Error when Extracting Metadata from ECC

[Former Member]

Hello,

DS 4.2 was working fine with ECC after the creation of RFC connection. I was able to pull some of the tables. but after Basis team made some security changed with the objects, I am not able to pull the metadata from ECC.It is showing the following error. Can any one help me with this.

[akhileshkiran · Accepted solution]

Hi

I hope this below threads will help you out. It is something related to authorization related to ETL account.

The solution for this issue which is by granting the SAP_ALL authorization to the ETL account. As Istimawan mentioned in the below thread.

  SAP_ALL authorization for "system" user type | SCN

Regards,

Akhileshkiran.

[Former Member · Accepted solution]

Akhilesh,

Thanks for your reply. I want to know what exact role should be define in the security. If SAP_ALL is not a best practice then what is the solution? what is level of security that is to be assigned in order to extract metadata from ECC?

Based on the experts discussion, I think we should assign all the roles under S_RFC and S_RFCACL what do you think?

[akhileshkiran · Accepted solution]

Hi

As per there discussion
Yeah it is not a best practice to assigning SAP_ALL. You should create a new role with authorization. Please contact your basis team. Ask them to create a New role and grant Authorizations. But in some cases SAP recommended to assign SAP_ALL authorization. 

Hope this will help you out

Authorization Profile SAP_ALL - Identity Management - SAP Library

This composite profile contains all SAP authorizations, meaning that a user with this profile can perform all tasks in the SAP system. You should therefore not assign this authorization profile to any of your users. We recommend that you create only one user with this profile. You should keep the password of this user secret (store it in a safe) and only use it in emergencies (see also Protective Measures for SAP*).

Instead of using the SAP_ALL profile, you should distribute the authorizations it contains to the appropriate positions. For example, instead of assigning your system administrator (or superuser) the authorization SAP_ALL, assign him or her only those that apply to system administration, namely the S_* authorizations. These authorizations give him or her enough rights to administer the entire SAP system, without allowing him or her to perform tasks in other areas such as Personnel.

Best Practice - How to analyze and secure RFC connections - Security and Identity Management - SCN W...

Regards,

Akhileshkiran

[Former Member]

Thanks Akhileshkiran for your help!!!!