Sap Security Authorization

SAP Security & Authorization

Related Skills

• sap-s4hana-extensibility — Extension authorization patterns
• sap-build-process-automation — Approval workflow design
• sap-rap-comprehensive — RAP authorization (global/instance)
• sap-cap-advanced — CAP-level auth with XSUAA/IAS scopes
• sap-kyma-runtime — Kubernetes API Rule JWT validation
• sap-successfactors — RBP (Role-Based Permissions) model

Quick Start

Authorization error? Start here:

1. Run SU53 (or for another user: SU53 → Other User)
2. Check which authorization object failed and what values were needed
3. If SU53 is not enough, use STAUTHTRACE for full trace (captures all checks, not just failures)

Design a role:

1. SU24 — Check authorization defaults for the transaction
2. PFCG — Create single role, add transactions to menu
3. Generate profile → Adjust authorization values → Save
4. Create derived roles for org-level variations (company code, plant)
5. Assign role to user via SU01

BTP authorization:

1. Define scopes and role-templates in xs-security.json
2. Create role collections in BTP cockpit
3. Assign role collections to users/groups

Core Concepts

On-Premise Authorization Hierarchy

User (SU01)
  └── Role (PFCG)
        └── Profile (auto-generated)
              └── Authorization Object
                    └── Field = Value

Role Types

Naming convention: Z_<MODULE>_<FUNCTION>_<TYPE> (e.g., Z_FI_AP_CLERK_S, _C for composite, _D for derived)

Critical Authorization Objects

BTP Authorization Model (XSUAA)

User/Group
  └── Role Collection
        └── Role
              └── Role Template
                    └── Scope ($XSAPPNAME.Read, $XSAPPNAME.Admin)

xs-security.json example:

{
  "xsappname": "myapp",
  "tenant-mode": "dedicated",
  "scopes": [
    { "name": "$XSAPPNAME.Read", "description": "Read access" },
    { "name": "$XSAPPNAME.Admin", "description": "Admin access" }
  ],
  "role-templates": [
    { "name": "Viewer", "scope-references": ["$XSAPPNAME.Read"] },
    { "name": "Administrator", "scope-references": ["$XSAPPNAME.Read", "$XSAPPNAME.Admin"] }
  ]
}

S/4HANA Cloud Authorization

On-premise PFCG roles are replaced by:

• Business Catalogs — Grouped app authorizations
• Business Roles — Assign catalogs + restriction types to users
• Restriction Types — Read/Write/Value Help access control (replaces org-level values)
• Maintain Business Roles Fiori app (replaces PFCG)

Common Patterns

Pattern 1: SU53 Error Analysis

1. User gets "No authorization" error
2. User runs SU53 immediately
3. SU53 shows:
   - Authorization Object: S_TCODE
   - Field: TCD
   - Required: ME21N
   - User has: ME23N, ME22N (missing ME21N)
4. Fix: Add ME21N to user's role in PFCG

For complex cases, use STAUTHTRACE:

1. STAUTHTRACE → Activate (filter: specific user, errors only)
2. User reproduces the action
3. STAUTHTRACE → Deactivate → Evaluate
4. Shows ALL auth checks with RC=0 (pass) and RC≠0 (fail)

Pattern 2: SoD Conflict Detection

Classic SoD conflicts to check:

Pattern 3: Security Audit Log Configuration

Transaction: RSAU_CONFIG (or SM19 on older systems)

Recommended filters (Dynamic Configuration):
1. Client: *, User: SAP* → Record ALL events (default user monitoring)
2. Client: *, User: FF_* → Record ALL events (firefighter monitoring)
3. Client: *, User: * → Record:
   - Dialog logon (successful + failed)
   - RFC/CPIC logon (successful + failed)
   - Transaction starts
   - Report starts
   - User master changes

Analysis: RSAU_READ_LOG (or SM20)
Enable: Set profile parameter rsau/enable = 1

Pattern 4: BTP Principal Propagation

User → IAS (authentication)
     → BTP Subaccount (SAML trust)
     → XSUAA (JWT token)
     → Destination (OAuth2SAMLBearerAssertion)
     → S/4HANA (API call with user identity)

Destination config:
- Type: HTTP
- Authentication: OAuth2SAMLBearerAssertion
- Token Service URL: <S4HANA>/sap/bc/sec/oauth2/token
- Audience: S/4HANA SAML provider name

Pattern 5: GDPR — ILM Data Blocking

1. IRM_CUST → Define retention rules per data object and legal entity
2. Configure residence/retention periods (aligned with local tax law)
3. Set up blocking policies (simplified blocking restricts read access)
4. Schedule destruction jobs (permanent erasure after retention expiry)
5. Implement Information Retrieval for data subject access requests

Key transactions: IRM_CUST, IRMPOL, ILM_DESTRUCTION, SARA

Error Catalog

Performance Tips

• Use SUIM reports for bulk authorization analysis (faster than manual SU01 checks)
• STAUTHTRACE with "errors only" filter reduces trace volume significantly
• Keep roles modular (5-15 auth objects per single role); composite roles combine them
• In BTP, minimize scope count per role template — JWT token size has limits
• Schedule RSUSR200 as background job for monthly dormant user detection

Key Tables

Bundled Resources

Gotchas

• SAP_ALL is not a role: SAP_ALL is a profile that grants all authorizations — never assign it to dialog users; use only for emergency/firefighter with full logging
• SU53 timing: SU53 shows the LAST failed authorization check only — if multiple checks fail, you may see a misleading result; run a full trace via ST01 instead
• Derived roles and org levels: Org-level values in derived roles override master role values completely — no merge; plan org structure before role design
• XSUAA vs. IAS: XSUAA handles application-level auth on BTP; IAS handles identity/SSO — they complement, don't replace each other
• Role transport: Roles transported via SCC1/STMS carry authorizations but NOT user assignments — reassign users in target system
• SoD is continuous: SoD analysis is not one-time; new role assignments can introduce conflicts — schedule periodic GRC Access Risk Analysis
• PFCG generated profiles: After changing a role in PFCG, you MUST generate the profile AND assign it to users for changes to take effect

Source Documentation

• SAP Help: Authorization Concept
• SAP Help: XSUAA Configuration
• SAP Cloud Identity Services
• SAP Help: ILM for GDPR
• SAP GRC Access Control