Role Upload & Download in SAP

We create roles in development system later moves these through  across landscape (Development-->Quality-->Production).

To move roles from one system to another system,two  possible ways are there.                            

1.Role transport
2.Role download and upload

Here we discuss 2nd option  Role upload/download.

We have to create new objects/roles/tables etc… in development and need to move all these objects to production.

We should maintain all the change history of all changes.

To maintain all authorization data of a role ,we can do either download/upload or role transport.

Here we are now discussing how to perform download and upload and advantages and disadvantages….

We can download single roles/composite roles/mass roles.. using PFCG.

When we will perform this role download and upload:

If we don’t have RFC connection in a landscape then will use this scenario. most of the companies are not following this process. Why because we cant find role history if we download/upload the roles

And second point is some times will lose the authorizations in a role after upload in SAP.

And user assignment comparison and role profile generation will not save. We have do user comparison and profile generation manually after uploading the roles into SAP.
 STEPS to download & upload:

1.login to SAP and execute PFCG.

Go to Role->expand ->select download option.

By using download option we can do only one role. If you want to download mass roles then go to Utilities->Mass download.

2. now select the location and download the roles …

Role will save as .SAP format.

 Now message will prompt as roles downloaded successfully.

 
 Role will be save on desktop as  beside

3.Next open the target system and then go to PFCG.
Go to Role-> upload

Then Go to desktop, select the role name & click on Open button.







After upload roles to SAP ,you should regenerate the profiles and do user master comparison.
Use the same process To download/upload MASS ROLES.

 

To do  upload /download,The security admin needs  UL/DL activities under S_USER_AGR authrization object in SU01 T-code.


To know about Role Transport request creation