SAP Authorization Objects

To use Xtract Universal.iQ you need an SAP connection user with sufficient authorization in SAP. Authorizations are assigned via authorization objects in SAP. Redirect this page to your SAP Basis administrators to get the relevant authorization objects for your SAP connection user.

The authorizations in the section General authorization objects are required to establish an SAP connection with the SAP application server. The required authorizations for each service type are listed in their respective section.

SAP Authorization Profiles

Theobald Software collected and combined the necessary authorizations for all service types into SAP roles. You can download the SAP profiles and upload them to your SAP system:

General Authorization Objects

The following authorization objects are required to establish a connection to SAP.

S_RFC           RFC_TYPE=FUGR; RFC_NAME=SYST; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=SRFC; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=RFC1; ACTVT=16
S_RFC           RFC_TYPE=FUGR; RFC_NAME=OCS_CRM; ACTVT=16

Download SAP profile for general authorization

CDSFlow

The following authorization objects are required for using the CDSFlow service type and performing delta loads:

S_RFC             RFC_TYPE=FUGR,FUNC; ACTVT=16; 
S_RFC             RFC_NAME=DHAMB_SERVICE_DSET_BROWSE, DHAMB_SERVICE_DSET_DEFINITION, DHAPE_GRAPH_MANAGER, DHAPE_GRAPH_ROUNDTRIP, DHAPE_GRAPH_VERSION, OCS_CRM, OCS_GET_INSTALLED_SWPRODUCTS, RFC1, RFCPING, RFC_SYSTEM_INFO, SRFC, SYST;
S_DHAMBACT        DHAMB_ACVT=BR,DF;
S_DHAMBCDS        DHBASCDSNM=*; DHBASCDSRS=NO; ACTVT=03,33;
S_DHAPEAC2        ACTVT=16;
S_DHAPEOPR        ACTVT=16; DHAPEOPNM=com.sap.abap.cds.reader.v3, com.sap.abap.subscr.eraser.v1, internal.outport; 
S_DHCDCACT        DHCDCACTVT=TD;
S_DHCDCCDS        ACTVT=03; DHCDCSBTYP=DHAPE; DHCDCCDSRS=NO; DHCDCCDSNM=*;
S_DHCDCSTP        DHCDCSBTYP=DHAPE; ACTVT=01, 03, 06;

The authorization values shown above grant access to all CDS views. To restrict access, adjust the following authorization fields:

• To allow access only to specific CDS Views, set the authorization objects S_DHAMBCDS-DHBASCDSNM and S_DHCDCCDS-DHCDCCDSNM to the name of the allowed CDS View.
• To allow access only to C1 released CDS Views, set the authorization objects S_DHAMBCDS-DHBASCDSRS and S_DHCDCCDS-DHCDCCDSRS to "C1". The value "NO" allows access to CDS Views regardless of their release status.

Download SAP profile for CDSFlow

Function Module / BAPI

Xtract Universal.iQ only supports remote-enabled functions.

S_RFC            ACTVT=16; RFC_TYPE=FUGR; RFC_NAME=DDIF_FIELDINFO_GET, SDIFRUNTIME     

Download SAP profile for BAPI

Report

To execute a report with Xtract Universal.iQ, the SAP connection user needs explicit authorization to execute the report. Authorization can be granted using one of the following methods:

• Assign the authorization object Z_TS_PROG
• Assign an authorization group

S_RFC            RFC_TYPE=FUGR; RFC_NAME=THEO/REPORT; ACTVT=16
S_TABU_NAM       ACTVT=03; TABLE=TRDIR, TRDIRT, TSTC, VARID
S_GUI            ACTVT=61 
S_TABU_DIS       ACTVT=03; DICBERCLS=&NC& 
S_TABU_DIS       ACTVT=03; DICBERCLS=SS
S_BTCH_ADM       BTCADMIN=Y
S_BTCH_JOB       JOBGROUP=*; JOBACTION=RELE

Download SAP profile for Report

Table

S_RFC            ACTVT=16; RFC_TYPE=FUGR; RFC_NAME=SDTX, SDIFRUNTIME, /THEO/READ_TABLE                   
S_TABU_DIS       ACTVT=03; DICBERCLS=XXXX
S_TABU_NAM       ACTVT=03; TABLE=DD02V, DD17S, DD27S, ENLFDIR
S_DSAUTH         ACTVT=16;    

XXXX (stands for a placeholder) is the authorization group for the table. To determine, which authorization group belongs to which table, check the table TDDAT - Maintenance Areas for Tables. If the table is not listed, the authorization group is &NC&. For authorizing specific tables use authorization object S_TABU_NAM instead of S_TABU_DIS.

Additional Options

• Run function module in background:

  Necessary SAP authorizations

  S_BTCH_ADM       BTCADMIN=Y
  S_BTCH_JOB       JOBGROUP=*; JOBACTION=RELE
  

• Count Rows button:

  Necessary SAP authorizations

  S_RFC            RFC_TYPE=FUNC; RFC_NAME=EM_GET_NUMBER_OF_ENTRIES; ACTVT=16  
  

• Adjust currency decimals:

  Necessary SAP authorizations

  S_TABU_NAM       ACTVT=03; TABLE=TCURX
  

• Support for CDS Views based on Entities:

  Necessary SAP authorizations

  S_TABU_NAM       ACTVT=03; TABLE=DDDDLSRC, DDDDLSRCT
  

Download SAP profile for Table

Table CDC

S_DMC_S_R        ACTVT=33
S_RFC            ACTVT=16; RFC_TYPE=FUGR, FUNC; RFC_NAME=SDTX, SDIFRUNTIME, Z_THEO_DELETE_LOG_ENTRIES, /THEO/CDC_*, /THEO/READ_TABLE          
S_TABU_DIS       ACTVT=03; DICBERCLS=*
S_TABU_CLI       CLIIDMAINT=X 
S_TABU_NAM       ACTVT=03; TABLE=DD02V, DD17S, DD27S, ENLFDIR
S_DEVELOP        ACTVT=03; DEVCLASS=$TMP; OBJNAME=ZTSCDC_*; OBJTYPE=*; P_GROUP=*

Download SAP profile for Table CDC

Related Topics

• SAP Help: Role Administration
• SAP ONE Support Launchpad