Composite Roles in SAP Security
Composite
roles:
1. A
composite role is a container with several different roles. For reasons
of clarity, it does not make sense and is therefore not allowed to add
composite roles to composite roles. Composite roles are also called roles.
2. It
is used to simplify the administration.
3. Composite
roles do not contain authorization data. If you want to change the
authorizations (that are represented by a composite role), you must maintain
the data for each role of the composite role.
4. It
only groups the roles, but menus can be compressed.
5. Creating
composite roles makes sense if some of your employees need authorizations from
several roles. Instead of adding each user separately to each role required,
you can set up a composite role and assign the users to that group.
6. The
users assigned to a composite role are automatically assigned to the
corresponding (elementary) roles during comparison.
7. Composite
roles are identified by customer naming conventions only.
1. These
are created in PFCG.
2. These
are earlier called as CAGS(Composite Activity Groups).
3. Example
for Composite Role. Here the role name, “BASIS
Role” is defined as Composite Role
·
The menu tree of a composite role is, in the
simplest case, a combination of the menus of the roles contained. When you
create a new composite role, the initial menu tree is empty at first. You can
set up the menu tree by choosing Read menu to add the menus of all roles
included. This merging may lead to certain menu items being listed more than
once. For example, a transaction or path contained in role 1 and role 2 would appear
twice.
·
If the set of roles contained in a composite
role changes, the menu tree is also affected. In such a case, you can
completely rebuild the menu tree or process only the changes. If you choose the
latter option, the Profile Generator removes all items from the menu which are
not contained in any of the roles referenced.
·
It is possible (and often necessary) to change
the menu of a composite role at any time. You adjust these menus in the same
way as the menus for roles (see above).