imp webui_auth_sap crm - how to assign to user id

7/25/2019 IMP WebUI_auth_SAP CRM - How to Assign to User Id

1/10

1/18/2016 PFCG Role creation in SAP CRM

http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/ 1/10

Home About Us SAP TRAINING Authors Become an Author Other SAP Resources Contact


Home SAP Authorizations PFCG Role creation in SAP CRM

PFCG Role creation in S P CRM

19 September 2012 | Davy Pelssers | 20 Comments | SAP Authorizations,

SAP CRM

About time I could free up some time to write a useful article about this topic. I will try to explain

things as good as I can lets see . Who is this article intended for? People that have some or a lot

of experience with SAP Authorizations, but have little to no experience with SAP CRM

Authorizations.

Transaction codes versus External ServicesOk, when I started working in SAP back in 2000 most people (end-users) using SAP were actually

working in SAP using transaction codes. The SAP Authorization concept was based on:

Grouping relevant tasks (performed using transaction codes) and grouping them together in

single authorization roles

Multiple single roles were joined in composite authorization roles

A transaction code was checked on the auth orization object S_TCODE and other authorization

objects allowing to further distinct access based on e.g. document type/material type/sales

org/company code... just to name some well known examples

Typically, in SAP ECC you had (and still have) different transaction codes based on the allowed

activity (create /change/display ) which mostly was translated into a Transaction Short code

,followed by the allowed activity. (e.g. VA01/VA03 /VA03 or XD01/XD02/XD03 )

When I started working with SAP CRM (at that time it was 3.0 and 4.0 release) end-users were still

working with the SAP GUI and therefore evidently also using transaction code based access.

The big difference from an authorization point of view was that SAP CRM did not really know the

concept of separate transaction codes by "allowed activity" as compared to SAP ECC.

Some examples:

The transaction code BP was used to create/change/display any business partner in the system

(ranging from Customers/Employees/Contact persons/..). It was on authorization object level

that we had to make the distinction on the allowed activity.

CRMD_ORDER was used to create/change/display any business transaction (ranging from

activities/leads/opportunities/sales and service order

Search

>

Categories

Geen categorie

SAP CRM

SAP basic knowledge

SAP SD

SAP FICO

SAP HCM

SAP BW/BI

SAP Authorizations

SAP ABAP

SAP BASIS

SAP Career

SAP Workflow

Disclaimer

SAPUNIVERSITY.EU is not affiliated or related to

any division or subsidiary of SAP AG.

SAP, SAP R/3, R/3 software, R/2 software, ABAP/4

programming language, BAPI programming

interface, BWI software, AcceleratedSAP

methodology, and and any other SAP trademarks

are registered trademarks of SAP AG
http://sapuniversity.eu/the-sap-crm-business-role/http://sapuniversity.eu/category/sap-hcm/http://sapuniversity.eu/category/sap-crm/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/the-sap-crm-business-role/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/about-us/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/authors/http://sapuniversity.eu/join-as-an-author/http://sapuniversity.eu/other-sap-resources/http://sapuniversity.eu/contact/http://sapuniversity.eu/http://sapuniversity.eu/about-us/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/authors/http://sapuniversity.eu/join-as-an-author/http://sapuniversity.eu/other-sap-resources/http://-/?-http://sapuniversity.eu/category/sap-workflow/http://sapuniversity.eu/category/sap-career/http://sapuniversity.eu/category/sap-basis/http://sapuniversity.eu/category/sap-abap/http://sapuniversity.eu/category/sap-authorizations/http://sapuniversity.eu/category/sap-bw/http://sapuniversity.eu/category/sap-hcm/http://sapuniversity.eu/category/sap-fico/http://sapuniversity.eu/category/sap-sd/http://sapuniversity.eu/category/sap-basic-knowledge/http://sapuniversity.eu/category/sap-crm/http://sapuniversity.eu/category/geen-categorie/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/wp-content/uploads/2012/09/1.pnghttp://sapuniversity.eu/the-sap-crm-business-role/http://sapuniversity.eu/the-sap-crm-business-role/http://sapuniversity.eu/the-usage-of-the-sap-crm-role-configuration-key-detailed-example/http://sapuniversity.eu/category/sap-crm/http://sapuniversity.eu/category/sap-authorizations/http://sapuniversity.eu/profile/davypelssers/http://sapuniversity.eu/category/sap-authorizations/http://sapuniversity.eu/http://sapuniversity.eu/contact/http://sapuniversity.eu/other-sap-resources/http://sapuniversity.eu/join-as-an-author/http://sapuniversity.eu/authors/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/about-us/http://sapuniversity.eu/http://sapuniversity.eu/contact/http://sapuniversity.eu/other-sap-resources/http://sapuniversity.eu/join-as-an-author/http://sapuniversity.eu/authors/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/about-us/http://sapuniversity.eu/


