Composite Roles in SAP Security

Composite Roles in SAP Security

Composite roles:

1.   A composite role is a container with  several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.

2.     It is used to simplify the administration.

3.    Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.

4.     It only groups the roles, but menus can be compressed.

5.  Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.

6.   The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.

7. Composite roles are identified by customer naming conventions only.

1.    These are created in PFCG.

2.  These are earlier called as CAGS(Composite Activity Groups).

3.    Example for Composite Role. Here the role name, “BASIS Role” is defined as Composite Role

           

·         The menu tree of a composite role is, in the simplest case, a combination of the menus of the roles contained. When you create a new composite role, the initial menu tree is empty at first. You can set up the menu tree by choosing Read menu to add the menus of all roles included. This merging may lead to certain menu items being listed more than once. For example, a transaction or path contained in role 1 and role 2 would appear twice.

·         If the set of roles contained in a composite role changes, the menu tree is also affected. In such a case, you can completely rebuild the menu tree or process only the changes. If you choose the latter option, the Profile Generator removes all items from the menu which are not contained in any of the roles referenced.

·         It is possible (and often necessary) to change the menu of a composite role at any time. You adjust these menus in the same way as the menus for roles (see above).