5 Replies Latest reply: Sep 28, 2007 9:43 AM by vedam Ashok kumar

Different role types. Was: "Hi sap gurus"

Damodar reddy. G
Sep 28, 2007 8:41 PM
define and differentiate the following types of roles

1.single role

2.composite role

3.derived role

4.child role

5.parent role

Message was edited by: Moderator

Please use meaningfull thread subject titles.

 1254 Views


Average User Rating

 Re: Hi sap gurus

Alex Ayers Sep 27, 2007 5:43 PM (in response to Damodar reddy. G)

You will get the answer for all of those if you type them into a search engine

3&4 are the same

o Report Abuse
 o Like (0)
 Re: Hi sap gurus

Auke Visser Sep 27, 2007 8:40 PM (in response to Damodar reddy. G)

pls buy authorisatiosn made easy and you will know teh answers after readiing

o Report Abuse
o Like (0)
 Re: Hi sap gurus

ravi p Sep 27, 2007 10:39 PM (in response to Damodar reddy. G)

Single role is role which generally does not have a Org level (Generally sap delivered roles are single)

Composite role is a summation of single roles

Derived and Child roles are the same. They are created where Org levels have to be maintained.

Parent role is the role from which the child roles derive their data.

best regards

Ravi

o Report Abuse
o Like (0)
 Re: Hi sap gurus

Srinidhi Kotakonda Sep 28, 2007 7:41 AM (in response to Damodar reddy. G)
Hi Damodar,

Dervied role(child & dervied are same)

Derived role is a role which derived its authorizations from the role from which it is derived.

For example: You have created a Master role for Purchase Requisition creator . Now if you want person A to be able
to do this for a particular Org Unit A and another user B for for Org Unit B.

Then in this case you create two derived roles for the Master role mentioned above and maintain the Organizational
fields accordingly (Org Unit A for Dervied roleA, Org Unit B for Derived Role B)

So in Short derived roles are used when you have a common role which needs to be given to morethan one user with
the difference only in the Organizations Fields with the same activities then you create derived roles.

Now for composite roles say you have 100 end users who perform the same activities. and each one needs to be
assigned same set of ten roles.

Now if you go on doing it one by one its a painful task. A solution to this is to club the roles into a Composite role and
now once you assign this role to the users gives the same effect as the earlier case and managing and maintaining
becomes easier. So composite role is like a folder with a collection of single roles in it and can be assigned to users.

Master role or parent role :Parent role is the role from which the child roles derive their data.

refer to dervied role.

____________________________________________________________________

These online help looks good on this topic:

Derived Rols:http://www.*********************/tutorials/derived_role.htm

Composite roles: http://www.*********************/tutorials/composite_role.htm

o Report Abuse
o Like (0)
 Re: Hi sap gurus

vedam Ashok kumar Sep 28, 2007 9:43 AM (in response to Damodar reddy. G)

Hi

There are 5 types of Roles:

1) Single Role.

2) Composite Role. (Max 164 Single Roles can be attached to one Composite Role)

3) Derived Roles.

4) Orphans Role.

5) Reference Roles.

<b>Composite roles </b>

A composite role is a container with several different roles. For reasons of clarity, it does not make sense and is
therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.

Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by
a composite role), you must maintain the data for each role of the composite role. Creating composite roles makes
sense if some of your employees need authorizations from several roles. Instead of adding each user separately to
each role required, you can set up a composite role and assign the users to that group. The users assigned to a
composite role are automatically assigned to the corresponding (elementary) roles during comparison.
The menu tree of a composite role is, in the simplest case, a combination of the menus of the roles contained. When
you create a new composite role, the initial menu tree is empty at first. You can set up the menu tree by choosing
Read menu to add the menus of all roles included. This merging may lead to certain menu items being listed more
than once. For example, a transaction or path contained in role 1 and role 2 would appear twice. If the set of roles
contained in a composite role changes, the menu tree is also affected. In such a case, you can completely rebuild the
menu tree or process only the changes. If you choose the latter option, the Profile Generator removes all items from
the menu, which are not contained in any of the roles referenced. It is possible (and often necessary) to change the
menu of a composite role at any time. You adjust these menus in the same way as the menus for roles.

<b>Derived roles </b>

Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included
(transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if
no transaction codes have been assigned to it before.

The higher-level role passes on its authorizations to the derived role as default values, which can be changed
afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User
assignments are not passed on either. Derived roles are an elegant way of maintaining roles that do not differ in their
functionality (identical menus and identical transactions) but have different characteristics with regard to the
organizational level.

The menus passed on cannot be changed in the derived roles. Menu maintenance takes place exclusively in the role
that passes on its values. Any changes immediately affect all inheriting roles. You can remove the inheritance
relationship, but afterwards the inheriting role is treated like any other normal role. Once a relationship is removed, it
cannot be established again.

In real time scenario Roles and Authorizations are primarily based on Company codes in many cases and in some
scenarios are also based on Cost centers or divisions etc. IN such scenario, a Master role is created and many child
roles are created with relevant Organizational levels added to the same. So any change to the master role would be
drilled down to Child roles and hence it would avoid a lot of Maintenance overhead.

E.g.: Master Role -- Z_SAP_FI_BUYER_000

Child Role1 -- Z_SAP_FI_BUYER_CC1

Child Role 2 -- Z_SAP_FI_BUYER_CC2

Child Role 3 -- Z_SAP_FI_BUYER_CC3

Orphans Roles are Stand-alone roles and are many a times required for IS uses/. So a System Admin role, a Security
Auditor role and many other special roles mainly not used in Business side are created as ORPHANS. This role limits
the user to a particular organization.

<b>Reference Role</b>

They are SAP standard Roles.

Reward points if helpful