| name | sap-security-authorization |
| description | SAP security, authorization, and compliance skill. Use when designing PFCG roles, analyzing SU53 auth errors, checking SoD conflicts, implementing SOX/GDPR compliance, configuring IAS/IPS/XSUAA, or auditing user access. If the user mentions SAP role, authorization object, SU53, SoD, SAP_ALL, principal propagation, or BTP security, use this skill. Covers on-premise, S/4HANA Cloud, and BTP.
|
| license | MIT |
| metadata | {"author":"SAP Skills Community","version":"1.1.0","last_verified":"2026-03-25"} |
SAP Security & Authorization
Related Skills
sap-s4hana-extensibility — Extension authorization patternssap-build-process-automation — Approval workflow designsap-rap-comprehensive — RAP authorization (global/instance)sap-cap-advanced — CAP-level auth with XSUAA/IAS scopessap-kyma-runtime — Kubernetes API Rule JWT validationsap-successfactors — RBP (Role-Based Permissions) model
Quick Start
Authorization error? Start here:
- Run SU53 (or for another user: SU53 → Other User)
- Check which authorization object failed and what values were needed
- If SU53 is not enough, use STAUTHTRACE for full trace (captures all checks, not just failures)
Design a role:
- SU24 — Check authorization defaults for the transaction
- PFCG — Create single role, add transactions to menu
- Generate profile → Adjust authorization values → Save
- Create derived roles for org-level variations (company code, plant)
- Assign role to user via SU01
BTP authorization:
- Define scopes and role-templates in
xs-security.json
- Create role collections in BTP cockpit
- Assign role collections to users/groups
Core Concepts
On-Premise Authorization Hierarchy
User (SU01)
└── Role (PFCG)
└── Profile (auto-generated)
└── Authorization Object
└── Field = Value
Role Types
| Type | Description | Use Case |
|---|
| Single | Contains tcodes, auth objects, field values | Job-based access |
| Composite | Groups single roles; no own authorizations | Combining functions |
| Derived (Child) | Inherits from master; only org-level values differ | Multi-org access |
Naming convention: Z_<MODULE>_<FUNCTION>_<TYPE> (e.g., Z_FI_AP_CLERK_S, _C for composite, _D for derived)
Critical Authorization Objects
| Object | Fields | Controls |
|---|
| S_TCODE | TCD | Transaction access |
| S_RFC | RFC_TYPE, RFC_NAME, ACTVT | RFC/function module execution |
| S_SERVICE | SRV_NAME, SRV_TYPE | Fiori/OData service access |
| S_TABU_DIS | DICBERCLS, ACTVT | Table access by auth group |
| S_TABU_NAM | TABLE | Table access by name |
| S_DEVELOP | DEVCLASS, OBJTYPE, OBJNAME, ACTVT | ABAP development |
| S_USER_GRP | CLASS, ACTVT | User master maintenance |
| S_USER_AGR | ACT_GROUP, ACTVT | Role assignment |
| S_PROGRAM | P_ACTION, P_GROUP | Program execution |
BTP Authorization Model (XSUAA)
User/Group
└── Role Collection
└── Role
└── Role Template
└── Scope ($XSAPPNAME.Read, $XSAPPNAME.Admin)
xs-security.json example:
{
"xsappname": "myapp",
"tenant-mode": "dedicated",
"scopes": [
{ "name": "$XSAPPNAME.Read", "description": "Read access" },
{ "name": "$XSAPPNAME.Admin", "description": "Admin access" }
],
"role-templates": [
{ "name": "Viewer", "scope-references": ["$XSAPPNAME.Read"] },
{ "name": "Administrator", "scope-references": ["$XSAPPNAME.Read", "$XSAPPNAME.Admin"] }
]
}
S/4HANA Cloud Authorization
On-premise PFCG roles are replaced by:
- Business Catalogs — Grouped app authorizations
- Business Roles — Assign catalogs + restriction types to users
- Restriction Types — Read/Write/Value Help access control (replaces org-level values)
- Maintain Business Roles Fiori app (replaces PFCG)
Common Patterns
Pattern 1: SU53 Error Analysis
1. User gets "No authorization" error
2. User runs SU53 immediately
3. SU53 shows:
- Authorization Object: S_TCODE
- Field: TCD
- Required: ME21N
- User has: ME23N, ME22N (missing ME21N)
4. Fix: Add ME21N to user's role in PFCG
For complex cases, use STAUTHTRACE:
1. STAUTHTRACE → Activate (filter: specific user, errors only)
2. User reproduces the action
3. STAUTHTRACE → Deactivate → Evaluate
4. Shows ALL auth checks with RC=0 (pass) and RC≠0 (fail)
Pattern 2: SoD Conflict Detection
Classic SoD conflicts to check:
| Function A | Function B | Risk |
|---|
| Create Vendor (XK01/BP) | Post Vendor Payment (F110) | Fictitious vendor fraud |
| Create PO (ME21N) | Approve PO (ME29N) | Unauthorized procurement |
| Maintain Customer (XD01/BP) | Post Credit Memo (FB75) | Credit fraud |
| Create Employee (PA30) | Run Payroll (PC00_M99) | Ghost employee |
| Maintain GL Master (FS00) | Post Journal Entry (FB50) | Financial misstatement |
| Change User (SU01) | Change Role (PFCG) | Privilege escalation |
Pattern 3: Security Audit Log Configuration
Transaction: RSAU_CONFIG (or SM19 on older systems)
Recommended filters (Dynamic Configuration):
1. Client: *, User: SAP* → Record ALL events (default user monitoring)
2. Client: *, User: FF_* → Record ALL events (firefighter monitoring)
3. Client: *, User: * → Record:
- Dialog logon (successful + failed)
- RFC/CPIC logon (successful + failed)
- Transaction starts
- Report starts
- User master changes
Analysis: RSAU_READ_LOG (or SM20)
Enable: Set profile parameter rsau/enable = 1
Pattern 4: BTP Principal Propagation
User → IAS (authentication)
→ BTP Subaccount (SAML trust)
→ XSUAA (JWT token)
→ Destination (OAuth2SAMLBearerAssertion)
→ S/4HANA (API call with user identity)
Destination config:
- Type: HTTP
- Authentication: OAuth2SAMLBearerAssertion
- Token Service URL: <S4HANA>/sap/bc/sec/oauth2/token
- Audience: S/4HANA SAML provider name
Pattern 5: GDPR — ILM Data Blocking
1. IRM_CUST → Define retention rules per data object and legal entity
2. Configure residence/retention periods (aligned with local tax law)
3. Set up blocking policies (simplified blocking restricts read access)
4. Schedule destruction jobs (permanent erasure after retention expiry)
5. Implement Information Retrieval for data subject access requests
Key transactions: IRM_CUST, IRMPOL, ILM_DESTRUCTION, SARA
Error Catalog
| Error | Cause | Fix |
|---|
| SU53 shows failed S_RFC check | Missing RFC authorization for function group | Add RFC auth to role: S_RFC with RFC_TYPE=FUGR, RFC_NAME= |
| "No authorization for transaction" | S_TCODE missing in role | PFCG → add transaction to menu → regenerate profile |
| Derived role not working | Master role changed but derived not adjusted | PFCG → open derived role → Adjust (Ctrl+F5) |
| 401 on BTP app | Role collection not assigned | BTP cockpit → assign role collection to user |
| SAML token exchange fails | Audience mismatch in destination | Match destination audience with SAML provider name |
| IPS provisioning fails | Attribute mapping mismatch | Check IPS transformation JSON for correct field names |
| SoD conflict in GRC | Incompatible roles assigned | Add mitigation control or remove one conflicting role |
| Audit log not recording | rsau/enable = 0 or SM19 not configured | Set rsau/enable = 1; configure filters in RSAU_CONFIG |
| User locked after failed logins | Login/password lock parameters exceeded | SU01 → unlock; check login/fails_to_user_lock parameter |
| Certificate expired in trust | SAML metadata signing cert expired | Re-exchange SAML metadata with fresh certificates |
Performance Tips
- Use SUIM reports for bulk authorization analysis (faster than manual SU01 checks)
- STAUTHTRACE with "errors only" filter reduces trace volume significantly
- Keep roles modular (5-15 auth objects per single role); composite roles combine them
- In BTP, minimize scope count per role template — JWT token size has limits
- Schedule RSUSR200 as background job for monthly dormant user detection
Key Tables
| Table | Content |
|---|
| AGR_1251 | Role → auth object → field → value |
| AGR_USERS | Role-to-user assignments |
| AGR_DEFINE | Role definitions |
| USR02 | User logon data (lock status, last logon, password hash) |
| USR04 | User-to-profile assignments |
| USOBT_C / USOBX_C | SU24 check indicators |
Bundled Resources
| File | When to Read |
|---|
references/pfcg-role-design.md | Detailed PFCG role creation guide |
references/authorization-objects.md | Full reference of critical auth objects |
references/sod-matrix.md | Comprehensive SoD conflict matrix |
references/cloud-identity-services.md | IAS/IPS configuration guide |
references/btp-xsuaa-guide.md | BTP authorization with XSUAA |
references/compliance-checklist.md | SOX, GDPR, ISO 27001 audit checklist |
templates/xs-security.json | BTP xs-security.json template |
templates/role-naming-convention.md | Role naming standard template |
Gotchas
- SAP_ALL is not a role: SAP_ALL is a profile that grants all authorizations — never assign it to dialog users; use only for emergency/firefighter with full logging
- SU53 timing: SU53 shows the LAST failed authorization check only — if multiple checks fail, you may see a misleading result; run a full trace via ST01 instead
- Derived roles and org levels: Org-level values in derived roles override master role values completely — no merge; plan org structure before role design
- XSUAA vs. IAS: XSUAA handles application-level auth on BTP; IAS handles identity/SSO — they complement, don't replace each other
- Role transport: Roles transported via SCC1/STMS carry authorizations but NOT user assignments — reassign users in target system
- SoD is continuous: SoD analysis is not one-time; new role assignments can introduce conflicts — schedule periodic GRC Access Risk Analysis
- PFCG generated profiles: After changing a role in PFCG, you MUST generate the profile AND assign it to users for changes to take effect
Source Documentation
