Security concerns when upgrading from v.3.1 to v.4.6x

Security concerns when upgrading from v.3.1 to v.4.6x

I am new to SAP applications. We are at v.3.1 I_com and 3.1 H o/s and functionality. Now I would like to upgrade to v. 4.6. I have heard that the security is very different between the two versions, so can you give me some insight into what the differences are and how best I can make the transition without causing much pain for the users? Any suggested reading material would be greatly appreciated.


    Requires Free Membership to View

    Login

    When you register, you will start receiving targeted emails from my award-winning team of editorial writers. Our goal is to keep you informed on the hottest topics and biggest challenges faced by SAP professionals today.

    Hannah Smalltree, Editorial Director

    By submitting your registration information to SearchSAP.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSAP.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Sure, there are two big issues between the two. Technically, 4.6x versions have entirely new table structures and program code around how Roles and associated profiles are created, maintained and assigned. The 4.6x version introduces a menu structure that can be associated with each role, providing the basis for the assigned user's interface when logging in. Additionally, there are now composite roles, and the ability to link file folders, HTML addresses, and a number of other options to the role itself.

Philosophically, most 3.1x implementations did not focus on security, the focus was on implementing SAP and security got in the way. As a result, many implementations did not take advantage of the S_TCODE object that was introduced in version 3.1G. This choice means that many companies are secured using the authorization objects only, rather than identifying specific transactions for each profile. This dilemma creates considerable complications when auditing the system, ensuring appropriate controls and (most of all) upgrading to a 4.x version. Though it is not technically required to have Transaction code based security in versions 4.x, it is strongly recommended and ideal. In future versions of SAP (Portals and New Dimension) the reliance on menu-driven roles and transaction-based security will be paramount.


This was first published in September 2002

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top