The SAP authorization
concept is based upon the logical relationship between a user ID and the
range of system authorizations with which it can be associated. The
architecture of the authorization system is based upon the utilization
of several individuals but related logical components: Profiles,
Objects, Fields, and Authorizations. The user ID refers exclusively to
profiles. Each profile grants a set of specific system access
authorizations to user. Figure 2 illustrates the hierarchical
authorization concept in SAP.
Figure 2
Composite Profiles
Composite profiles refer
to the various employee roles available in the corporation (for
instance: Purchasing / Receiving Clerk or Accounts Agent). As the name
suggests, composite profiles may contain multiple user IDs necessary to
perform all the business operations associated with a particular role. A
composite profile may encapsulate another composite profile(s). In
practice, a model composite profile should be recognized for each
possible role in the organization, which may be used to produce hybrid
composite profiles. The over-existence of the hybrids can defy the very
purpose of composite profiles and they should be created only when
specific needs arise.
User Ids
User ids allow access to
SAP applications. Each user must have a corresponding profile
specifically assigned. In many situations, multiple composite profiles
can be assigned to a user ID, depending on the role(s) an individual
user is responsible for, in the business processes.
Authorizations
Authorizations are the
key building blocks of SAP security. Authorization is the process of
assigning values to fields present in authorization objects. In SAP,
access to all system functionality is achieved through a complex array
of authorizations. Sometimes users find that they lack the necessary
authorizations to perform a certain function in the system, in which
case the message: �You are not authorized�� is displayed at the bottom
of the screen.
An authorization process may ask for
second associated authorization process which in turn asks for third and
so on. For example, the task of paying a vendor invoice may require 10
different authorizations.
