Hello,
Can anyone help me to clarify some things regarding Support Pack upgrades and authorizations please.
With each support pack, most of the time some authorization roles are updated. For example, from SP6 to SP7; the role SAP_SUPPDESK_PROCESS gained access to KNAR transaction type in objects CM_ORD_LP and CM_ORD_PR.
This update is obviously only done in the standard SAP role. But I already have my own ZSAP_SUPPDESK_PROCESS, in which I have added the authorization for my Z-transaction types, such as ZMIN and ZMPR.
Now I wonder how I can get the update for the KNAR transaction type in my Z-authorization role, in an automated way. In this case, it is not a lot of work to add KNAR manually, but this is not the only update.
I am aware that after a SP upgrade, you need to redo some steps in SOLMAN_SETUP. One of them is for ITSM, Step 2.5: create template users. This step had a yellow exclamation mark, meaning it needed an update.
It indicated that the SAP_SUPPDESK_PROCESS role needed an update:
However, executing this update has a serious drawback: this step actually OVERWRITES my ZSAP_SUPPDESK_PROCESS completely. Meaning that now it does give access to KNAR, but no longer to ZMIN and ZMPR…
I also read the Security Guide, which mentions that you need to use transaction SU25 after an upgrade. However, when I look at ZSAP_SUPPDESK_PROCESS in step 2C of SU25, it does not suggest to add KNAR like I expected it to.
I figured that SU25 does not compare SAP_SUPPDESK_PROCESS to ZSAP_SUPPDESK_PROCESS, but it just looks at the transactions in the Menu of ZSAP_SUPPDESK_PROCESS and checks the data from SU24 against it. And the adding of KNAR is nowhere in these data.
So, does anyone know what the correct procedure is to update Z-roles after a support pack upgrade? Or do all these updates need to be added manually to the Z-roles?
Kind regards,
Joyca