SAP Authorization Objects

To use Xtract Universal.iQ you need an SAP connection user with sufficient authorization in SAP. Authorizations are assigned via authorization objects in SAP. Redirect this page to your SAP Basis administrators to get the relevant authorization objects for your SAP connection user.

The authorizations in the section General authorization objects are required to establish an SAP connection with the SAP application server. The required authorizations for each service type are listed in their respective section.

SAP Authorization Profiles

Theobald Software collected and combined the necessary authorizations for all service types into SAP roles. You can download the SAP profiles and upload them to your SAP system:

General Authorization Objects

The following authorization objects are required to establish a connection to SAP.

S_RFC           RFC_TYPE=FUGR; RFC_NAME=SYST; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=SRFC; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=RFC1; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=OCS_CRM; ACTVT=16

Download SAP profile for general authorization

CDS Flow

The following authorization objects are required for delta loads:

S_RS_CDS_X           ACTVT=03; DDLXTRNAME=*; DDLXTRPART=DATA; DDLXTRRELS=C1
S_DHCDCSTP           ACTVT=01,03,06; DHCDCSBTYP=ODP 
S_DHCDCCDS           ACTVT=01,02,03,06; DHCDCSBTYP=ODP; DHCDCCDSRS=C1

Function Module / BAPI

Xtract Universal.iQ only supports remote-enabled functions.

S_RFC            ACTVT=16; RFC_TYPE=FUGR; RFC_NAME=DDIF_FIELDINFO_GET, SDIFRUNTIME     

Download SAP profile for BAPI Extractions

Report

To execute a report with Xtract Universal.iQ, the SAP connection user needs explicit authorization to execute the report. Authorization can be granted using one of the following methods:

• Assign the authorization object Z_TS_PROG
• Assign an authorization group

S_RFC            RFC_TYPE=FUGR; RFC_NAME=ZXTRACTABAP; ACTVT=16
S_TABU_NAM       ACTVT=03; TABLE=TRDIR, TRDIRT, TSTC, VARID
S_GUI            ACTVT=61 
S_TABU_DIS       ACTVT=03; DICBERCLS=&NC& 
S_TABU_DIS       ACTVT=03; DICBERCLS=SS
S_BTCH_ADM       BTCADMIN=Y
S_BTCH_JOB       JOBGROUP=*; JOBACTION=RELE

Download SAP profile for Report

Table

S_RFC            ACTVT=16; RFC_TYPE=FUGR; RFC_NAME=SDTX, SDIFRUNTIME, /THEO/READ_TABLE                   
S_TABU_DIS       ACTVT=03; DICBERCLS=XXXX
S_TABU_NAM       ACTVT=03; TABLE=DD02V, DD17S, DD27S, ENLFDIR
S_DSAUTH         ACTVT=16;    

XXXX (stands for a placeholder) is the authorization group for the table. To determine, which authorization group belongs to which table, check the table TDDAT - Maintenance Areas for Tables. If the table is not listed, the authorization group is &NC&. For authorizing specific tables use authorization object S_TABU_NAM instead of S_TABU_DIS.

Additional Options

• Run function module in background:

  Necessary SAP authorizations

  S_BTCH_ADM       BTCADMIN=Y
  S_BTCH_JOB       JOBGROUP=*; JOBACTION=RELE
  

• Count Rows button:

  Necessary SAP authorizations

  S_RFC            RFC_TYPE=FUNC; RFC_NAME=EM_GET_NUMBER_OF_ENTRIES; ACTVT=16  
  

• Adjust currency decimals:

  Necessary SAP authorizations

  S_TABU_NAM       ACTVT=03; TABLE=TCURX
  

• Support for CDS Views based on Entities:

  Necessary SAP authorizations

  S_TABU_NAM       ACTVT=03; TABLE=DDDDLSRC, DDDDLSRCT
  

Download SAP profile for Table

Table CDC

S_DMC_S_R        ACTVT=33
S_RFC            ACTVT=16; RFC_TYPE=FUGR, FUNC; RFC_NAME=SDTX, SDIFRUNTIME, Z_THEO_DELETE_LOG_ENTRIES, /THEO/CDC_*, /THEO/READ_TABLE          
S_TABU_DIS       ACTVT=03; DICBERCLS=*
S_TABU_CLI       CLIIDMAINT=X 
S_TABU_NAM       ACTVT=03; TABLE=DD02V, DD17S, DD27S, ENLFDIR
S_DEVELOP        ACTVT=03; DEVCLASS=$TMP; OBJNAME=ZTSCDC_*; OBJTYPE=*; P_GROUP=*

Download SAP profile for Table CDC

Related Topics

• SAP Help: Role Administration
• SAP ONE Support Launchpad