2/10



The transaction code COMMPR01 was used to create/change/display products within SAP CRM.

In the newer SAP CRM releases, where people work in the WEB UI, they are actually no longer using

transaction codes. Rather the SAP CRM WEBUI makes use of external services of the type

UIU_COMP. In such a case I am referring to end-users (so not the consultants who still use

certain SAPGUI transaction codes from an administration point of view).

Where in the older CRM releases you would typically check SU24 settings (the relationship between

your transaction code and their corresponding authorization objects) you now will use SU24 to

analyse the relationship between an external service and its relevant authorization objects.

Example of SU24 for transaction code BP

Executing this selection shows us:

Example of analysing an external service for the component BP_HEAD_MAIN
http://sapuniversity.eu/wp-content/uploads/2012/09/5.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/4.pnghttp://sapuniversity.eu/logging-into-sap-crm-without-entering-client-and-language/http://sapuniversity.eu/wp-content/uploads/2012/09/3.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/2.png


3/10



Result:

What you see below is that all these external services use a certain naming convention:

How can you add such an external service in a PFCG Role?

Step 1: create a new PFCG role using the transaction code PFCG

Step 2: In the menu tab, click on the button Other.
http://sapuniversity.eu/wp-content/uploads/2012/09/14.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/Naming-convention-External-Services.jpghttp://sapuniversity.eu/wp-content/uploads/2012/09/12.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/11.png


4/10



Step 3: Select Authorization Default Values

for Services.

Select External Service with as

type UIU_COMP.

In the field Service, you now can add the External Service Name, which you also can lookup using

the input help.

Step 4: If we now go to the tabpage Authorizations, we can generate a profile name, and see therelevant authorization objects for this external service (as they are currently maintained within

SU24).
http://sapuniversity.eu/wp-content/uploads/2012/09/17.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/16.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/165.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/15.png


5/10



After manually entering a profile name or generating a default one, and next clicking on the button

Change Auth oriation Data youll see th e following:

The authorization objects automatically addded in the above example are related to Business

Partner Security, as the external service I added is the one used to create new business partners in

the system of the type INDIVIDUAL ACCOUNT.

Clicking on the navigation link "create Individual account" will navigate to the following page:

I wish you all the best and speak to you soon!

By the way - if you like this article, please leave a comment or click on one of the social media

button s it keeps me somehow motivated to share my knowlegde!

cheers

Davy Pelssers

Davy has been working as an SAP Consultant since 2000 and started

working in the SAP IS-U Module , but as of 2002 he has mainly worked as

functional SAP CRM consultant and SAP Authorizations consultant.More about Davy Pelssers

0
http://sapuniversity.eu/profile/davypelssers/http://sapuniversity.eu/wp-content/uploads/2012/09/20.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/19.pnghttp://sapuniversity.eu/wp-content/uploads/2012/09/18.png


6/10



Tweet 6

20 thoughts on PFCG Role creation in SAP CRM

17

Like Share

6 Comments Sort by

Mahaveer Sharma Engineer, IT at Ras Girtas Power Company

nice one.

