You can use this program PFCG_MASS_COLL_ASSIGN to add or delete assignments of single roles in composite roles. Saving applies the changes of the indirect single role assignments to users automatically.
Selection
The program provides three change modes for the composite roles selected in the standard selection:
- Simulation
- This mode simulates the changes you want to make and displays them in a results list. All required authorization checks are made in the simulation.
- Execute with prior simulation
- First the roles are locked and the simulation performed. The pushbutton ‘Execute’ then appears in the menu bar. This allows you to check the changes before saving them, and prevents the roles from being changed inadvertently in the meantime.
- If you only want to change some of the displayed roles, you can use the “Exclude Role” function above the results list to delete those roles that you have marked. Note that if you mark a line, this applies to the entire role that this line refers to. You cannot exclude single authorizations from being processed.
- Direct execution
- In this mode the changes are made immediately and displayed in a results list.
Role Transport
Here you can see whether a setting is active for transporting client-specific customizing objects in transaction SCC4, and if so, which one.
For the “Automatic Recordings of Changes” setting, you can select the generated authorization profiles and the personalization data as optional transport components and enter the required customizing request for role recording. The text in parentheses after the input field indicates that the specified request is only used for roles that are not set in another request by existing recordings. If you do not specify a request on the selection screen, but it is still possible to select a request for at least one of the roles you have selected, you will get the usual dialog window for selecting the request later on when you save the mass changes.
If the SCC4 setting is not active or is set to “Changes without automatic recording”, automatic recording does not take place. However, you can select the required roles in the results list after the mass changes have been executed, and record these manually by selecting the transport function in the toolbar.
The setting “Changes without automatic recording, no transports allowed” does not allow automatic or manual recordings.
For detailed information about using the SCC4 setting in relation to role maintenance, see SAP Note 1723881.
Change
For each type of change, determine whether you want to add or delete single roles or composite roles.
- Add:
- Select the single roles that you want to add.
- Delete:
- Select the single roles that you want to delete.
When changing authorizations, you have other options:
- User profile comparison Selecting this option updates the profile assignments to users.
- Supplement long text: By choosing ‘Text’, you can save a description that is appended to the long text for all changed roles. However, the long text of a role can only be maintained if you are logged on in its original language. Therefore, if you use this option, the assignments of single roles are only changed if the logon language matches the original language of the role.
Output
The output shows the result of the simulation or the execution. Errors are displayed in the error log at the end of the list. If you are changing composite roles, the list contains the following columns:
- Name of Composite Role
- Name of Single Role
- Value Comparison: Indicates whether a single role was added, deleted, or has stayed the same
