Use Cases for SAP Profile Generator (PFCG): 1. PFCG role is a collection of T-codes and their associated activities or authorization objects. 2. It enables SAP security administrators to create roles for users according to their roles and responsibilities in the organization. 3. It provides a graphical interface which enables the security administrators to view and assign authorizations to roles. 4. It is a front end transaction to assign authorizations to roles in the schema using authorization objects. 5. It helps in creating a single test environment with the help of roles. 6. In addition, the profiles generated by PFCG are used to generate and reset SICF services.
PFCG — Meta Data
| Description: | Role Maintenance |
| Main Category: | Basis |
| Sub Category: | ABAP Authorization and Role Management |
TCodes related to PFCG
| TCODE | Description | Application |
|---|---|---|
| SU01 | User Maintenance | Basis - User and Authorization Management |
| SU24 | Maintain Authorization Defaults | Basis - ABAP Authorization and Role Management |
| SUIM | User Information System | Basis - User Information System |
| SM59 | RFC Destinations (Display/Maintain) | Basis - RFC |
| SM30 | Call View Maintenance | Basis - Table Maintenance Tool |
| SU53 | Evaluate Authorization Check | Basis - User and Authorization Management |
| PFUD | User Master Data Reconciliation | Basis - ABAP Authorization and Role Management |
| SU25 | Upgrade Tool for Profile Generator | Basis - ABAP Authorization and Role Management |
| SE80 | Object Navigator | Basis - Repository Browser |
| SU10 | User Mass Maintenance | Basis - User and Authorization Management |
| SE16 | Data Browser | Basis - Workbench Utilities |
Tables related to PFCG
Authorization Objects related to PFCG
| AUTHORIZATION OBJECT | Description | Application |
|---|---|---|
| S_TCODE | Transaction Code Check at Transaction Start | |
| S_RFC | Authorization Check for RFC Access | |
| S_DEVELOP | ABAP Workbench | |
| S_USER_AGR | Authorizations: Role Check | |
| S_TABU_DIS | Table Maintenance (via standard tools such as SM30) | |
| S_USER_GRP | User Master Maintenance: User Groups | |
| S_USER_PRO | User Master Maintenance: Authorization Profile | |
| S_USER_TCD | Authorizations: Transactions in Roles | |
| S_USER_VAL | Authorizations: Field Values in Roles | |
| S_RS_COMP | Business Explorer - Components | |
| P_ORGIN | HR: Master Data | |
| S_SERVICE | Check at Start of External Services |
ABAP FMs related to PFCG
ABAP Reports related to PFCG
BW Datasources related to PFCG
| BW DATASOURCE | Description | Application |
|---|---|---|
| 0TCTUSERNM | BW Metadata: User | - |
| 0CO_OM_NWA_1 | Network Activity: Costs | CO - Overhead Projects |
| 0CO_OM_NWA_2 | Delta extraction: Netw. Activity Actual Costs | CO - Overhead Projects |
| 2LIS_11_VAITM | Sales Document Item Data | SD - Sales and Distribution |
| 2LIS_02_HDR | Purchasing Data (Header Level) | MM - Materials Management |
| 0FI_AP_4 | Vendors: Line Items with Delta Extrcation | FI - Accounts Payable |
| 0TCTAUTH | Authorization (Technical Name) | - |
| 0TCTIFCUBE | BW Metadata: InfoCube | - |
| 2LIS_11_VAHDR | Sales Document Header Data | SD - Sales and Distribution |
| 2LIS_11_VASCL | Sales Document Schedule Line | SD - Sales and Distribution |
| 0TCTIFAREA | BW Metadata: InfoArea | - |
| 0TCTQUERY | BW Metadata: Query and Query Elements | - |
Errors related to PFCG
| ERROR | Description |
|---|---|
| RFC_NO_AUTHORITY | &INCLUDE INCL_AUTHORITY_MISSING |
| MESSAGE_TYPE_X | Short text of the error message: |
| OPEN_DATASET_NO_AUTHORITY | &INCLUDE INCL_AUTHORITY_MISSING |
| DYNPRO_SEND_IN_BACKGROUND | Attempt made to send an image to a user during background processing.\n |
| RFC_DEBUGGING_NO_DIALOG_USER | To debug ABAP programs |
| SAPSQL_INVALID_FIELDNAME | An Open SQL clause has been entered dynamically. The field name used |
| UNCAUGHT_EXCEPTION | This exception is closely related to a previous exception &YC |
| SAPSQL_ARRAY_INSERT_DUPREC | When an Open SQL array insert is performed |
| ITS_CANT_LOAD_INCLUDE | Compile time include &P5 could not be included. Check whether the |
| OBJECTS_OBJREF_NOT_ASSIGNED | You are trying to access a component with a 'ZERO' object reference |
| DBIF_RSQL_INVALID_REQUEST | An invalid request was made to the SAP-internal database interface when |
