Chapter 18. Security Concepts in SAP R3 Query-Based Reporting Tools
Chapter 18. Security Concepts in SAP R/3 Query-Based Reporting ToolsIn this chapter
This chapter addresses how you can configure the SAP environment to permit varying levels of use of the SAP Query tools to users. It does not have to do with what a person can see when executing a SAP query. Recall from Chapter 2, "One-Time Configuration for Query Tool Use," that SAP standard logical databases are used whenever InfoSets are created. As noted in Chapter 2, you should always use logical databases as the data source within InfoSets that are used for query-based reporting. Using a logical database as your data source guarantees that the SAP solution is smart enough to know which areas of the data a user is allowed to see so that only the appropriate data will show in an SAP query report. Regardless of what type of security access the person who created the report has, the system is smart enough to display only the appropriate data for the user executing the report. (Note that this is the case only when logical databases are used as the data source if a SAP query is created using an InfoSet that is based on anything other than a logical database (for example, a table, a table join, a program). It is fair to say that no security whatsoever is in place when the query is run because all records within the tables are displayed in the report output.) Note Dedicated professionals in each organization are responsible for security. It is recommended that the security decisions, configuration, and administration described in this chapter be performed by those dedicated security professionals. The basics of how security works for SAP queries are described here so that you have a full picture of the reporting solution. I recommend that you follow your company's established guidelines for modifying security roles and that you make the information in this chapter available to your designated security professionals. A system administrator can control access rights to the InfoSet (Ad Hoc) Query tool by using roles or query groups. Exactly one SAP query group must be assigned to a role (an InfoSet must be associated with the query group), although the user does not need to be listed in the query group. If users want to save their reports, they need authorization object S_QUERY, field ACTVT, value 02; otherwise, they can only create and execute reports. |
