Create SAP users, roles, and authorizations

Create the SAP user, roles, and authorization objects required for the Software Asset Management integration with the central and satellite SAP systems.

Before you begin

The SAP transport files must be imported into the central system before configuring users and roles.

Role required: SAP Basis administrator

About this task

The Software Asset Management integration requires a dedicated SAP user with separate roles for the central system and each satellite system. Central system roles control background job scheduling and service access. Satellite system roles control RFC execution and table display access.

Procedure

1. Create a user ID S_SERVICENOW in your SAP system.

   If the user already exists, remove the current authorizations and set up new authorizations with central and satellite system permissions.

2. Create a central system role.

   1. Navigate to transaction code PFCG.

   2. On the Role Maintenance page, enter a role name in the Role field.

      For example, Z_SNOW_CTR.

3.  In the **Description** field, enter a brief description of the role and save.

4.  Add authorization object `S_SERVICE` and add external service name `/NOW/SAMP//NOW/SAMP_USER_DETAILS_WSDL`.

5.  Add authorization object `S_BTCH_ADM` and select the **N \(No administrator authorization\)** option in the **Activities** field.

6.  Add authorization object `S_BTCH_JOB`, select **RELE \(Release Jobs\)** in the **Activities** field, and leave the **JOBGROUP** field empty.

7.  If the central system is a SAP S/4HANA system, add authorization object `S_PROGNAM` and the following values in the corresponding fields.

    -   **P\_ACTION** — `BTCSUBMIT`
    -   **P\_PROGNAM** — `/NOW/SAMP_USER_PROG_BCKJOB_RUN`

1. Create a satellite system role.

   1. Navigate to transaction code PFCG.

   2. On the Role Maintenance page, enter a role name in the Role field.

      For example, Z_SNOW_CLT.

3.  In the **Description** field, enter a brief description of the role and save.

4.  Add authorization object `S_RFC` and fill in the following values for the fields.

5.  Add authorization object `S_TABU_DIS` and enter `03` in the **Activity** and `&NC&`, `SS` in the **Table Authorization Group** field.

6.  Add authorization object `S_TABU_NAM` and fill in the following values for the fields.

7.  Add authorization object `S_TOOLS_EX` and enter `S_TOOLS_EX_A` in the **Authorization name in user master main** field.

8.  Add authorization object `S_BTCH_ADM` and select the **N \(No administrator authorization\)** option in the **Activities** field.

9.  Add authorization object `S_BTCH_JOB`, select **RELE \(Release Jobs\)** in the **Activities** field, and leave the **JOBGROUP** field empty.

10. Add authorization object `S_RZL_ADM` and enter `01` in the **Activity** field.

11. Add authorization object `S_USER_GRP` and enter `03` in the **Activity** field and `SUPER` in the **User group in user master main** field.

1. Assign the central system role to the S_SERVICENOW user in the central system, and the satellite system role to the same user in each satellite system.

   Authorization object	Description
   S_RFC	Verifies that the called RFC user is authorized to execute RFC function modules.
   S_SERVICE	Verifies the start of your external services.
   S_TCODE	Initiates an SAP transaction from the command box or menu.
   S_BTCH_ADM	Manages background processing.
   S_BTCH_JOB	Manages background jobs.
   S_RZL_ADM	Maintains external system commands.
   S_TABU_DIS	Controls table access to users.
   S_TABU_NAM	Provides authorizations for tables based on the table name instead of the table authorization group.
   S_TOOLS_EX	Monitors tool performance.
   S_USR_GRP	Performs user maintenance for several transactions.

What to do next

Select the Remote Function Call (RFC) connections that the SAP ABAP program uses to import data from your SAP clients. For details, see Select SAP clients to import data.