BW/4HANA Security: SAP BW/4HANA Migration (Remote Conversion)

Introduction

SAP BW/4HANA is a next generation data warehouse solution developed by SAP. The underlying foundation of SAP BW/4HANA is the SAP HANA in-memory database, which means that the data is stored and processed in the main memory of the server resulting faster data retrieval, processing, and analytics compared to traditional disk-based databases.

SAP BW/4HANA simplifies data modeling, enables real-time analytics, and supports integration with advanced technologies like big data and machine learning. It helps organizations consolidate, manage, and analyze large volumes of data, providing timely insights for data-driven decision-making.

Organizations that have been using the earlier version of SAP BW can migrate to SAP BW/4HANA. The migration process involves converting the existing data models, objects, and applications to the new platform, taking advantage of the improved features and capabilities.

Business Scenario:

Organization is planning to migrate from BW to BW/4HANA solution but they are keen to know the impact on security authorizations. Also, the security authorization activities to be carried out as a part of the migration. This article will help the organization to achieve their requirements in terms of security authorizations.

Step1: Transport SU25 changes

• Create a transport request in BW system for customer tables.
• Transport the customer tables from BW to BW/4HANA system.

Step2: SAP BW Users.

• Discuss with the business about the SAP BW user master i.e. how they want to handle the users in BW/4HANA system.
• If business agrees for client copy via BW system then copy profile SAP_UONL (User Without Authorization Profiles and Roles) into BW/4HANA system.

Step3: Transport BW Analysis Authorizations

• Discuss with the business and identify the list of BW analysis authorizations which are in scope i.e. BW analysis authorizations which needs to be available in BW/4HANA system.
• Transport the scoped analysis authorizations from BW to BW/4HANA system.

Step4: Transport BW roles

• Discuss with the business and identify the list of BW roles which are in scope i.e. BW roles which needs to be available in BW/4HANA system.
• Transport the scoped roles from BW to BW/4HANA system.

Step5: Run SU25 Steps

• Execute SU25 steps i.e. Step 2A, 2B, 2D and 2C
• Extract the list of impacted roles, discuss with the business and remediate the roles.

Step6: Execute Transfer of Authorizations into BW/4HANA

• BW specific authorizations for object types get impacted when we convert SAP BW to SAP BW/4HANA system like InfoCubes and those must be replaced by authorizations for corresponding object types like ADSO.
• Program “RS_B4HTAU_CREATE_RUN” gives you the list of impacted authorizations for the corresponding object types.
• Run Program “RS_B4HTAU_CREATE_RUN” into BW/4HANA system.

Fig.1.1

Create Rule ID to perform Transfer of Authorizations

Fig.1.2

Add the required BW/scoped roles which needs to be analyzed.

Fig.1.3

Click on the settings button to add the Suffix for the new BW/4HANA role i.e. when you execute this tool, system automatically creates new role with adjustment of authorizations for corresponding object types.

Fig.1.4

Selected BW/scoped roles with corresponding new BW/4HANA roles (with suffix) gets available in the Transfer of Authorizations tool.

Fig.1.5

Click on Initial Run and Delta Run to perform the analysis on the selected BW roles.

Fig.1.6

The output of Initial Run and Delta Run gives you the following Action Types:

ASSUME: No change in authorizations for object types i.e. Authorization will continue to work even after the conversion.

Fig.1.7

ADJUST: Check if there is any change in the values of authorization object and adapt it accordingly.

Fig.1.8

REPLACE: Change the Authorization Objects and adapt it’s values accordingly.

Fig.1.9

Fig.1.10

OBSOLETE: Authorization object is not supported or obsolete, should be removed/deactivated from the role.

Fig.1.11

Click on the Generate button to create and generate the new BW/4HANA role with defined suffix.

Fig.1.12

Role gets created & generated into BW/4HANA system with automatically adjustments of All Action Types.

Note:

1. If there is a business requirement that not to create any new role and wants to make use of the existing role then based on the Action Types, existing roles must be modified manually via PFCG.

2. SAP BW/4HANA has some Fiori Apps which can be enabled and mapped into the roles based on the business requirement.