BI security concepts - SAP authorization concept for a non-transactional system
What is BI:
SAP Business is a separate system containing historical data used primarily for reporting. When we work on the SAP ECC SAP System, we consider real-time transactional data. The SAP BI system is mainly used by managers and supervisors to obtain high level summary information.
Data and BI access points:
Data is stored in Cube, which is basically a table and is displayed to end users as queries. SAP has implemented web-based tools and tools for extracting data. Tools are a convenient way to display data so that end users can easily view it. The concepts of BI Security are to ensure the security of SAP BI queries, as well as the SAP BI data displayed in questions.
Security concepts for querying / data security:
When we protect a request, we basically restrict who has access to them. But when we limit the data, we determine what information in the request is visible to another person. For example, you have a request for product sales worldwide, and a user from the United States executes a report, he only needs data for product sales in this country. The constraint here may be the company code or installation site or both.
Prerequisite:
When you create a request, the company / plant code must be a mandatory variable.
Security concepts for roles in:
There are three types of users in the system — advanced users, casual users, and SAP BI System Support. SAP BI does not have enough transactions for SAP Security Consultant to limit. The primary transaction for end users of SAP BI is RSRT, and system administrators are RSA1.
PS: There are other transactions.
Security concepts for roles:
Because the data should be limited in Query, BI security concepts are very simple. We will only have a folder role, query execution / role support, data restriction role and a common role for end users.
Folder roles:
The role of the folder has no authority; rather, it is the owner of the place where the report, books and questions are stored. Some of the examples include: financial BI reporter, HR BI reporter, etc. These roles are assigned to end users for their display, and the power user for changing folder roles and pressing the query as an SAP BI folder.
Request Execution:
The query execution role SAP BI will have access only to execute the query without any access to modify or create queries. This role is provided only to occasional users.
Query support:
These role support queries have access to Create Change and update Queries. These roles are provided to Power users who can create and assign requests to the appropriate folders.
Data Role:
This role will have restrictions on the objects of information, so the request may be limited to the corporate code or the organization of the plant or sales or all of them. The security administrator is assigned the task to make the relevance of the Info object relevant and to configure the constraint in the RSECADMIN transaction. This role can be assigned to casual users, power users and support users.
The overall role of SAP BI:
This role basically contains transactions used by all users in the system. Some of the transactions will be SU53, SU56, SU3 SPO1, etc.
BI security concepts for accessing the user tier:
Power users: these users have advanced knowledge in some applications. Authorized users are assigned special permissions or roles and reports are generated in accordance with the requirements of the management or executive. Usually for each functional area there will be special users. For example, one Power user will create a report mainly for HR, while others will create reports only for finance. The main task of experienced users is to create, publish and modify reports.
Casual users: these are mostly senior managers and executives who rely on data for decision making. Their main task is to simply look at the data. They will only participate in how they want to report.
System support This includes users who support the SAP BI system, including developers, SAP database administrators, and security administrators.
