Roles and profiles

2.1k views Asked by At

What is the difference table AGR_PROF from table AGR_1016?

1

There are 1 answers

3
vwegert On BEST ANSWER

Both tables deal with the generated profiles for a role. The role SAP_BC_JSF_COMMUNICATIONS does not come with a pre-generated profile, so unless you generate one for yourself or someone else has done that on your system, it's to be expected that the tables do not contain any information for this role.

AGR_PROF contains the language-dependent description text of the generated profile as well as the profile ID. As you can see by looking at the primary key, only one entry can exist for each profile and language. This entry defines the "master profile name". AGR_1016 can contain multiple entries for a single role, so it's technically not surprising that there are more entries in this table than in AGR_PROF. The conceptual reason behind this is that there's a size limit to a single profile. This size limit was hard-wired into the kernel at a time where there were comparatively few authorization objects. Nowadays, it's easy to create a role whose generated profile exceeds the size limit. Instead of changing the kernel structures, SAP decided to just generate multiple profiles for a single role, all of which can be seen in AGR_1016. You'll notice that for COUNTER > 1, PROFILE+10 is simply incremented.

And as a side note - "what profiles are included in the role" triggers the semantic equivalent of a ?SYNTAX ERROR. Profiles are generated from the role, not included by it.