SAP Security Upgrade

http://www.sapbuddy.com
Upgrade Steps

http://www.sapbuddy.com
 Step 1

• If you have not yet used the Profile

Generator or you want to copy all SAP
default values again, use the initial fill
procedure for the customer tables.

http://www.sapbuddy.com
 Step 2

• 2A: Execute the Profile Generator comparison program.

– Compares the new USOBT and USOBX tables with USOBT_C and USOBX_C
• 2B: Add any new transactions/updates to tables USOBX_C and USOBT_C using transaction
SU25..
• 2C: Update the existing roles and flag all roles with new authorization objects.
• 2D: Display all roles for which there are changed transaction codes.

• The authorization checks added in the target release require that tables USOBT_C and USOBX_C
as well as the roles created in the source release be updated to the latest version. Transaction
.SU25. can be used to do this.

http://www.sapbuddy.com
 Step 2A
• This compares the Profile Generator data
from the previous release with the data for
the current release. New default values are
written in the customer tables for the Profile
Generator. You only need to perform a
manual adjustment later (in step 2B) for
transactions in which you changed the
settings for check indicators and field values.
• You can also display a list of the roles to be
checked (step 2C).

http://www.sapbuddy.com
 Step 2B

• If you have made changes to the check

indicators or field values in transaction
.SU24., you can compare these with the
new SAP defaults. You can see the values
delivered by SAP and the values that you
changed next to each other, and can
make an adjustment, if desired. You can
assign the check indicators and field
values by double-clicking the relevant
line.
http://www.sapbuddy.com
 Step 2C

• This step guides you through all the roles

that are affected by newly added
authorization checks and that have to be
changed to correspond. You can jump
directly to role maintenance.
– This changes are not transported automatically
should be transported manually
• Step 2D
• Occasionally, transactions in the SAP system are replaced by one or
more other transactions. In step 2D, you create a list of all roles that
contain transactions that were replaced by other transactions. The old
and new transaction codes are listed.
• If necessary, you can replace the transactions in the roles. It is also
possible to jump directly to role maintenance in this step.

http://www.sapbuddy.com
SAP_ALL & SAP_NEW

http://www.sapbuddy.com
http://www.sapbuddy.com