Like Reply 2 Sep 24, 2012 11:58pm

Praveen Kumar CheenepalliAbu Dhabi, United Arab Emirates

Good Mahaveer, wuld help us to know more in depth..! abt PFCG..!

Like Reply Sep 25, 2012 8:13am

Srinivas Nalabotula Sr Consultant at IBM

it's rally asome..... thank you very much boss.

Like Reply Jan 15, 2013 11:20pm


it's really excellent..... thank you very much boss.

Like Reply Jan 16, 2013 12:52am


hi what about crm mobile security?

pls provide any posts related to crm mobile security&athorizations...


Davy Pelssers Senior SAP Consultant at DASAP consulting

Hi srinivas, so far I have not had the chance to work in the mobile solution, and

as such no experience yet in setting up mobile security... perhaps in a future

some day..



thank you Davy..


Kuntal Panda Kolkata, India

your article is very informative.

Like Reply Feb 4, 2013 10:05pm

Facebook Comments Plugin

Oldest

Add a comment...

By Francis Deveen on 21 September 2012 at 16:20

Great article

Comment

By tription 24 September 2012 at 06:54

nice article.

Comment

By Gaurav on 6 October 2012 at 17:57

CRM Security contents are very limited on web.Its very refreshing to see such

a quality documents and it is a really good initiative .

Comment

By zakster on 14 November 2012 at 23:17

Excellent article! Thank you for taking the time to do this. I have a question

on this article.

In the example you had provided, how did you know the appropriate external

service for the "Individual account"? I'm trying to find the relationship

between the workcenters and their contents and the corresponding external
http://in.linkedin.com/pub/tripti-pandey/15/314/282https://developers.facebook.com/docs/plugins/comments/https://www.facebook.com/kuntal.pandahttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_373069http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_373069http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_373069https://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/davy.pelssershttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_324930https://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/mahaveer.sharma.507https://www.facebook.com/mahaveer.sharma.507https://www.facebook.com/pages/Engineer-IT/208321362584063https://www.facebook.com/pages/Ras-Girtas-Power-Company/416424005117421https://www.facebook.com/pages/Ras-Girtas-Power-Company/416424005117421https://www.facebook.com/plugins/comments.php?api_key=236955776409746&channel_url=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D42%23cb%3Df326f4770%26domain%3Dsapuniversity.eu%26origin%3Dhttp%253A%252F%252Fsapuniversity.eu%252Ff4876160%26relation%3Dparent.parent&href=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F&locale=en_US&numposts=30&sdk=joey&width=630https://www.facebook.com/plugins/comments.php?api_key=236955776409746&channel_url=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D42%23cb%3Df326f4770%26domain%3Dsapuniversity.eu%26origin%3Dhttp%253A%252F%252Fsapuniversity.eu%252Ff4876160%26relation%3Dparent.parent&href=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F&locale=en_US&numposts=30&sdk=joey&width=630http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=45#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=14#respondhttp://in.linkedin.com/pub/tripti-pandey/15/314/282http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=9#respondhttps://developers.facebook.com/docs/plugins/comments/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_373069https://www.facebook.com/pages/Kolkata-India/105803266126801https://www.facebook.com/kuntal.pandahttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_335149https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/pages/DASAP-consulting/105067306199939https://www.facebook.com/pages/Senior-SAP-Consultant/104807146243956https://www.facebook.com/davy.pelssershttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_324930https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/srinivas.nalabotulahttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_324299https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/srinivas.nalabotulahttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_324172https://www.facebook.com/pages/IBM/541610822590143https://www.facebook.com/pages/Sr-Consultant/1409127599358169https://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/pages/Abu-Dhabi-United-Arab-Emirates/115461575134685http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?fb_comment_id=105046832984374_30523https://www.facebook.com/pages/Ras-Girtas-Power-Company/416424005117421https://www.facebook.com/pages/Engineer-IT/208321362584063https://www.facebook.com/mahaveer.sharma.507https://www.facebook.com/kuntal.pandahttps://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/davy.pelssershttps://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/srinivas.nalabotulahttps://www.facebook.com/mahaveer.sharma.507https://www.facebook.com/plugins/comments.php?api_key=236955776409746&channel_url=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D42%23cb%3Df326f4770%26domain%3Dsapuniversity.eu%26origin%3Dhttp%253A%252F%252Fsapuniversity.eu%252Ff4876160%26relation%3Dparent.parent&href=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F&locale=en_US&numposts=30&sdk=joey&width=630https://www.facebook.com/plugins/comments.php?api_key=236955776409746&channel_url=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D42%23cb%3Df326f4770%26domain%3Dsapuniversity.eu%26origin%3Dhttp%253A%252F%252Fsapuniversity.eu%252Ff4876160%26relation%3Dparent.parent&href=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F&locale=en_US&numposts=30&sdk=joey&width=630https://twitter.com/intent/tweet?original_referer=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F&ref_src=twsrc%5Etfw&text=PFCG%20Role%20creation%20in%20SAP%20CRM&tw_p=tweetbutton&url=http%3A%2F%2Fsapuniversity.eu%2Fpfcg-rolecreation-in-sap-crm%2F


