14. User Master Records and Buffer

User Master Records

The user master records define the user accounts for enabling access to the system. The user master records contain all the access information needed by the system to validate a user logon and assign users access rights to the system, such as passwords and authorization profiles.

User Buffer

User buffers are special areas (tables) containing all the authorizations for the user. These buffers are specific for individual users, and are actually built when the users log on, based on the authorizations contained in the profiles included in the user master record.

When users try to perform activities in the system, the application programs and transactions are checked against the authorization objects and values contained within the user buffer.

The number of entries in the user buffer can be controlled using the profile parameter auth/number_in_userbuffer.

13. SAP User Must known

SAP User Must known

1.   Remote Support Users : When using the SAP support services, you often need to allow remote access to your system using a user defined at your site. Because you are allowing system access to someone outside of your system, you should take extra precautions to protect this user. We recommend the following:

·                          Define a special user for remote access. Do not use any of the standard users.

·                          Define a procedure for activating and deactivating the user. Activate it only when necessary and deactivate it once the remote session is completed.

·                     Do not disclose this user’s password over the remote session. Send it over a separate channel such as an e-mail or a return telephone call. Change the password once the session is done

2.            EARLYWATCH : EARLYWATCH is created in the client 066 during installation and is used for remote control by SAP and is only set up with some standard authorizations S_TOOLS_EX_A for performance monitoring. The user is to be locked in general, and can be unlocked upon request. Initial password for EARLYWATCH is support.

3.            TMSADM : This ID is automatically created at the set up the change and transport management system in the client 000. The user type is “Communication”, and is utilized for transports by the CTS. TMSADM is assigned to profile S_A.TMSADM assigned that authorizes the use of RFC with display of the development environment as well as access to write to the file system. The standard password for this user directly after the installation is PASSWORD.

4.            SAPCPIC : SAPCPIC is created as a “communication” user at the installation and is mostly used for EDI. The standard profile S_A.CPIC restricts the access to the use of RFC. This user is hard-coded into the function module INIT_START_OF_EXTERNAL_PROGRAM together with a standard password. This needs to be considered in case of password changes for this user.

5.            The standard password for this user directly after the installation is ADMIN.

6.            SAP* in J2EE : The user is established with full authorizations for the administration. With regard to security, the user has no standard password assigned. To utilize this user as emergency user the properties in the UME need to be maintained. Setting the ume.superadmin.activated property to true will activate the use of this user for emergency cases. Setting a password in ume.superadmin.password will then activate the user finally after the restart of the engine. While the user SAP* is in use, all other users will be inactivated during this time. When the system is fixed, the deactivation can be achieved by setting the ume.superadmin.activated property to false.

7.            J2EE_ADMIN : This user is the Java standard user with full administration authorization in this environment. The password is to be assigned during the set up. High complexity is recommended for this password.

8.            J2EE_GUEST : This user is a Java standard user who can be utilized for anonymous access. The user is locked per default. The password is assigned during the installation.

9.            SAPJSF : This user is a standard communication user for LDAP Lightweight Directory Access Protocol data sources.

10.         ADSuser : This standard user is utilized for the communication between Java and ADS Adobe Document Service.

11.         caf_mp_scvuser : This standard user is utilized in the context of the Composite Application Framework (CAF) core transport system and communication with other Java services.

Summary

To summarize, we recommend that you regularly review the following criteria for protecting the standard users:

·      Maintain an overview of the clients that you have and make sure that no unknown clients exist.

·      Make sure that SAP* exists and has been deactivated in all clients.

·      Make sure that the default passwords for SAP*, DDIC, and EARLYWATCH have been changed.

·      Make sure that these users belong to the group SUPER in all clients.

·      Lock the users SAP*, DDIC, EARLYWATCH and your remote support user. Unlock them only when necessary. (Note that it should never be necessary to use SAP*!)

·      Lock DDIC and EARLYWATCH and unlock them only when necessary.

12. Mass user Changes

Mass user Changes SU10

1. Log on to the appropriate SAP system and the client where the user changes are to take place.

2. Go to transaction SU10.

3. On the User Maintenance: Mass Changes Initial Screen screen, you need to select whether you will select users based on Address Data or Authorization Data and click the appropriate button. If you click Address Data, you can find users with any combination of First name, Last name, User ID, Company, City, Building, Room, Extension, Department, and Cost Center. If you opt to use Authorization Data, you can specify a combination of Groups, Reference User, Authorizations, Authorization Objects, and many other fields. For either method, fill in the fields you want to search on in the Users by Complex Selection Criteria screen, and click the Execute button.

4. On the Users by Complex Selection Criteria screen, you can click “on” the users to be changed, or click the Select All button. Once all the users you want to change have been selected, click the Transfer button.

5. Back on the Maintenance: Mass Changes Initial Screen screen, you can select all the users on the screen again by clicking the Select All button or change your mind and make any last minute corrections. Once you have all the users selected that you want to change, click User → Change.

6. On the Mass User Changes screen, scroll through the tabs, changing data and clicking the Add or Remove button for each correction. Please note, each SU10 batch run must use all Adds or all Removes but never a mixture. Do all Adds in one run and then all Removes in another. Once all your changes have been made, click the Save button.

7. On the Mass changes popup, you will see how many users you are about to change. To make the changes, click on Yes.

8. On the Log Display screen, you will see a log of the changes you made. Expand the list to see the transactional details.

9. You may now leave the SU10 transaction.

11. Add Role to User

Add a Role to a User:

1. Log on to the appropriate SAP system and the client where the user needs the role. Go to transaction SU01.

2. On the User Maintenance: Initial Screen screen, type in the user’s name and press Enter to confirm that the user exists.

3. Click the Change button or press Shift+F6.

4. On the Maintain User screen, click on the Roles tab. Fill in the name(s) in the field(s) provided, and when done press Enter.

5. Click the Save button.

6. Go to transaction PFCG, and on the Role Maintenance screen, type in the name of the role to which the users where added and press Enter to confirm exist of the role.

7. Click the Change role little yellow pencil button.

8. On the Change Roles screen, click the User tab. Click on User Comparison and then Complete Comparison. Once the comparision is done, click Save one more time and you are done!

10. Modifying User’s Password

Modifying a User’s Password:

1. Log on to the appropriate SAP system and the client where the user’s password is to be changes.

2. Go to transaction SU01.

3. On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4. On the Change Password popup, enter the new password in both the New password and Repeat password boxes. Click the green √ picture-icon.

5. You will receive a the password was changed message in the status bar at the bottom of the screen. You may now leave the SU01 transaction.

09. Locking a User

Locking a User:

1. Log on to the appropriate SAP system and the client where the user is to be locked.

2. Go to transaction SU01.

3. On the User Maintenance: Initial Screen screen, type in the user’s name and click the lock/unlock picture-icon.

4. On the Lock user popup, click the lock picture-icon.

5. You will receive a User locked message in the status bar at the bottom of the screen. You may now leave transaction SU01.

08. Deleting User

Deleting a User:

1. Log on to the appropriate SAP system and the client where the user is to be deleted.

2. Go to transaction SU01.

3. On the User Maintenance: Initial Screen screen, type in the user’s name and click the trash can picture-icon.

4. On the Delete user popup, click the Yes button.

5. You will receive a User deleted message in the status bar at the bottom of the screen. You may now leave the SU01transaction.