Question:
Hi There -
One of our consultants has requested a db (oracle) user with read only access.
The reason they need it because they want to extract data from a standard sap table and dump it into another db (sql server), then we have another application that will read the data from the sql server.
What is your comments regarding creating a db (oracle) user with read only access ?
Answer:
Are you a contractor. Looks like from the sounds you are a contractor asking for expertise to sell.
Answer:
No I am not. We just bought a 3rd party datawarehousing product called Q4bis, and this product needs to extract data from some SAP tables. The scary part is that they want to read the data directly from oracle level.
At the moment we just give them temprarily the sapr3 user access to extract data from our DEV. But I am not sure whether we should give the same user access in PRD or not.
Answer:
...you have to pray that someone do not use in wrong way the sapr3 user....
If they delete the user, Oracle will remove the schema as well, and your R/3 is gone....
bye
Answer:
Hello,
never give the SAPR3 users password to anyone Its worse than you give sap_all to everybody. You throw away the whole authorisation system and if any misuse happens you will have no logs about it.
I can imagine 3 solutions:
1/ ABAP/4 report. You can ask the consultant to write an abap riport to dump the data into a VSC file. Then the file can be feeded to the Q4bis. This way you can control by the report what data will the Q4bis get.
2/ external program. The SAP can be accessed by RFC calls. If the Q4bis does not have RFC inetrface for R/3 then you can write some simple C or Java code with SAPs RFC SDK.
3/ DB link. You can create a new user in the database and grant access to some tables. I suggest to create an interface table and dump there only the required data. (its still one of the worst solutions)
+1/ kick out the consultant. Lot of consultants learned their profession in our SAP systems. And we paid them for it
Regards,
Zavaros
Answer:
Another easy solution is just to use sqlplus and create an oracle account. Then grant "connect" and "select any table" to the user.
If you are worried about security, then you would need to grant specific sapr3 tables. It is not hard to do, just tedious.
Answer:
Johnny -
We created a new oracle user and grant 'select' to the sap tables they need. Do we need to grant 'index' as well ? what grant index does?
Others -
But, we have realised that this solution wont working well, since we need to extract data from sap non-transparent table. So we are now thinking to write an abap program to dump the data into a text file as Zavaros suggested and then feed that text file to sql server.
Answer:
You may also create an entry in DBCON to connect to the sql server via ABAP. This will allow you put the data into SQL Server directly and save devlopment time on the datawarehouse side. It also allows you to control all security via SAP authorizations and when the data pull schedule.
Answer:
Can you give me any refference or docs how to use DBCON ?
thanks
Answer:
If you extract data from BW for a third party system SAP will charge license fees for the users of the third party system (if they find out).
We came up against this but managed to avoid the cost because all of the users of the third party system already had BW user IDs.
I am not sure if this applies to R/3 or other SAP components