Roles and profiles [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.

---

开发者_运维百科

Want to improve this question? Add details and clarify the problem by editing this post.

Closed 2 years ago.

Improve this question

What is the difference table AGR_PROF from table AGR_1016?

---

Both tables deal with the generated profiles for a role. The role SAP_BC_JSF_COMMUNICATIONS does not come with a pre-generated profile, so unless you generate one for yourself or someone else has done that on your system, it's to be expected that the tables do not contain any information for this role.

AGR_PROF contains the language-dependent description text of the generated profile as well as the profile ID. As you can see by looking at the primary key, only one entry can exist for each profile and language. This entry defines the "master profile name". AGR_1016 can contain multiple entries for a single role, so it's technically not surprising that there are more entries in this table than in AGR_PROF. The conceptual reason behind this is that there's a size limit to a single profile. This size limit was hard-wired into the kernel at a time where there were comparatively few authorization objects. Nowadays, it's easy to create a role whose generated profile exceeds the size limit. Instead of changing the kernel structures, SAP decided to just generate multiple profiles for a single role, all of which can be seen in AGR_1016. You'll notice that for COUNTER > 1, PROFILE+10 is simply incremented.

And as a side note - "what profiles are included in the role" triggers the semantic equivalent of a ?SYNTAX ERROR. Profiles are generated from the role, not included by it.