| GETWA_NOT_ASSIGNED | An attempt was made to access a field symbol that has not been assigned |
Messages related to PFCG
| MESSAGE | Description |
|---|---|
| CD119 | &1 Retry RFC call &2 &3 |
| ST400 | User settings saved for user & |
| RSDMD138 | Master data/text of characteristic & already deleted |
| RSAU499 | Error occurred in & for data target & |
| RSAU727 | Routine & |
| BCOS005 | Because of error &1 |
| 5A252 | You have not specified a plan version |
| BUP003 | Internal parameter error in segment &1 |
| CRM_ORDERADM_H012 | Transaction with the transaction number '&1' is not available or archived |
| BC401 | Error in rule structure: Invalid parent rule |
| EYE007 | You do not have sufficient authorization |
| BUP002 | Internal key for segment &1 is not unique |
Table Fields related to PFCG
Glossary/Terms related to PFCG
Authorizations
SCM - Asset Central FoundationThe name of a Fiori App that is used to create authorization groups, and authorize business partners in the authorization group to access your business objects. You can grant read or write access to the business objects within the authorization group.
The right to perform a given activity in the SAP system. Every authorization relates to an authorization object. It defines one or more values for every field contained in the authorization object. Authorizations are grouped into profiles that are entered in the user’s master record. An authorization comprises complete or generic values for the authorization fields of an authorization object. The combination deter mines which activities a user can use to access certain data.
Authorization
CA - SAP Anywhere (CA-ANW)Authority that is given to a role in order to perform an action.
Authorization
OPU - Duet (OPU-DUE)The process of granting a person, computer process, or device access to certain information, services or functionality. The authorization is derived from the identity of the person, computer process, or device requesting access, which is verified through authentication.
Authorization
PLM - PLM Design Collaboration (PLM-DC)The authority of a user to access a system. Authorization is derived from the identity of the person which is verified through authentication.
An affirmative response from the clearing house forwarded to the merchant to permit a card transaction.
Business transaction in the area of simplified customs declarations to request simplifications from a customs authority. For example, authorizations are requested from the German customs authority for the simplified procedure. Customs authorities run periodic checks to ensure that the company has fulfilled all regulatory requirements of the authorization.
Roles
EHS - SAP Carbon ImpactSection of the SAP Carbon Impact application where the administrator can assign specific authorizations to a user and customize a user’s product experience.
Role
BC - Data Control Language (BC-SEC-DCL)A key word of the data control language (DCL), which defines the rules that govern access to Core Data Services (CDS) entities. An administrator can assign roles to users granting access to CDS according to the rules defined within the role and according to the values the administrator set in any access conditions within the rules.
Unit of an AS ABAP authorization concept. Roles control the authorization assignments and - by means of the role-specific user menus - the appearance of the user interface. A role contains transactions that the user needs in order to perform daily and recurring tasks. In role administration (the Profile Generator), you transfer these transactions to a role (in the role menu). Role administration proposes suitable authorization objects and field values for the various transactions, in accordance with the entries defined in transaction SU24. You then have to edit these values manually. You then use role administration to generate a profile from these authorization values. The users do not have the authorizations until the generated profile of the role has also been assigned to them. If Customizing switch AUTO_USERCOMPARE in table PRGN_CUST has been set to YES, or does not exist, the profile assignment is performed automatically.
Role assumed by an object in its relationship with another object.
Role
BI - SAP Predictive Analytics (BI-RA-PA)How a variable is used in data modeling. Three roles exist: target variable, explanatory variable, and weight variable.
Combination of similar positions. &EXAMPLE& The "Purchasing Manager" role covers the responsibility for orders in for providing basic material, goods and business methods. The task area of the Purchasing Manager entails optimizing the relationship between price and value. Included in the task area of the Purchasing Manager are managing the order process, determining purchasing policies, and procurement market research (process tasks). The Purchasing Manager also plays the role of a superior, meaing that s/he supervises the efficiency of the order process, controls the cost center data and is responsible for personnel administration in his/her area (administrative activity functions).
The collection of activities that a person performs to participate in one or more business scenarios in an organization. Access to the transactions, reports, Web-based applications, and other objects contained in roles is through user menus. mySAP.com Workplace provides the user access using a Web browser to a role-based portal for completing his or her tasks.
Role
CA - SAP Anywhere (CA-ANW)Definition of a position with a combination of authorizations to data. Roles are assigned to users to limit their data access.
A business object that is relevant to the master project. Individuals can be assigned to specific roles in a master project. The content of the Project Workspace that is available to a user is dependent upon the assigned role.
Role
EP - Roles (EP-PIN-ROL)A collection of tasks, services, and information that is available for groups of users. The role determines which service can be accessed. In addition, it provides the visualization of content and the navigation structure.
Role
EPM - EPM IM Flying Profit&Loss (Leopard)(EPM-IM-FPL) A collection of functional rights and data access rights to which a user can be assigned.
Role
EPM - Percipient (EPM-NOV-SWP)A dimension that represents a job or the function a resource performs within the organization. &Example& Accounts Payable Representative, Project Manager, and Financial Analyst.
A marker used to assign functions to your business partner depending on the business relationship (for example, counterparty, issuer, borrower), and to control field selection for the partner data. A business partner may have more than one role.
The function that a business partner assumes in your own company. The role allows you to: Edit the business partner attributes that are required in order to carry out this function Control authorizations Search for business partners Set role-dependent field selection &EXAMPLE& Tenant, account holder, lawyer, or partner group
A subject area in claims processing for which a performer is responsible. &EXAMPLE& Role for subrogation/recovery Role for fraud detection Role for legal disputes (litigation, negotiation) Role for claim settlement
A group of business activities that a user executes to participate in one or more business scenarios of an organization. The access to the transactions, included in roles, reports and web-basedapplications, is made through user menus.
Role
GRC - SAP Cloud Identity Access Governance (GRC-IAG)A collection of rights and permissions that allow users to access and use services, systems, applications, data, reports, and so forth. Administrators assign roles to users to enable them to access one or more business resources.
Role
GRC - Business Role Management (GRC-SAC-BRM)This app allows users to do a google-like search of roles, role attributes, associated risks, and users assigned in Access Control.
Role
LOD - Travel OnDemand (LOD-TEM)A defined set of access privileges. The role assigned to a user determines which tasks the user can perform and which work centers and views the user can access. All users must be assigned at least one role in order to access the system.
Role
MFG - Production Process (MFG-DM-MA-PP)A function related to certain activities and authorizations that is designated to a user or a work group.
Role
OPU - Duet (OPU-DUE)A defined set of access privileges. The role assigned to a user determines which tasks the user can perform and which parts of the user interface the user can view. All users must be assigned at least one role in order to access the system.
Role
PLM - PLM Design Collaboration (PLM-DC)A defined set of access privileges. The role assigned to a user determines which services and apps the user can access. Administrators assign roles to users to enable them to have the right access.
Role
PPM - Resource Management (PPM-CLD-RES)The function that a person has in a job or project.
The function of a resource in a project, for example, the project lead. The role is staffed by one or more concrete persons and contains information regarding the qualifications the person must have and the date and length of time the person must be available for. As a rule, therole is assigned to the tasks in the project for which the person is responsible, or to the tasks a person works with. The role stands for a required resource from the point of view of resource management.
Role
PUR - Procurement Planning (PUR-PRP)Unit of the SAP Cloud Platform authorization concept. Roles control the authorization assignments and - by means of the role-specific user menus - the appearance of the user interface. A role can be assigned to a user and contains functional rights and data access rights.
Role
SBO - SAP Business One (SBO)An attribute that describes the meaning of XBRL resources and is expressed as a uniform resource locator (URL).
Role
SCM - Sales & Operations Planning (SCM-SOP)A defined set of access privileges and permissions. The role assigned to a user determines which tasks the user can perform and which parts of the user interface the user can view. All users must be assigned at least one role in order to access the system.