7/10



services so I can look the security needed for that screen in SU24.

Keep up the good work!

Zack

Comment

By Davy Pelsserson 14 November 2012 at 23:55

Hi Zack

I basically use several options for this purpose.

Either I am quickly able to identify the relevant component using amethod explained in a previous post:

http://sapuniversity.eu/how-to-get-the-technical-information-for-a-

screen-view/

OR I can use ST01 authorization tracing!

Also have a look at my latests post about:

identifying the UIU_COMP values for workcenters and navigation links...

they are basically very useful for this purpose too!

you will see that with those queries I can easily find out for example the

relevant Component Name WindowName & Inbound Plug for a specific

workcenter defined within the navigation bar profile assigned to my

business role. Now as you saw in THIS post, the external service naming

convention is actually composed of these 3 elements.... so this should get

you started

cheers

Davy

Comment

By Revanth on 17 December 2012 at 11:42

Nice article..

Can we have the authorization related to territory for the user to restrict on

master data.

If so can you please send me the article it to my mail Id.

Comment

By Davy Pelsserson 17 December 2012 at 13:33

Hi, I have not elaborated any article on Territory management so far.

But here is what you should be able to do with it (regarding Account

authorizations):

Territory based authorizations can be turned on / off in business

transactions such

as opportunities, sales orders etc.

*Territory based authorizations can be defined at the header level of a

document

as well as at the item level

*Territory based authorizations help you

Ensure that the employee responsible of the document is also assigned to

the territory

of the document

Ensure that the account assigned to a document is also assigned to the

territory of the

document

Ensure that the product assigned to a document is also assigned to the

territory of the

document

*The level of access to the data can be also restricted used on Territory

based

authorizations. A user may be given access to only his data, or his data

and his

teams data or to everything-------------------------------------------

Accounts in Territory Management

* Authorizations to define what accounts are available for use in business

transactions using

the value help.

*Depending on Customizing maintained for a particular business
http://www.dasap.be/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=846#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=264#respondhttp://sapuniversity.eu/how-to-get-the-technical-information-for-a-screen-view/http://www.dasap.be/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=263#respond


8/10



document, the value help for

accounts in the business transactions is enhanced, so that the territory

ID is already pre-filled

while doing the accounts search. Hence, the result list is already filtered

and only contains

those accounts which belong to a user as per his/her territory

assignments.

* Depending on the users role, the user is able to search for My

Accounts, My Teams

Accounts, All Accounts while creating business transactions.

