Security: Best Practices for Roles Transport in

AS ABAP system
Posted by Bhupinder SIngh Arora Jun 20, 2014
Best Practices for Roles Transport in AS ABAP system
Guidelines for role transports, I am here trying to compile different scenarios (as much as possible), please
share comments and add-ons on the same if any.
1. Single role
For Single role change transport in standard way.
2. Parent and Child roles.
For parent and child roles different scenarios are:
Scenario-1. Addition of T-code and Authorization Object
We are adding T-code in parent role and distributing to all child roles, In this case we will create a transport for
Parent and all Child roles. (If we are putting all child roles, parent role get added automatically).
Scenario-2. Addition of Org Level in Child Role.
Child role as per mechanism is only for Org level maintenance, so when we are making changes in org level
of any child role we can transport only that child role. Again that child role will call parent role in transport
automatically.
Imp Note: To avoid confusion and misbehavior in case of large no. of role changes of nature parent and child
roles we should include all child roles in transport.
3. Composite and Single roles
For Single and composite roles different scenarios are:
Scenario-1. Addition of T-code and Authorization Object.
Addition of T-code, authorization object in Single role which is part of composite role can add individually in
transport.
Scenario-2. Creation of new single role and adding to existing composite role.
We have created a new role and added that as a part of composite role; In this case we need to add single
role and also composite role in transport without checking the option Also Transport Single Roles from
Composite Roles.
Scenario-3. Creation of new composite and all its new single role.
We have created a new role and added that as a part of composite role, in this case we need to add composite
role in transport without checking the option Also Transport Single Roles from Composite Roles. This
option will take all its single roles.
Scenario-4. Adding or deleting existing single role in composite role.

Generated by Jive on 2015-03-10+01:00

1

Security: Best Practices for Roles Transport in AS ABAP system

In this case we need to add only composite role without checking the check box of Also Transport Single
Roles from Composite Roles.
Scenario-5. Composite roles of BW system
In BW system Composite roles need to move always without checking the check box of Also Transport
Single Roles from Composite Roles as in BW there are roles which are suppose to be allowed to edit by
query designer and administrator directly in production. They are adding new queries in role menu on daily
basis which they are not maintaining in Dev and Test and the composite with option checked Also Transport
Single Roles from Composite Roles will spoil the roles.

The goal of the document is to help make users aware of the Transport roles in AS ABAP systems.
Recommendations are based on my personal experience in SAP Implementation as an Sr. SAP Consultant.
The user can follow the suggestions provided by the document which should be supplemented with additional
information. The suggestion provided by the document may vary as per the project requirement.
523 Views

Bhupinder SIngh Arora in response to deepak m on page 2

Mar 5, 2015 7:52 AM
Thanks Deepak
deepak m
Nov 18, 2014 1:34 PM
Hello Arora,
Very good document explaining all the possible scenarios related to transport...good work....
Regards
Deepak M

Generated by Jive on 2015-03-10+01:00

2