Manage Roles

Manage permissions to multiple login accounts by creating roles and granting roles to logins.

Note: Only a system security officer can create, modify, or delete roles.

A system security officer can define and create roles as a convenient way to grant and revoke permissions to several logins. A role can be granted only to a login account or another role.

When creating or modifying roles, these options are available:

Choose permission access for object types or command type
Expire passwords
Set mutually exclusive roles
Set role hierarchy
Assign logins to roles
Set passwords

Permissions

Permissions granted to roles override permissions granted to users or groups. For example, if John is granted the role of system security officer and individual permissions of sales accounts, he can still access the sales accounts if his individual permissions are revoked because his role permissions override his user permissions.

Hierarchical Roles

A system security officer can define role hierarchies such that a role can be assigned to another role. For example, the chief financial officer role might contain both the financial analyst and the salary administrator roles.

Mutually Exclusive Roles

Roles can be defined to be mutually exclusive. The supported exclusive types are:

Membership – one user cannot be granted two different roles. For example, the system administrator and system security officer roles can be defined as mutually exclusive for membership; that is, one user cannot be granted both roles.
Activation – one user cannot activate, or enable, two different roles. For example, a user might be granted both the senior auditor and the equipment buyer roles, but is not permitted to have both roles enabled simultaneously.

Expiring a Role Password
Use SAP Control Center to change a password for a role.
Creating a Role
You can grant login to one or more roles. You can also grant roles to other roles.
Restoring System Roles
Return system role privilege to the default system-defined values.
Role Properties
Use the Role Properties window to set passwords, assign logins to roles, set permissions, hierarchically map roles, and set roles as mutually exclusive.
Revoking Object Permission from a Role
Revoke database object permissions from a role.
Granting Object Permissions to a Role
Use object access permissions to regulate the use of specific commands that access specific database objects.
Revoking Privileges from a Role
Revoke system privileges from roles.
Granting Privileges to a Role
Grant system privileges to roles at the server or database level.
Creating Role Hierarchy
To manage permissions or privileges for one or more logins, you can grant roles hierarchically.
Managing Mutually Exclusive Roles
To prevent users from being granted different roles, or activating two different roles, use mutually exclusive roles.
Removing Login Profiles Assigned to a Role
Remove login profiles currently assigned to a role.
Assigning Login Profiles to a Role
Assign a login profile to a role.
Removing Logins Assigned to a Role
Remove login accounts assigned to roles.
Assigning Logins to a Role
Assign one or more logins to a role.
Setting Command Permissions for a Role
Manage login account privileges by granting command permissions to a selected role.

Parent topic: Security