Snow For SAP

Hi

Apologies that you have not heard back from the anyone in the community with regards to your automatic assignment question.  

The best solution would be to raise a new support case via Support Portal, and share any screenshots/information on what you have tried, then they may be able to assist you with their knowledge or pass to the relevant team.

Kind Regards

Mark Stenning

Global Solution Success Manager

Thanks for your inquiry. Before going into the detailed answers, some general remarks: The roles delivered with Snow Optimizer are sample roles, designed to enable quick implementations and not restricting certain functionalities of the product - as the suffix _ALL also implies. If a customer wants to restrict the functionalities or limit them to be used by specific users only, he will need to create his own authorization roles, as it it also the case with SAP standard functionalities.

• S_B TCH_ADM with value Y (should only be assigned to Basis Administrators) Why is this needed?

To be able to schedule batch jobs is an important requirement for a lot of functions in the Snow Optimizer. In addition to that, we offer

the so-called Master Job feature which requires, at least for an admin-type user, the mentioned authorization.  

• S_GUI with value 04, 60, 61 (04 is never used. 60/61 can´t be restricted to certain files so would apply to all files in the system = risk)  Why is this needed?

 Certain functionalities in the Snow Optimizer require up- and download of files from/to the PC desktop.

• S_ALV_LAYO with value 23 (this allows you to maintain global lay-outs) Why is this needed?

 Most reports in the Snow Optimizer use ALV screens. We didn't want to restrict the ability to create layouts for other users.

• S_DEVELOP act 03 for object type SUSO (authorization objects) Why is this needed?

 You will notice that this authorization is automatically included if transaction SU53 is assigned (which is part of our role /DYNAM/MASTER_ALL). It can be regarded as uncritical.

• S_RFC: please provide function modules, not function groups so we know exactly which RFCs are being executed.

We don't do this because in the course of development of the product we often need to add or remove function modules called by RFC. Using function groups instead of individual function modules in the authorization role greatly reduces the need for customers to update the satellite authorization roles with every update of the product. We have customers with hundreds of connected satellite systems - for them this would be unacceptable. If you absolutely need to avoid the use of function groups, we can support you, but we don't recommend this approach.

• S_TABU_CLI: should not be used as it allows cross client maintenance. Why is this needed?

 Snow Optimizer needs to read some client-independent system configuration data. 

• S_TABU_DIS: we will only use S_TABU_NAM so please provide table names, not groups.

 The same argument as for S_RFC applies here.

• Role DYNAM/SATELLITE_DATA_LOAD allows user maintenance. Please clarify why this is needed. What kind of users are in scope of this?

The mentioned role doesn't allow user maintenance, only displaying user data (activity = 03) is authorized. However, the role /DYNAM/SATELLITE_UPDATE allows the change of user master data. This is mainly needed to update the license type of the users to support SAP license audits, but also to maintain some others relevant user master data fields for licensing purposes. BTW, we support restricting the changeable fields by our own authorization checks.

• Role DYNAM/SATELLITE_LAW_CENTRAL_RFC: please clarify what the LAW system is and what kind of data are you transmitting between SNOW optimizer and the LAW system.

 LAW is the "License Administration Workbench" transaction from SAP. This is to support the regular license measurement from SAP.

Hi,

Snow Optimizer for SAP checks these tables to look for change documents.

There is a group of tables that the SAP standard license measurement monitors. Users making changes in these tables are typically required to have Professional or Limited Professional licenses.

Snow Optimizer is performing a similar check.

Only the presence of a change document and the type of change document is recorded. No additional details are gathered (eg specific details of the business document).

One can select what type of data one loads and can omit this data if required. Although doing this will limit some of the reporting and user license analysis functionality.

The RFC user is assigned a composite authorization role. Removing the single role /DYNAM/SATELLITE_PROF_LIM_LOAD will will restrict the ability to to access this data.

It should be noted that no data is leaving the SAP environment. It is being transferred from one internal customer SAP system to another. On both systems access to the data will be subject to SAP authorization controls.

If one wishes to further secure the ability to access "sensitive data" it is recommended to use trusted RFCs.

A list of tables/table groups can be supplied if required. (please log a support ticket for this)

Alternatively running a trace on the satellite system will a data load is taking place should provide you with the information that you required.

Hi,

You can go directly to version 3.3. This is always the case for Snow Optimizer for SAP upgrades. There is no requirement to update to interim releases, you can go directly to the latest release from any older version.

You will find the documentation (PDF Installation Manual) bundled together with the software. The section "Upgrade from an older version" (page 8) describes the process. It's the imports of SAP transports.

In the software download area you will find links to the online documentation documentation. There is a section titled "release notes" both under 3.3 & 3.2 which details the new features in the new versions.

Gutentag Herr Krambrich,

please raise a ticket in the support portal. This will direct it to the correct people.

Mit freundlichen Grüßen,

Jelle