Merging users of the production system and the QA system
Recently I found this article in the SAP community:
A legitimate question. After all, a QA system should have the greatest possible similarity to the productive system after a system refresh. Not only for material master data, FI documents, etc., but also for the users. In case there is a big difference in the amount of users on the Production system compared to the QA system, programs and transactions working with user master data and/or authorizations could run fine in the QA environment and bad and slowly in the Production environment. This is not what a Quality system is meant for!
Coming back to the question for having a combination of the users from Production and Quality system: unfortunately the answer from SAP is correct and this is not possible in the SAP standard. Regarding users and their handling in a system refresh (as well as in a client copy) it is always "all or nothing". In the SAP standard you have to decide which users finally you want to be there in the QA system:
- the users of the QA system before the system refresh took place
or - the users of the Production system.
In the second case you have to spend additional effort regarding the system users. System users and their passwords are typically specific to the system (despite there may be an intersection of few system users). If you just use the users as they were copied from the Production system, your interfaces to the QA system will not work anymore (accompanied by many short dumps on the connected systems).
With the "Copy user" function from "Shortcut for SAP systems" you have the possibility to keep the users from the QA system as well as the users from the Production system, and it even can be done with different approaches:
First approach: keep the users from the QA system and copy non-existing users afterwards from the Production system
Typically in the context of a system refresh the users will be saved in front of the system refresh and restored afterwards. In the "PCA" tool (where the above mentioned question is related to) the component "USERS" with all related tables will be exported / imported using R3trans, consequently all users after the system refresh will be the same as before.
With the "Copy user" function you can transfer all missing users from the Production system to the Quality system:
The "Copy user" function can copy users from an SAP client to another one (this can be a client on the same system as well as on another system) as well as from an SAP client into a file and vice versa. Here we copy the users directly from the Production system to the Quality system. By leaving out the flag in the "Overwrite existing users?" field only those users will be copied that are not existing in the target client. Users already existing will not be touched.
There are lots of flags for the individual segments of the user master data and role / profile assignments. Here all segments and role / profile assignments are used. There is a button "more..." near to the "License" flag. By using this you can specify that the users are already charged on the Production system - depending on how you deal with the license costs, this might make it easier and/or save you money.
That's it! It seems almost too easy, doesn't it? But in fact there is nothing more to do. You can do this manually after the system refresh via the GUI application (as shown here) or via the command line tool, if necessary also integrated in existing automations for the system refresh.
Second approach: keep the users coming from the Production system and add missing users, existing on the QA system before the system refresh was done.
For this you did not processed the 'USERS' component according to the PCA tool. After the system refresh you have the same users on the QA system as on the Production system. But you can't leave it like that - at least the system users with their passwords (used in interfaces from other systems) must be restored, just as they were before the system refresh. And then there are other users that may need to be restored on the QA system: there may be dedicated / anonymous test users or a project team with extended permissions.
For this you can also use the "Copy user" function, but - as it is about restoring users - you have to consider this in the pre-work of the system refresh. Just copy all users to be restored into a file:
You can also store the full amount of users into a file and reduce the amount of users to be restored afterwards. Here the selection of the users was done in advance. The small button left from the input field for the users is very useful for this!
As mentioned, of course this has to be done before the QA system is overwritten from the Production system. After it is overwritten, just restore the users from the file:
Decide, if existing users are to be overwritten or not. Typically some system users exist on both QA and Production system. If they have the same authorizations it makes no difference if they will be overwritten or not. If they have different authorizations (e.g. for RFC), it can be necessary to overwrite them from the data stored in the file.
After this the system users are back again - but not with the correct password. The "Initial password" field points to this. You can specify an initial password or - if you leave it empty - a password will be generated. In both cases it will not be the right one, that was assigned before the system refresh.
For adjusting the passwords you can use the "Set password" function:
There is no suitable mass function for assigning passwords to users available in the SAP standard. With SU10 you can generate a password for selective users, but this is not what we need. Assigning given individual passwords to users is possible in the SAP standard by maintaining each user individually only.
Here we got the data for our system users out of an Excel file, where we stored the information. The users on the left, the passwords on the right, both line by line. Once inserted, you can also save them in a Variant:
After clicking on "Execute" the passwords will be assigned in seconds:
And again: that's it. The first approach - keeping the users from the QA system and add others afterwards by copying them from the Production system - seems to be easier, but is based on the export and import of the users from the PCA tool. Or, if you do not have the required license for using the PCA tool, you can achieve the same - as described here. However, this is more common than the second approach - taking the users from the Production system and restore / adjust users (mainly system users). But also this is easily possible! Both user copy and password assignment can be performed fully automatically with the command line tool.
Before I forget: Of course, you don't have to wait until the next system refresh to complete your QA system users. Copying the users of course also works completely independent of a system refresh and can be done at any time.
Es gibt noch keine Rezension.