights reserved. Customer 11

12 Further Authorizations Authorizations depending on the used Source Types (=access techniques to the source systems) Some may be needed on SAP Solution Manager itself Some may be needed on the individual source system

13 Special Authorizations Source Type ABAP (using generated extractor function modules) During definition of Comparison Objects / Data Models On SAP Solution Manager Read RFC Connection to managed development system (with background user), for dictionary access Trusted RFC Connection to managed development system (with dialog user), for extractor generation On managed system Authorization object S_DEVELOP (to create new function modules) Authorization object S_RFCACL (to use the trusted connection) Authorization object S_RFC (to execute function modules remotely) Function group SEUF for function module RS_FUNCTIONMODULE_INSERT Function group SUNI for function modules FUNCTION_EXISTS and RS_FUNCTION_POOL_INSERT Function group OXT_GENERIC_SERVICES for function module OXT_CHECK_DEVCLASS Function group SDTB for function module DD_TABL_GET Function group SDTX for function module RFC_READ_TABLE Function group SRFC for function module RFC_PING 2013 SAP AG. All rights reserved. Customer 13

14 Special Authorizations Source Type ABAP (using generated extractor function modules) During execution of Comparison Runs On SAP Solution Manager Read RFC Connection to managed system, for data extraction (typically from the production system) On managed system Authorization object S_TCODE for transaction SE16 Authorization object S_TABU_DIS (for the table groups to be extracted) starting with Solution Manager 7.1 SPS9 also S_TABU_NAM is supported for details on these two authorization objects see SAP Note Authorization object S_RFC for the generated extractor function modules the function group is typically in Z namespace 2013 SAP AG. All rights reserved. Customer 14

15 Special Authorizations Source Type ABDY (using a generic extractor function module) During definition of Comparison Objects / Data Models On SAP Solution Manager Read RFC Connection to managed system, for dictionary access On managed system Authorization object S_RFC (to execute function modules remotely) Function group SUNI for function module FUNCTION_EXISTS Function group SDTB for function module DD_TABL_GET Function group SDTX for function module RFC_READ_TABLE Function group SRFC for function module RFC_PING 2013 SAP AG. All rights reserved. Customer 15

16 Special Authorizations Source Type ABDY (using a generic extractor function module) During execution of Comparison Runs On SAP Solution Manager Read RFC Connection to managed system, for data extraction (typically from the production system) On managed system Authorization object S_TCODE for transaction SE16 Authorization object S_TABU_DIS (for the table groups to be extracted) starting with Solution Manager 7.1 SPS9 also S_TABU_NAM is supported for details on these two authorization objects see SAP Note Authorization object S_RFC for the generic extractor function module /SDF/DCC_CDC_GENERIC_EXTRACTOR delivered by add-on ST-PI 2008_1_700 SP08 (SAPKITLRD8) or as manual down-port with SAP Note SAP AG. All rights reserved. Customer 16

17 Special Authorizations Source Type ADBC (using a remote database connection) Common during definition and execution of Comparisons On SAP Solution Manager Authorization object S_DBCON DBA_DBHOST Name of the DBCON entry for the remote database in transaction DBACOCKPIT DBA_DBSID (not used) DBA_DBUSER (not used) ACTVT Activity SAP AG. All rights reserved. Customer 17

18 Special Authorizations BPMon data collector for automatic monitoring of CDC Comparison Results During background execution of the BPMon data collector On SAP Solution Manager (from BPMon point-of-view, Solution Manager is a managed system here) The background user that is used for the BPMon data collection (e.g. SM_BPMO) needs display-only authorization for the Comparison, which are maintained as filter parameter in the BPMon Setup It is recommended to assign template role SAP_CDC_INSTANCE_ANALYZER For Solution Manager release below 7.1 SP 9, use the older role SAP_CDC_DISPLAY instead During the call of the detail info feature in BPMon alert list to navigate to CDC UI On SAP Solution Manager (from BPMon point-of-view, Solution Manager is a managed system here) The dialog user that is calling the detail info CDC UI needs display-only authorization for the Comparisons and special authorization to view the detailed result data (ACTVT 35 = Output) It is recommended to assign template role SAP_CDC_INSTANCE_ANALYZER For Solution Manager release below 7.1 SP 9, use the older role SAP_CDC_DISPLAY instead The BPMon Framework does it own standard checks before allowing detail info calls Authorization object SM_BPM_DET, which is included in standard role SAP_MANAGED_BPOANA_DIS 2013 SAP AG. All rights reserved. Customer 18

19 Special Authorizations Integration between SLT (LT Replication Server) and CDC RFC User for the direction SLT to Solution Manager (to execute expert functions) On SAP Solution Manager Authorization object S_RFC (to execute function modules remotely): Function group DSWP_CDC_APP for all function modules DSWP_CDC_GET* CDC display authorizations (based on authorization objects SM_CDC_OBJ and SM_CDC_INS): It is recommended to assign template role SAP_CDC_INSTANCE_ANALYZER For Solution Manager release below 7.1 SP 9, use the older role SAP_CDC_DISPLAY instead For the direction Solution Manager to SLT (to execute mass creation of comparison) On SLT system Authorization object S_RFC (to execute function modules remotely): Function group IUUC_REPAIR_API for function modules IUUC_REPL_GET_CONFIGURATIONS and IUUC_REPL_GET_CONFIG_TABLES Function group SUNI for function module FUNCTION_EXISTS Function group SDTX for function module RFC_READ_TABLE 2013 SAP AG. All rights reserved. Customer 19

20 Thank you