Function that a persons holds within an organization. For example, an Internal Sales Representative.
Role
SRD - FDN-Organization Management (SRD-MD-OM)A description of the part a location plays in the enterprise. A location can be a site, or a site with inventory, for example.
Catalogs
SRD - SRM-Catalogue Content ManagementA work center view where you can upload and access supplier catalogs, or content from supplier catalogs, to search for required products. Catalogs is also a business topic in the business adaptation catalog.
The home page and entry point to all important activities in the technical monitoring cockpit. The launchpad is a dashboard with tiles, where each tile represents a monitoring or administration screen that the user can launch. Tiles that represent monitoring screens include thumbnails with a simplified preview of the charts, tables or or lists from the screens. Users can change the launchpad like a dashboard by defining their own selection of tiles.
A generic design template for displaying navigation targets as hyperlinks. It is implemented using the Web Dynpro component FPM_LAUN CHPAD_UIBB.
Launchpad
BI - SAP Lumira (BI-LUM)A page that lists all available stories and datasets.
The LaunchPad is the left-hand Web browser frame of the standard mySAP Workplace. The LaunchPad displays the pull part of a role in the form ofa menu tree. The user can choose one of the entries here to launch an application or access information and services in the WorkSpace of the mySAP Workplace.
Navigation
AP - ByDesign Studio (AP-RC-BDS)The means by which a user can move around, within and between, screens. Navigation elements include menus, links, and standard buttons such as Back, Forward, and Exit.
Means by which the user switches from one screen to another, or from one application to another. The navigation options in the R/3 System are intended to give the user as much freedom as possible when moving between screens and applications. To support this, standard functions (such as Back, Exit, and Cancel) are provided. In addition to the free navigation available by choosing functions or absolute destinations, the SAP System can guide the user through a sequence of screens.
Analysis of the InfoProvider data by displaying different views on the data of a query or a Web application. With the aid of the various navigational functions, such as: - 'Fix as Filter Value' - 'Insert Drilldown According to' you can generate different views of the data (query views) that are presented in the results area of the query or Web application. Changing views is considered to be navigation.
Navigation
PLM - Visualization (PLM-EPD-VIZ)A type of visualization whose purpose is to allow users to navigate business data using photographs (360 and Flat). A navigation is created by importing photographs and adding interactive markers to them for navigation and interrogation of business data.
Groups
SCM - Asset Central FoundationThe name of a Fiori App that is used to group together different business objects for different purposes.
To create an ABAP trace.
An entity which is only used in business scenario configuration. A profile is maintained in SOA Manager and contains mainly the set of security settings that need to be applied to service definitions and service groups during business scenario configuration. As the security settings of a landscape may change in the course of time, a new profile version was introduced in SOA Manager to support these changes. The Web service consumer and provider applications can agree on specific profile versions, and all other profile versions can be deactivated. The Web service configuration on the consumer and the provider side takes place automatically with the help of this mechanism, thus supporting change management in the landscape. Profiles are used during local and central business scenario configuration. This entity cannot be transported across systems but can be exported and imported as an XML file between systems. This entity is also exposed in the Services Registry where
Contains user data such as e-mail address, language, password. Can be changed by an administrator or the user.
Profile
BC - SAP Replication Server (BC-SYB-REP)A pre-defined set of properties that SAP Replication Server uses to connect to a particular non-SAP ASE server.
Configuration for a filter that allows you to quickly find the task lists and folders relevant to you in the Open dialog box.
Describes a finite list of freely definable attributes and the values attached (by business partners) to these attributes, drawn up for marketing purposes. A profile is therefore a logical description of a quantity of business partners to be contacted through marketing activities. In addition to a description explaining the purpose of the profile, a planned size and a type, profiles consists mainly of the criteria by which the relevant business partners are selected and stored in the target group(s).
Profile
EIM - SAP Information Steward (EIM-IS)A process that generates attributes about the data such as minimum and maximum values, pattern distribution and data dependency to help data analysts discover and understand data anomalies.
Profile
FS - Liquidity Management Suite (FS-LMS)A set of data records which define rules for accessing LMS.
