SAP Security Fundamentals: Users, Roles and Authorizations

Keep this: job aid

SAP authorization basics: a tester's cheat sheet

• Hierarchy: field → object (up to 10 fields) → authorization (values) → profile → role → user.
• Activities: 01 create, 02 change, 03 display, 06 delete.
• Start check: S_TCODE (SAP GUI), S_SERVICE (Fiori OData); then AUTHORITY-CHECK on data objects.
• Return codes: 0 allowed; 4 values missing; 12 object missing; 16 no profile.
• After a SAP GUI refusal, run SU53 at once and attach it; for Fiori apps use STAUTHTRACE and /IWFND/ERROR_LOG.
• Composite roles hold no authorizations; fix the single role.
• User types: A dialog, B system, C communication, S service, L reference.
• Least privilege: limit function, activity and organization; avoid * in org fields.
• Every role test has positive and negative cases.
• Fiori: tile visible (catalog/space) ≠ app starts (S_SERVICE) ≠ data allowed (back-end objects).