Change Request Management Roles in Solution Manager

Before users can start working with Change Request Management, the system administrator (or equivalent user) has to create user roles that contain the relevant authorizations, and then assign these roles to the corresponding users. The roles have to be created (by using transaction SU01) for users in the following systems:

· SAP Solution Manager system (Change Request Management runs in this system)

· Satellite systems that are managed by Change Request Management

Roles in the SAP Solution Manager System

The following roles are provided by SAP and have to be assigned to the corresponding users in the SAP Solution Manager system:

· SAP_CM_CHANGE_MANAGER

This role enables the user to approve and reject change requests.

· SAP_CM_DEVELOPER_COMP

This composite role enables the user to make corrections in the development and maintenance systems, and to release the necessary transport requests. It comprises the following single roles:

¡ SAP_SOCM_DEVELOPER

¡ SAP_CM_SMAN_DEVELOPER

· SAP_CM_TESTER_COMP

This composite role enables the user to test and validate corrections in the test system. It comprises the following single roles:

¡ SAP_SOCM_TESTER

¡ SAP_CM_SMAN_TESTER

· SAP_CM_OPERATOR_COMP

This composite role enables the user to import corrections into systems, and to perform operational tasks in task lists. It comprises the following single roles:

¡ SAP_SOCM_IT_OPERATOR

¡ SAP_CM_SMAN_OPERATOR

· SAP_CM_PRODUCTIONMANAGER_COMP

This composite role enables the user to approve and perform the import of corrections into the production system. In certain critical situations (such as during a payroll run), the production manager can decide not to import corrections into the production system; otherwise, the system could be rendered inconsistent. It comprises the following single roles:

¡ SAP_SOCM_PRODUCTION_MANAGER

¡ SAP_CM_SMAN_PRODUCTIONMANAGER

· SAP_CM_REQUESTER

This role enables the user to create change requests.

· SAP_CM_ADMINISTRATOR_COMP

This composite role enables the user to customize and check all Change Request Management functions in the Solution Manager system, as well as perform administrative and technical tasks for task lists and cProjects. It comprises the following single roles:

¡ SAP_SOCM_ADMINISTRATOR

¡ SAP_CM_SMAN_ADMINISTRATOR

¡ SAP_CPR_PROJECT_ADMINISTRATOR

¡ SAP_CPR_USER

Roles in the Satellite Systems in Solution Manager

From a transport point of view, the remote architecture of Change Request Management consists of one central SAP Solution Manager system, which is where Change Request Management runs and where all transports are controlled, and satellite systems where transport requests are created, released, and imported. In all these satellite systems, the local users need to have special authorizations within the Change and Transport System (CTS) according to their particular tasks.

· Real Users

For users in the satellite systems that have the system role types Development, Test or even Production, assign the following roles:

¡ SAP_CHANGEMAN_DEVELOPER

Contains the authorization profile S_TMW_DEVELO. This profile contains CTS authorizations for developers: No authorization to create transport requests, and no authorization to release transport requests but to create and release tasks.

¡ SAP_CHANGEMAN_OPERATOR

Contains the authorization profile S_TMW_OPERA. This profile contains CTS authorizations for operators: All transport authorizations; no configuration authorizations

¡ SAP_CHANGEMAN_ADMIN

Contains the authorization profile S_TMW_ADMIN. This profile contains CTS authorizations for administrators: All authorizations in the CTS (including configuration)

Note that the roles SAP_CHANGEMAN_PROJECTASSISTANT and SAP_CHANGEMAN_PROJECTLEAD are obsolete; do not assign them to users.

For SAP systems based on SAP Web Application Server 6.10 and lower, the profiles listed above are available, but not the roles. Therefore, you have to explicitly assign the authorization profiles to the relevant users.

· Trusted System Users

For all client system actions in Change Request Management, users are required to log on by using trusted systems. For this purpose, you must also assign trusted system authorizations to the relevant users. In particular, you have to assign the authorization object S_RFCACL. For more information, see SAP Solution Manager: Configuration Guide ® Technical Requirements ® Automatic Generation of Trusted System RFC Destinations.

· Background User

This user is required for communication between the SAP Solution Manager system landscape (transaction SMSY) and all systems that have the role type source system. For more information, see Generate/Change RFC Connections. In these logical systems, a communication (background) user is generated for executing tasks in the background (user SOLTMW). This background user automatically has the following profiles from the CTS area:

¡ S_TMW_CREATE for creating and releasing transport requests in development systems as well as for setting the project status switch for creating transport requests

¡ S_TMW_IMPORT for importing transport requests into test systems (empty)

The most important task of the background user is to create and release transport requests and tasks remotely from Change Request Management. Requests that are created in this way are known to Change Request Management, which means that Change Request Management can control the distribution of these requests within the landscape.

Requests that are created, released, or imported locally cannot be identified by Change Request Management in conjunction with a change request and are therefore not part of the Change Request Management transport control and distribution process. For this reason, we recommend that no users (apart from administrators) have authorization to create transport requests or tasks in Change Request Management-controlled clients.

· Import Authorization Checks

Change Request Management uses the import functions of the Transport Management System (TMS). The TMS remote infrastructure is based on RFC connections that point solely to the 000 client of a target system. For this reason, you must make sure that Operators and Administrators have users both in the client into which changes are imported, and in the 000 client of these systems.

· Automatic Imports

In test systems, it is sometimes necessary that imports are performed automatically. If you want developers within the Change Request Management scenario to start imports into a test system automatically, you must add the profile S_TMW_IMPORT to the user TMSADM in client 000 of the test system. Since S_TMW_IMPORT is delivered empty, you have to assign it the authorizations S_CTS_IMPALL and S_CTS_IMPSGL, which are also contained in the authorization object S_CTS_ADMI.

It is now possible to start an import into this system from every satellite system within your domain by using the CPIC user TMSADM; therefore, do not use this method in production systems or in any other security-critical systems.

The system where you want to start the import automatically must share the same transport directory as its preceding system. If the transport directories were different, the user who starts the import would need “addtobuffer” authorizations for the buffer adjustment, which would present a security risk not only for the system concerned, but also for the whole landscape (including the production system).

Authorizations in Solution Manager

The following figures show which authorizations are contained in the Change Request Management roles.

· Roles in SAP Solution Manager system

The following table shows which task list authorizations are assigned to the roles in SAP Solution Manager system:

	Developer	Tester	Prod. Manager	Operator	Administrator
Display	X	X	X	X	X
Create	X	---	---	---	X
Change	---	---	---	---	X
Delete	---	---	---	---	X
Run	X	X	X	X	X
Change status	X	X	X	X	X

· Roles in the satellite systems

The following table shows which transport request/task authorizations are assigned to the satellite system roles:

* See Roles in the Satellite Systems (Automatic Imports section)

Maintenance Optimizer Roles in Solution Manager

Technical name: SAP_MAINT_OPT_ADMIN

Technical name: SAP_MAINT_OPT_DISP

Tasks

The individual roles allow users to either administer or display product maintenance procedures in the Maintenance Optimizer.

Activities in

This individual role allows users to create and change product maintenance procedures in the Maintenance Optimizer

Activities in

This individual role allows users to display product maintenance procedures in the Maintenance Optimizer