Question:
hello,
I’m new in SAP, I just got the HR academy course, I ‘m working in the Human Resources Information System division.
I requested from our SAP administrator to give me access to the Ad-Hoc Query that I can extract some HR data for analysis.
In fact I want to get access to the PNP, PCH, and PAP logical databases.
Our system administrator said that he cannot limit my access to these logical databases, and if he will give me access, it will be for all modules (FI,MM,etc..).
I found this not logic!
Could any one help me how to get read anly access to the HR data (only the 3 logical databases)?
Thanks to everyone that can provide some help.
Answer:
Technically Basis kind of correct, BUT The Queries produced generally get produces with an authorization group on the program and you will have to be authorized to use those with S_PROGRAM. The Logical databases generally have authorization checks in the LDB code so those are protected as long as you do not have access, Their concern is the direct table, and depending on the tool used in query those are protected with S_TABU_DIS. SO giving you access to HR data only is possible.
However Basis or Security should STILL NOT give you access to ABAP Query in production. ALL queries should be created in Development and transported to production through the normal change management and the specific query should be assigbned to the user's role using PFCG and ABAP Query SQ01, et al. NOT be used in Production.
Answer:
Hello,
Ad Hoc Query can be given with tcode S_PH0_48000513
This tcode will not need SQ01 and it validates Specifically aginst the master data (P_Orgin) authorizations you have in your security roles. You have to have your development team create info sets. The Ad Hoc Query tcode above will allow you to access infosets based on user group.
Answer:
That transaction code ALSO give you access to all other infosets so you can get to non HR data. and you have to maintian the user groups. if you use PFCG and assigne the queries to the role you will find a good many of the reports are already tied to a tcode and the user can access them directly WITHOUT the tedious user group maintenance.