Profiles combine tasks (also surgery tasks). They are used to structure task lists in the documentation work station or in its variants, for example, the surgery work station. You define profiles in profile templates.
Profile
IS - Connected Health Platform (IS-PMED-HPH)A set of parameters that specify how the data is integrated.
Contains values such as consumption and prices for a certain period. Profiles are used to manage interval data in the Energy Data Management (IS-U-EDM) component. A profile is composed of header data and profile values. Profile characteristics are defined in the header data. The most important characteristics are: Interval length Profile type Profile value category Example Interval data includes Values measured by an interval meter every 15 minutes Forecast values for an interval meter every 15 minutes An price index from the energy exchange with an hourly amount
A collection of information used to configure specific objects. The information in a profile is standard information, that are always required in a similar constellation when maintaining different objects. A profile acts as a data entry tool and simplifies the management of object data.
Profile
LOD - Human Capital Management onDemand (LOD-HCM)A collection of key information about an employee, such as his or her career information, goals, activities, and mentoring relationships.
Profile
LOD - SAP JAM (LOD-SF-JAM)A page displaying information about a user, as well as all public comments and content the user has posted from his or her account.
Profile
MFG - SAP Complex Assembly Manufacturing (MFG-CAM)A profile defines the functions that users are allowed to do and the document types and tables that users are allowed to work with.
The profiles contain default values and control parameters for processing objects and functions in the Project System. The Project System includes the following profiles: Standard network profile Network profile Project profile Plan profile for cost planning in the WBS Budget profile for budget management Information system profiles
Profile
SBA - Semantic Business Applications (SBA)A group of settings that reflect the requirements of a distinct user group. Profile settings include: Local folder locations and preferences Permission for access to all new cases Mapping settings for plug-ins to other systems A profile always belongs to a specific client. Clients can have several profiles.
A logical area containing the documents for your application. It has a unique name by which it can later be queried, and is secured by a key provided by the application.
Storage location for files that are linked to from the Help Center. This can be the Help Center repository in Solution Manager or a shared network folder.
Repository
BC - Landscape Virtualization Management (BC-VCM-LVM)Central storage location in your landscape for storing data files. It is mounted on a host and accessible by SAP Host Agent.
Repository
BI - SAP Predictive Analytics (BI-RA-PA)Component of the Predictive Analytics integrator. The Repository does not store predictive models themselves, but only a URL and metadata. It contains a hierarchy of objects that you can use to organize your Models.
A set of tables that hold user-created and predefined system objects, source and target metadata, and transformation rules.
Repository
EIM - SAP Master Data Services (EIM-MDS)An area for storing and managing domain-specific and global resources.
Repository
EP - KM Content Management (EP-KM-CM)Storage system or location where data accessed through CM functions is stored. The CM Repository Framework supports different types of repositories (for example, file system repositories, WebDAV repositories). Depending on the type of repository, not all CM functions may be applicable.
A repository is a place, room, or container where something is deposited or stored.
Involves tasks such as creating, deleting, locking, unlocking users, and resetting passwords. The authorization to carry out administrative tasks can also be delegated to another user. For example, you can create a delegated administrator's role and assign it to a company contact - who can then handle administration of users of that company.
SAP Fiori
BV - Brand Voice - Technology PlatformFirst developed as a set of extensible HTML5 apps specific to key user roles, offering a seamless user experience across devices using responsive design principles. SAP Fiori apps target all employees of existing SAP customers, addressing the most common business functions, such as workflow approvals, information lookups, and self-service tasks. A free launchpad allows users to access their SAP Fiori apps from one single entry point. A cloud version is available as SAP Fiori Cloud.
SAP Help, Wiki, Q&A and other resources for PFCG
Click here for the full list of resources and help pages, only the first few are posted below
-
View the full list of resources, SAP Help/Wiki pages and Q&A for PFCG
SAP NetWeaver Business Client 1.0 (with PFCG Connection) - SAP Library
Relevancy Factor: 5650.0The SAP NetWeaver Business Client (NWBC) is a new, desktop-based SAP integration platform that provides end users with a seamless integration of classic SAP GUI-based transactions and new applications developed in Web Dynpro. Existing browser-based SAP applications can also be integrated.
