Adjustments to the dialog user roles may be necessary in particular if the authorizations on the ABAP side are to be defined specifically.
The given dialog user roles are composite roles that consist of two single roles. For example, the role SAP_XI_DEVELOPER consists of the following two single roles:
· SAP_XI_DEVELOPER_ABAP (contains ABAP authorizations)
· SAP_XI_DEVELOPER_J2EE (contains J2EE authorizations)
The suffixes are also used for other roles in the same way.
To make changes to authorizations on the ABAP side, proceed as follows for each dialog user role:
1. Call transaction PFCG.
2. Copy the single role SAP_XI_<role>_ABAP into the customer namespace (replace the prefix SAP).
3. Create a new composite role in the customer namespace (for example, *_XI_<role>).
4. Assign the new single role (suffix _ABAP) to the new composite role.
5. Assign the new SAP single role (suffix _J2EE) to the new composite role.
6. Make changes to the new single role (suffix _ABAP).
7. Generate an authorization profile for the new single role (suffix _ABAP).
This is summarized and illustrated in the diagram below.
Basically what is important is that the single roles with a J2EE suffix are still assigned to the current composite role. These J2EE single roles are known to the J2EE applications and are required for automatic authorization assignments during deployment.