Workflow Administrator authorizations

[Mark Pyc]

G'day Claude,

I can't give you the specifics you're after but I can tell you that I
wouldn't encourage SAP_ALL or anything close for a WF admin.

WF-BATCH should have SAP_ALL but that's an entirely seperate matter
since it's a batch user that no-one can log on as.

WF Admin really only needs access to WF Admin transactions (SWI1,
SWI2.., SWIA, SWU_OBUF, etc.) plus SM58 which is one that gets
forgotten often. But the WF Admin should not need any functional
transactions. Just because you've got a WF that deals with FI Docs it
doesn't mean that the WF Admin needs FB01 or FB02.

The WF Admin in my opinion should never do other peoples work for
them. They are there to assist the process. Sometimes they need to
give the process a good kick (so you do need all authorization for
manipulating work items) but you don't need access to the underlying
Functional Transactions.

That's my 2p.

Have fun,
Mark

On 4/21/05, Claude Bourque <claude_bourque at hc-sc.gc.ca> wrote:
> Greetings,
> 
> We've run across a few roadblocks recently were security wants to severely
> limit the Workflow Administrator's user id.
> 
> Although we've pointed out the SAP-delivered roles/profiles, nothing seems
> to be moving.
> 
> Can anyone share with me what kind of authorizations your administrators
> have been given? I'm assuming some kind of modified SAP_ALL.
> 
> PS: We had the same problem a while back with WF-BATCH.
> 
> Any suggestions would be greatly appreciated.
> 
> We're on 4.7 Basis 6.2.
> 
> Thanks and have a great day.
> 
> Claude Bourque
> HR/Workflow Consultant
> Health Canada
> 
> _______________________________________________
> SAP-WUG mailing list
> SAP-WUG at mit.edu
> http://mailman.mit.edu/mailman/listinfo/sap-wug
>