SAP roles and assignment

The supplied role package groups the SAP communication, read and user-administration permissions used by userXpress. You can provide this access through your existing SAP roles or use the package below, with authorization values matching the administrator’s responsibilities.

The package contains two single roles and a composite role. To use it, import the roles in PFCG, generate both single-role profiles and assign the composite role to the SAP users who will connect from userXpress.

Download the userXpress SAP roles (.zip)

Roles in the package

Communication Authorization

Single role: Z_DELORION_USERXPRESS_RFC

Permits the RFC calls and table reads userXpress uses to communicate with SAP.

User Administrator

Single role: Z_DELORION_USERXPRESS_USERADM

Provides authorizations for SAP user accounts, role assignments and authorization profiles.

Admin User Role

Composite role: ZC_DELORION_USERXPRESS

Groups the communication and user-administration roles so you can assign them together.

Assign the composite role to the SAP account used by the userXpress connection. SAP assigns its two single roles during user comparison. See SAP: Creating Composite Roles.

Use the SAP access reference to identify the authorizations needed for the person’s duties.

Prepare the role

Use the systems, clients, user groups, roles and activities already defined for the administrator’s duties when preparing the supplied roles.

For example, an administrator who resets passwords may need to read account details and change passwords for one user group, without permission to delete accounts or change role definitions.

Include the reads used to load and refresh the relevant user and role information. SAP controls read access and account changes through separate authorization checks, so set the scope of both to match those duties.

Import a PFCG role file

1. Download the ZIP file above and extract Delorion-userXpress-Roles.SAP.
2. Log on to the intended SAP system and client with an account authorized to maintain roles, then open PFCG.
3. Choose Role → Upload and select the extracted .SAP file.
4. Import the three roles listed above. If a role already exists, check that you intend to replace it before confirming.

After import, generate the authorization profiles for both single roles. Profile generation makes their authorization data available for assignment to users. See SAP: Working with Transaction PFCG.

Generate and assign

Generate the single-role profiles

Complete these steps for each single role: Z_DELORION_USERXPRESS_RFC and Z_DELORION_USERXPRESS_USERADM.

1. Enter the role name in PFCG and choose Change.
2. Open Authorizations → Change Authorization Data.
3. Maintain the required authorization values and apply the user-group, role-name and activity restrictions agreed for the administrator.
4. Save the authorization data and choose Generate to generate the profile.

Assign the composite role

1. Open ZC_DELORION_USERXPRESS in PFCG and choose Change.
2. On the User tab, enter the SAP user IDs that should receive the roles and set their assignment validity dates.
3. Save the assignments and choose User Comparison, then Complete Comparison. This applies the included single-role assignments and their generated profiles to the users.
4. Reconnect the affected userXpress connection to use the assigned authorizations.

SAP explains profile generation and user comparison in Maintaining User Authorizations with Roles and Profiles.

Change or remove access

After changing a role’s authorization data, regenerate its profile and complete the necessary user comparison. Reconnect the affected userXpress connection to use the updated authorizations.

Before removing a role, identify the users who depend on it. Remove the intended assignments and complete user comparison through your SAP administration process. Uninstalling userXpress from a workstation does not revoke SAP role assignments.