(Glue-2108) Standard SAP Authorizations

Users working with Glue should have access to relevant transaction codes and authorizations required for the Glue functionality.

The following SAP authorization objects are required for the Glue functionality. Please see below a description on how to set up the individual authorization objects.

• S_TCODE - authorization for transaction codes
• S_APPL_LOG - authorization for displaying logs
• S_RFC_ADM - authorization for Hadoop storage access (create Glue table, extraction, etc.)
• S_GUI - authorization for GUI activities
• S_BTCH_JOB - authorization for background job operations and scheduling (extraction)
• S_DATASET - authorization for temporary storage (Extractor rules, Glue TMS)
• S_SYS_RWBO - authorization for WBO Proxy Functions - creation and generation of a transport (Glue TMS)
• S_TRANSPRT - authorization for transport (Glue TMS)
• S_DEVELOP - authorization for inserting the ABAP code into the extraction (e.g. lookups, routines, etc.) and debugging
• S_RS_COMP - authorization for BEx query extraction
• S_RS_ICUBE - authorization for InfoCube extraction

Set up of authorization objects

S_TCODE

The main entry point for Glue is through the transaction code /DVD/GLUE. Other dedicated transaction codes may access parts of the functionality. Even when entering Glue through the main transaction /DVD/GLUE, the user should have access to these transaction codes through the authorization object S_TCODE.

Glue specific transaction codes:

• /DVD/GL11 - Glue Data Dictionary
• /DVD/GL16 - Glue Data Browser
• /DVD/GL14 - Glue Dictionary Utility
• /DVD/GL38 - Glue Script Editor
• /DVD/GL80 - Glue Object Navigator
• /DVD/GLWB - Glue Extractor Workbench
• /DVD/GLIP - Glue InfoProvider Management 
• /DVD/GLTR - Glue Transport Management
• /DVD/GL_DBT - Glue Trigger Management

Users should also have these additional authorizations:

• SM50 - Work process overview - not required on prod
• SM04 - Work process details (required for detail display in the transaction SM50) - not required on prod
• SE16 - Data Browser - not required on prod
• SE38 - Program execution - not required on prod
• SM36/SM37 - Background jobs 
• SE80 - Object Navigator

S_APPL_LOG

Fill in the fields with the following values:

• ACTVT - 03
• ALG_OBJECT - /DVD/GL
• ALG_SUBOBJ - /DVD/*

S_RFC_ADM (only for Hadoop storages)

Fill in the fields with the following values:

• ACTVT - 03
• RFCTYPE - <dummy>
• RFCDEST - storage RFC
• ICF_VALUE - <dummy>

S_GUI

Fill in the fields with the following values:

• ACTVT - 02, 61

S_BTCH_JOB

Fill in the fields with the following values:

• JOBACTION - RELE, SHOW
• JOBGROUP - *

S_DEVELOP

Fill in the fields with the following values:

• DEVCLASS - ZXXX (package used for transporting Glue objects, e.g.: ZGLUE_OBJ)
• OBJTYPE - *
• OBJNAME - Z*, Y*
• P_GROUP - *
• ACTVT - *

S_RS_COMP

Fill in the fields with the following values:

• ACTVT - 16 (execute)
• RSINFOAREA - *
• RSINFOCUBE - *
• RSZCOMPID - *
• RSZCOMPTP - *

S_RS_ICUBE

Fill in the fields with the following values:

• ACTVT - 03 (display)
• RSICUBEOBJ - DEFINITION
• RSINFOAREA - *
• RSINFOCUBE - *

Development only objects:

S_DATASET

Fill in the fields with the following values:

• PROGRAM - SAPLLOCAL_EDT1, SAPLSTRF
• ACTVT - *
• FILENAME - *

S_SYS_RWBO

Fill in the fields with the following values:

• DOMAIN - *
• DESTSYS - *
• TTYPE - DTRA, TASK
• ACTVT - 01

S_TRANSPRT

Fill in the fields with the following values:

• TTYPE - DTRA, TASK
• ACTVT - *

T-code - required authorization object matrix: