SAP Security Upgade document

SAP security upgrade

Pre-Steps in SAP security upgrade:

1.       You must verify that the SU25 step 1 has been executed correctly in the Development system. This should have been done during the installation and should not be performed again unless you want to wipe out all your SU24 changes.

2.       You must compare your SU24 settings between DEV, QAS and PRD because sometimes these might not have been transported or the target systems were open(ed) and changed there.

3.        You should also verify whether any data was changed in SU22 (never change SU22!)

4.       Before starting to upgrade roles which you do not use, you can consider deleting the obsolete ones. You must prior check whether the role is not assigned to ANY USER in ANY CLIENT of the transport domain otherwise the import events will not allow it's deletion. There is currently only the possibility to delete roles manually in the system and you must remember to capture them in a transport before hand. For information about mass deletion of roles (please be carefull!) and generally about transporting roles see SAP note 313587 and 571276.

After the upgrade:

1.Remember to transport all your SU24 changes through to PRD. This is necessary incase you do need to or accidentally do open a role in QAS or PRD and want the proposals to be the same and is necessary for the "No check" indicators otherwise the systems would behave differently for the same roles.

2. After the upgrade steps are completed, it is advisable to verify in transaction SUPC that all the roles have current generated profiles.

SAP Security related activities in Upgrade

The SAP system profile parameter auth/no_check_in_some_cases has the value
“Y”. If the profile parameter is set to .N, the value must be changed. (This ensures better security).

If roles were already used in the source release, they must be updated. Transactions that were selected in the menu of existing roles can be protected using additional authorization objects in the target release. This means that tables USOBT_C and USOBX_C have to be updated as well as the existing roles.

The SU25 tcode is used for to fill the customer tables of the profile generator the first time the profile generator is used, or update the customer tables after an upgrade.

1. Transaction -SU25

                                  1.  Initially Fill the Customer Tables  

            The first step is only required if you have a fresh installation and are using the profile generator

for the first time, or if you want to refill the tables.

2.  A. Preparation: Compare with SAP values

Step 2A

Compares the new USOBT and USOBX tables with USOBT_C and USOBX_C.
This compares the Profile Generator data from the previous release with the data for the current release. New default values are written in the customer tables for the Profile Generator

Step 2B
Add any new transactions/updates to tables USOBX_C and USOBT_C.

If you have made changes to the check indicators or field values in transaction
SU24, you can compare these with the new SAP defaults. You can see the values delivered by SAP and the values that you changed next to each other, and can make an adjustment, if desired.

Hint:
Steps 2A and 2B make changes to the customer tables of the Profile Generator.
If you want to transport these changes, choose step 3 in transaction .SU25. Before implementing any changes in system, take corresponding business approval for all role changes. The step 2C and 2D step will clearly identify the roles affected and new tcodes introduced in new systems.

Step 2C
This step guides you through all the roles that are affected by newly added authorization checks and that have to be changed to correspond. The corresponding authorization profiles need to be edited and regenerated. You can jump directly to role maintenance.

SU25, 2C step also contains the new SAP roles introduced.

If you go to one by one role, there are some authorization objects that are got affected during upgrade. We can categorize these authorization objects as below:-

1. Standard New – These are new authorization objects that are introduced in new system for corresponding tcode.

2. Manually new - It shows the authorization objects which were manually added in old system. Some of the values got updated for this also.
3. Standard Updated - Updated means, in old system if you have kept the standard values as it is, SAP has updated these standard values (u can check this one in SU24 check indicators).
4. Maintained New- Some of the organizational values introduced as field in authorization object.

After maintaining all new authorization objects, you can save it and generate the profile. If you get back to SU25 2C step shows all the roles with green signal. Means all roles saved and generated.

Step 2C

step also contains the new SAP roles introduced.
After generating all profiles in SU25 2C step, you can jump to 2D step.

Step 2D
If you execute this step, it will show the list of roles and old tcode and corresponding new tcode.
If business wants to use new tcode, then u can replace old tcodes by new one by clicking on automatically adjust menu. Otherwise go to manually adjust menu and generate the profile.
The new tcodes are introduced in 2D step, this doesn't means the old tcodes are no longer exists in new system. We have to check manually for each and every tcode.Some tcode does not exists in new systems. FOr e.g. RZ02 is replaced by RZ20 in ECC6. RZ02 no longer exists in ECC6.

STEP 3
This step transports the changes made in steps 1, 2a, and 2b. Tailoring the Authorization Checks .This area is used to make changes to the authorization checks.

STEP 4
Changes to the check indicators are made in step 4. You can also go to step 4 by calling transaction-SU24.

You can then change an authorization check within a transaction.
1. When a profile to grant the user authorization to execute transaction is generated, the authorizations are only added the Profile Generator when the check indicator is set to Check/Maintain.
2. If the check indicator is set to do not check, the system does not check the authorization object of the relevant transaction.

4.  Check Indicator (Transaction SU24) 

This Step is optional and relates to step 2.B

5.  Deactivate Authorization Object Globally 

AUTH_SWITCH_OBJECTS that allows you to switch off authorization objects for checks globally. 

6.  Copy Data from Old Profiles  

This step is only required if you actually are using the PFCG and roles for the first time. This

step will support you to convert your formerly used profiles into roles in different steps.  

SAP Security Interview Questions Part-4

1. The parameter login/password_max_idle work on all user types (Dialog, System,)?

ANS:

The parameter applies only to dialog accounts. 

