cancel
Showing results for 
Search instead for 
Did you mean: 

ERP permissions for DS

severin_thelen
Contributor
0 Kudos

Hi all,

I have got a problem with the ERP permissions for the DS connection.

Actual I get an RFC-CallReceive error, when I try to import tables:

It looks like, that the erp user has not all permissions he need.

I have read the DS supplement guide for SAP. This guide says, that I need the following permissions.

S_BTCH_JOB

S_RFC

S_TABU_DIS

S_TCODE

After that, the error was still there and the user needs the S_DSAUTH permission. Next step the user needs S_SDS, so I could not see an end and in my opinion it is not a great way to trace the permissions every time after grant a new one, until it works.

My question is, which permissions the user needs to import tables and load data from the ERP? (In best case you could tell me, where I could find this information).

Regards

Severin

P.S.: SAP_ALL is no option

Accepted Solutions (1)

Accepted Solutions (1)

Former Member
0 Kudos

Severin,

The additional auth object is S_DEVELOP which you will get only in the development client and not in your QA/Prod client (I hope ). You need to create a single SAP ECC datastore with multiple configurations, one pointing to DEV, the second to QA and so on. All your table imports and ABAP DFs should be done with the datastore pointing to the DEV client. Once the table imports/development is done, you can point your datastore to QA/PROD and run your jobs against it.

So basically, the following auth objects should suffice:

For DEV:

S_BTCH_JOB

S_RFC

S_TABU_DIS

S_TCODE

S_DEVELOP

For QA/PROD,etc:

S_BTCH_JOB

S_RFC

S_TABU_DIS

S_TCODE

-Chaitanya

severin_thelen
Contributor
0 Kudos

Thank Chaitanya,

but the problem is, that I permitted exactly this PROD permission to the erp user, but I still can not import the tables.

Regards

Severin

Former Member
0 Kudos

Severin,

Are you trying to import tables with your data store pointing to your PROD client?

severin_thelen
Contributor
0 Kudos

Yes. So I open the Datastore in DS (which using the ERP User with PROD permissions) and try to change to the external view. After this I get the error.

If I try to import tables by name, I get the same error.

Regards

Severin

Additional: Later I want just to read table data.

former_member187605
Active Contributor
0 Kudos

I told you that you need the DEV permissions to do what you want to, didn't I?

Former Member
0 Kudos

I am not sure I understand completely but you should NOT try to import tables with your datastore pointing to PROD. Below is how my SAP datastore looks with the default config pointing to DEV. DEV should have the 'S_DEVELOP' auth object.

1) Import your tables with your data store pointing to DEV.

2) Change config in datastore to point to your PROD or use system configurations if you have them and read data from PROD.

severin_thelen
Contributor
0 Kudos

I give this information to the customer and will post the result later.

Former Member
0 Kudos

After you check and if you are still having issues, you can try adding the following auth objects to your DEV user only if required.

S_DSAUTH

S_SDS

S_DSDEV

S_DSPGMCHK

-Chaitanya

severin_thelen
Contributor
0 Kudos

That are the permissions, which are missing, thanks. But where can I see, which permission parameters are require? (Is there any document.) The only document I found, was the update guide for DS 4.2 SP4. But this document just named the 4 permissions, so it do not really help.

Former Member
0 Kudos

Good to know it's working. While I figured it out the hard by working with a security team that set up a trace. I later found the document below specific to SAP upgrades. The authorizations are mentioned on Page 13 and 14.

http://help.sap.com/businessobject/product_guides/sbods42/en/ds_42_upgrade_en.pdf

Cheers,

Chaitanya

Answers (1)

Answers (1)

former_member187605
Active Contributor
0 Kudos

All the necesary information is in the SAP Data Services Supplement for SAP guide, indeed. More particular in section 2.4 SAP User authorizations.

But note that there's a difference between the production profile (the one you have selected) and the development and test profile (the one you need): you're missing S_DEVELOP.

severin_thelen
Contributor
0 Kudos

Thanks, I think I just miss to name S_DEVELOP.

But I have use the search function in the PDF and I do not find S_DSAUTH an S_SDS.

Because of this, I do not know, if there are more permissions I need.