* If the user enters an account manually by deleting the defaulted value

help while creating a

business document, an authorization check shall be performed so that a

user can only use

those accounts during document creation which belong to a territory that

is being associated

with that business document.

Comment

By Help on 5 January 2013 at 22:04

Hi Davy - I have a question. So for CRM security with respect to PFCG roles is

it always the role that is tied to a Business role or do we create separate PFCG

roles also? If so can you let us know how would the reqirements be for

building a private PFCG role?

Comment

By Davy Pelsserson 6 January 2013 at 17:46

Hi,

Usually you start creating the 1 single authorization role based on the

configured business role as mentioned in the article above. I personally

then start splitting this large role up into multiple single roles , especially

with regards to business transaction processing, and business partner

access.

Basically I normally do NOT work with such 1 large single role as it gives

me no flexibility or efficient manner to give different authorizations to

different users. So when I mention splitting things up, I mean deleting

external services from this large role and putting them in separate new

single roles.

I next start creating an authorization matrix based on the authorization

requirements I received during the blueprint phase or implementation

phase.

Comment

By Alex Z on 22 March 2013 at 11:17

Very good post Davy!

Thank you

Comment

By vijay on 11 April 2013 at 13:15

Nice article

Comment

By Ann W on 15 April 2013 at 18:29

Very helpful article, Thank You!

Comment

By Arunkumar on 9 May 2013 at 11:46

Very good article . Thanks..

Comment
http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=8376#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=6419#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=6101#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=4968#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=1246#respondhttp://www.dasap.be/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=1232#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=849#respond


9/10



Leave a Reply

Comment

By Kiryl on 21 May 2013 at 13:06

Davy, you are born teacher, thank you so much!

Your materials are easy to read and full of useful information.

Comment

By Anurag Jain on 31 May 2013 at 14:39

Very Informative Post. I have not found this information on any other place.

KEEP UP THE GOOD WORK!!!

Comment

By learning with fun and news pics on 21 June 2013 at16:40

Great web site. Lots of helpful information here. I am sending it to several

pals ans also sharing in delicious. And obviously, thanks for your effort!

Comment

By ajay on 22 August 2013 at 16:04

Hi Davy,

Thank you so much for sharing valuable information..and i have one doubt in

SAP CRM Security..

Why we need to deactivate S_SERVICE object in CRM roles..what impact if we

do not deactivate this object in CRM Roles..

Thanks In Advance..

Comment

By Davy Pelsserson 1 September 2013 at 11:15

Hi Ajay,

the reason that you need to deactivate this object is because it:

- is no longer used (was initially used by SAP..but obsolete at this

moment)

- check on OSS for the object S_SERVICE and you will find a note about

this!

- you can not generate the pfcg role without deactivating the object due

to too many entries

cheers

Davy

Comment

By Davy Pelsserson 9 January 2014 at 13:23

Hi, for your information, the OSS notes I was talking about is thefollowing:

1106781 - PFCG profile not generated because of S_SERVICE auth.

object

Comment

By pannag bhusan kanungo on 17 July 2014 at 05:53

Mr Davy your all articles are awesome . thank you

Comment
http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=95132#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=37920#respondhttp://www.dasap.be/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=13123#respondhttp://www.dasap.be/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=12719#respondhttp://sapuniversity.eu/the-sap-crm-business-role/http://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=10596#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=9751#respondhttp://sapuniversity.eu/pfcg-rolecreation-in-sap-crm/?replytocom=9136#respond


10/10


h // i i / f l i i / 10/10

Name *

Email *

Post Comment

http://sapuniversity.eu/contact/http://sapuniversity.eu/other-sap-resources/http://sapuniversity.eu/join-as-an-author/http://sapuniversity.eu/authors/http://sapuniversity.eu/sap-training/http://sapuniversity.eu/about-us/http://sapuniversity.eu/

imp webui_auth_sap crm - how to assign to user id

Documents