WF-BATCH requires SAP_ALL & SAP_NEW profiles

[Krishna M.P.]

Hi Lisa,
 
I have never tried doing that but It is a good idea to implement. Not only
security point of view but also auditing point of view.
In my opinion, we may have to give the following areas complete authority
to WF-BATCH.
 
a) To access all workflow areas.
          S_WF_ADMIN,
          S_WF_ALL
 
b) Complete RFC admin profile ( I am not sure which one it is, check with
the Basis team ) like access to SM59 etc.
 
c) Create, change and display access for the transactions that you are
using in your workflows.
           If you have implemented only PR workflow then only PR
transactions like ME51, 52 and 53 needs to be given.
 
The above is only a high level info and my opinion to start with something,
there could be more profiles required than what I mentioned above. In any
case one has to do real good testing to come out with a correct profile for
WF-BATCH. It will vary from company to company and system to system.
 
Other problems with the above approach is every time you implement a new
workflow you may have to test for security and add the relevant security to
the above profile. So you can predict some extra maintenance because of
this.
You are the best judge to adopt what you want.
 
Regards,
Krishna Pottabatula
Tel: 713-353-0023;    Fax: 713-353-0038
Email: Krishna.Pottabatula at exxonmobil.com
ExxonMobil - GIS/GSA/GATS/SAP Programming Services
 
 
 
 
 
                    Lisa Hasenbohler
                    <lhasenbo at agrium.com      To:     SAP-WUG at MITVMA.MIT.EDU
                    >                         cc:
                    Sent by: SAP              Subject:     WF-BATCH requires SAP_ALL & SAP_NEW profiles
                    Workflow
                    <Owner-SAP-WUG at MITVM
                    A.MIT.EDU>
 
 
 
                    05/14/02 03:30 PM
                    Please respond to
                    "SAP Workflow Users'
                    Group"
 
 
 
 
 
Hi All,
 
It is recommended that system user WF-BATCH be assigned SAP_ALL and
SAP_NEW, however, our policy is that SAP_ALL or SAP_NEW should only be used
in the Production Environment when absolutely necessary (even for
non-dialog users).
 
Before I go and attempt to build a new role or profile for WF-BATCH, I
thought I would ask if anyone has developed or attempted to develop their
own role/profile for WF-BATCH and if they could share their experience with
me.
 
Thanks,
Lisa Hasenbohler