2. Recovering the SAP user ID which is deleted in production client?

ANS:

A: 1.Go to SUIM .click Change document > for users > type the user name which u deleted .it will give the deleted user name with profiles

A.2.Goto SE83 or SA38 type RSUSR100 Execute

3.  How to find the role which is assigned for a deleted user?

ANS:

Goto SE83 or SA38 type RSUSR100 Execute

In this log u come to know what are the profiles add to the user .so u can add the same roles using this logs

4. I want to see list of roles assigned to 10 different users. How do you do it?

ANS

. In case of CUA, Goto table USLA04, type in the name of

Users, you will get the roles assigned to user in parent

As well as in child system

5. What is the correct procedure for Mass Generation of Roles?

ANS:

1. Tcode SPUC is for mass generation of roles.

                2. Program SAPPROFC_NEW

                3. PFCG > Utilities > Mass Generation

SAP Security Interview Questions Part-3

1. How do I restrict SAP HR Security won't allow users to update their own SAP HR data?

ANS:

Use the security object P_PERNR. the first field in this object is for authorization level, R, E, W, S, second field is for infotype, the PSIGN field means this...E = everyone else but self, I = self

2. How I can get all user info in PRD with Tcodes assignment?

ANS:

1. Copy the data extract of agr_users to excel.

2. Then in table agr_1251 give the entire list of roles as in step 1 along with S_tcode object...copy the results to excel...

3. You can combine both the data using lookup to obtain the desired combinations

3. Please let me know how we can delete roles from the list of users at once. Different set of roles are assigned to users 

ANS:

1) Open each role in transaction PFCG and remove the users from the Users tab.
2) Remove the roles from multiple users in transaction SU10.
3) Remove the roles individually from each user using transaction SU01.
4) Create a CATT script and run it using transaction SCAT. 

4. Maximum No. Of SAP Session per User

ANS:

rdisp/max_alt_modes 

You can use this parameter to restrict the max no of external sessions a user is allowed to open in one logon. This is Dynamic parameter so u can change in RZ11

5. See from which network IP address and host name a user has logged on

ANS:  Call transaction OS01,

Click "Presentation Server" button, "Change View" button. 

If you are using Citrix, you will not be able to view the user individual IP address as it will be the same Citrix IP address.

To check the speed and quality of the user's network connection,

Select the desired presentation server and click "10 X Ping" button.

SAP Security Interview Questions Part-2

1.     User is Still Locked in SU01

ANS: If you are trying to unlock a user in transaction code SU01 but the system persist to say that the user is still locked. It’s because the SAP system is maintained by the Central User Administration (CUA).

2.     While Creating BW roles what are the Authorization Objects we will use.

Ans:

1.      S_RS_COMP - used to restrict users to create queries only in their application areas or only for their own info cubes.

2.      S_RS_COMP1 - authorization object restricts queries to specific owners. This can be used to restrict which queries can be reviewed by a query owner based on the correct application area.

3.      S_RS_FOLD - Disable/Enable the 'Info Areas' button.

3.   When we changed the password for more users (for example: 100 users) where the password will be stored or from where you can Re-Collect the password and how will you Communicate the password to all users at a time.

Ans:

     Go to SE16>type>       USH02 change history of logon data

4.      What is Virsa? Once you entered in to the screen what it will perform.

Ans:

Virsa tool is accrued by SAP. It’s an ABAP based tool it has

               1) Access controls, 2) Process Controls.

               It Has 4 Sections to Audit the system.

1. Compliance Calibrator

2. Role Expert 

3. Firefighter 

4. Access enforcer.

5.     Can we add one Composite role in to another Composite role at any urgent user requests or in normal user requests?

ANS: NO not possible

SAP Security Interview Questions Part-1

1.     . What is the difference b/w change authorization mode and expert mode of Change authorization ?

ANS:

Change authorization: This option we will use when we create new role and modify old role

Expert mode: i. Delete and recreate authorizations and profile

(All authorizations are recreated. Values which had previously been maintained, changed or entered manually are lost. Only the maintained values for organizational levels remain.)

                           ii. Edit old status

(The last saved authorization data for the role is displayed. This is not useful, if transactions in the role menu have been changed.)

                           iii. Read old data and merge with new data

(If any changes happen in SU24 Authorizations we have to use this)

 

2.     When we do the user comparison in pfcg what is the difference in complete comparison and expert mode comparison.

ANS:

(Then main purpose of user comparison is when we assign role to the        user it will apply only after user comparison only. If we don’t do user comparison user cont access the assigned role?)

There are three ways to do user comparison

1. PFCG –User tab

2. PFUD T-code

3. PFCG_time_dependency in background mode

Also we can set automatic user comparison by            . ...........4.PFCG>utilities>settings> automatic user comparison

Select the option ‘Automatic User Compare…’

3.      What are the critical authorization objects in security point of view?

ANS:

i.                    S_USER_OBJ-        Globally deactivate auth.Objects

ii.                 S_TABU_DIS-        Table maintains (field-DICBERCLS)

iii.               S_TABU_CLI          Cross-client Table.M(Field-CLIDMAINDT)

iv.               S_USER_GRP         User Group maintains

v.                 S_USER_AUT         Auth Maintenance

vi.               S_USER_PRO         Auth profile maintains

vii.            S_USER_TCD         Transactions in roles

viii.          S_DEVELOP           ABAP/4 Development Workbench objects

ix.                  S_PROGRAM        Authorization to execute ABAP programs

x.                    S_TRANSPRT       Define transport requests

xi.               S_SPO_AUTH         Auth to perform actions on spool requests protected

4.     When we do the transportation of composite role what will happen.

ANS:

 While doing Transport of composite role associate (single role) roles also transport

5.     How to get the E-Mail address for 100 users at a time.

Ans:

USR21 with ADR6