"SAP NetWeaver Business Client 1.0 (with PFCG Connection) - SAP Library"
http://help.sap.com/erp2005_ehp_04/helpdata/en/44/a22c9ca40874a2e10000000a11466f/frameset.htmSAP Library - SAP NetWeaver Business Client 1.0 (with PFCG Connection)
Relevancy Factor: 4250.0
"SAP Library - SAP NetWeaver Business Client 1.0 (with PFCG Connection)"
http://help.sap.com/saphelp_erp60_sp/helpdata/en/44/a22c9ca40874a2e10000000a11466f/frameset.htmAssignment of a Process to PFCG Roles - HCM Processes and Forms - SAP Library
Relevancy Factor: 2630.0This section describes how to assign a process that uses a form scenario with a form of type FPM Form to PFCG roles.
"Assignment of a Process to PFCG Roles - HCM Processes and Forms - SAP Library"
http://help.sap.com/erp_hcm_ias_2013_01/helpdata/en/ec/4b6f1c7fc3460faba3dcc224d1777e/content.htmCentral Repository for Personalization Data - SAP Help Portal
Relevancy Factor: 2330.0The purpose of a central repository for personalization data is to provide storage for user-specific and role-specific data without having to create any additional database tables.
https://help.sap.com/docs/SAP_NETWEAVER_740/c6e6d078ab99452db94ed7b3b7bbcccf/abe70538389511d5974400a0c930dcc1.html5 Role Maintenance in PFCG - SAP Help Portal
Relevancy Factor: 2040.0With SAP NetWeaver Business Client (NWBC), you can display information on the client that is mapped to the client using the Role Maintenance ( PFCG) transaction. For this purpose, PFCG as the central repository for all system roles, has been enhanced with additional functions.
"5 Role Maintenance in PFCG - SAP Help Portal"
https://help.sap.com/docs/SAP_NETWEAVER_731_BW_ABAP/9737050ef01843f19572591b42128f1b/4c5bdc2a97817511e10000000a42189b.html5 Role Maintenance in PFCG - SAP NetWeaver Business Client - SAP Library
Relevancy Factor: 1920.0With SAP NetWeaver Business Client (NWBC), you can display information on the client that is mapped to the client using the Role Maintenance (PFCG) transaction. For this purpose, PFCG as the central repository for all system roles, has been enhanced with additional functions.
"5 Role Maintenance in PFCG - SAP NetWeaver Business Client - SAP Library"
http://help.sap.com/saphelp_SCM700_ehp02/helpdata/en/4c/5bdc2a97817511e10000000a42189b/content.htm1 Overview - SAP Help Portal
Relevancy Factor: 1900.0SAP NetWeaver Business Client (NWBC) is a rich UI client that offers a single point of entry to SAP applications, especially harmonizing access to existing SAP GUI transactions and newly developed applications based on Web Dynpro. NWBC itself is a high-fidelity shell that aims at harmonizing the user experience over different UI technologies.
https://help.sap.com/docs/SAP_NETWEAVER_731_BW_ABAP/9737050ef01843f19572591b42128f1b/4c5bd87b97817513e10000000a42189b.htmlChecking for Changes in Authorizations After Upgrades - SAP Help Portal
Relevancy Factor: 1570.0After an upgrade compare the default check indicators and the field values of the previous and new releases. Run the comparison with Profile Generator: Upgrade and First Installation (transaction SU25).
"Using customer-specific organizational levels in PFCG"
https://help.sap.com/docs/SAP_NETWEAVER_740/c6e6d078ab99452db94ed7b3b7bbcccf/4e1e4fa89c4920cfe10000000a42189c.html5.5 Navigation Tree - SAP Help Portal
Relevancy Factor: 1180.0For more information, see Role Menu and the documentation that is displayed by choosing the icon on the Menu tab page.
https://help.sap.com/docs/SAP_NETWEAVER_731_BW_ABAP/9737050ef01843f19572591b42128f1b/4c5bdd2a97817511e10000000a42189b.html5.11 Remote Systems - SAP Help Portal
Relevancy Factor: 1150.0For some applications, you need to be able to define whether, although the role is defined locally, specific entries or all entries in one role can be executed in a foreign system.
https://help.sap.com/docs/SAP_NETWEAVER_731_BW_ABAP/9737050ef01843f19572591b42128f1b/4c5bdc6497817511e10000000a42189b.html