## 13.3.4.3.4.2  Authorizations
## Use
Employee Self-Service uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to ESS.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP.
##  Note
For more information about how to create roles, see Role Administration .
## Role and Authorization Concept for Employee Self-Service
Employee Self-Service embraces services from a variety of SAP applications and also uses the authorizations of these individual components. Most of these services belong to HCM components, see Authorizations for Human Resources .
## Standard Roles
The tables below show the standard roles that are used for authorizations by the Business Package for Employee Self-Service (up to and including 1.50 ) and by Employee Self-Service (WDA) .
Standard Roles for the Business Package for Employee Self-Service
| Role                  | Name                                                  | Description                                                                                                                                                                     |
|-----------------------|-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_ESSUSER_ERP05     | Single Role with all Non-Country-Spe- cific Functions | Single role that comprises all non coun- try-specific functions.                                                                                                                |
| SAP_EMPLOYEE_ERP05_xx | ESS ERP05: Country-Specific Func- tions for <Country> | Single role comprising country-specific functions. A separate role exists for each country version ( xx = country ID). The corresponding composite role is SAP_EMPLOYEE_ERP05 . |
| Role             | Name                                | Description                                                                                                                                                                                                                |
|------------------|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_ASR_EMPLOYEE | HRAdministrative Services: Employee | Enhancement of the role SAP_ESSUSER_ERP05 for the employ- ees that use the functions of the component PA-AS (HR Administrative Services) in the Business Package for Employee Self-Service (up to and in- cluding 1.4.1 ). |
##  Caution
For the Business Package for Employee Self-Service , you also need SAP Note 857431 for generating the authorization profiles.
Standard Roles for Employee Self-Service (WDA)
| Role                      | Name                                 | Description                                                                                                                                                                                                         |
|---------------------------|--------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_EMPLOYEE_XX_ESS_WDA_2 | ESS International Single Role        | Authorizations for all international serv- ices in Employee Self-Service (WDA). For more information about this and all other Employee Self-Service (WDA) roles, see Single Roles for Employee Self-Service (WDA) . |
| SAP_EMPLOYEE_AU_ESS_WDA_1 | ESS Single Role for Australia        | Authorizations for country-specific services for Australia in Employee Self- Service (WDA).                                                                                                                         |
| SAP_EMPLOYEE_CA_ESS_WDA_2 | ESS Single Role for Canada           | Authorizations for country-specific services for Canada in Employee Self- Service (WDA).                                                                                                                            |
| SAP_EMPLOYEE_CH_ESS_WDA_1 | ESS Single Role for Switzerland      | Authorizations for country-specific services for Switzerland in Employee Self-Service (WDA).                                                                                                                        |
| SAP_EMPLOYEE_CN_ESS_WDA_1 | ESS Single Role for China            | Authorizations for country-specific services for China in Employee Self- Service (WDA).                                                                                                                             |
| SAP_EMPLOYEE_DE_ESS_WDA_1 | ESS Single Role for Germany          | Authorizations for country-specific services for Germany in Employee Self- Service (WDA).                                                                                                                           |
| SAP_EMPLOYEE_HK_ESS_WDA_1 | ESS Single Role for Hong Kong, China | Authorizations for country-specific services for Hong Kong, China in Em- ployee Self-Service (WDA).                                                                                                                 |
| Role                         | Name                                  | Description                                                                                                                                                                               |
|------------------------------|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_EMPLOYEE_IN_ESS_WDA_2    | ESS Single Role for India             | Authorizations for country-specific services for India in Employee Self- Service (WDA).                                                                                                   |
| SAP_EMPLOYEE_JP_ESS_WDA_2    | ESS Single Role for Japan             | Authorizations for country-specific services for Japan in Employee Self- Service (WDA).                                                                                                   |
| SAP_EMPLOYEE_MY_ESS_WDA_1    | ESS Single Role for Malaysia          | Authorizations for country-specific services for Malaysia in Employee Self- Service (WDA).                                                                                                |
| SAP_EMPLOYEE_PT_ESS_WDA_1    | ESS Single Role for Portugal          | Authorizations for country-specific services for Portugal in Employee Self- Service (WDA).                                                                                                |
| SAP_EMPLOYEE_SG_ESS_WDA_1    | ESS Single Role for Singapore         | Authorizations for country-specific services for Singapore in Employee Self-Service (WDA).                                                                                                |
| SAP_EMPLOYEE_TH_ESS_WDA_1    | ESS Single Role for Thailand          | Authorizations for country-specific services for Thailand in Employee Self- Service (WDA).                                                                                                |
| SAP_EMPLOYEE_US_ESS_WDA_1    | ESS Single Role for the United States | Authorizations for country-specific services for the USA in Employee Self- Service (WDA).                                                                                                 |
| SAP_FI_TV_WEB_ESS_TRAVELER_2 | ESS Single Role for the Traveler      | Authorizations for ESS services for the traveler role in Employee Self-Service (WDA).                                                                                                     |
| SAP_ASR_EMPLOYEE_SR_HCM_CI_3 | ESS Single Role for HCMP&FServices    | Authorizations for international ESS services from the HRProcess and Forms application in Employee Self- Service (WDA).                                                                   |
| SAP_PM_EMPLOYEE_HCM_CI_1     | ESS Single Role for HCMPMServices     | Authorizations for ESS services from the Performance Management applica- tion in Employee Self-Service (WDA).                                                                             |
| SAP_TMC_EMPLOYEE_6           | Employee in Talent Management         | Authorizations for ESS services from the Talent Management and Talent Development application in Employee Self-Service (WDA). For more infor- mation, see Employee in Talent Management . |
| Role                    | Name                                | Description                                                                                       |
|-------------------------|-------------------------------------|---------------------------------------------------------------------------------------------------|
| SAP_RCF_ESS_SR_ERC_CI_4 | E-Recruiting services for ESS (WDA) | Authorizations in SAP E-Recruiting for employees that use SAP E-Recruiting services in ESS (WDA). |
| /SAPSRM/EMPLOYEE_ESS    | SAP SRMEmployee for ESS             | Authorizations in SAP SRMfor employ- ees that use services from Purchasing in ESS (WDA).          |
##  Note
The composite role SAP\_EMPLOYEE\_ESS\_WDA\_2 , which contains the single roles listed above (except for the last two roles), is required for Employee Self-Service (WDA) in SAP Business Client for HTML . For more information on all roles for ESS (WDA), see also Roles in Employee Self-Service (WDA) .
## Standard Authorization Objects
The following table presents the general authorization objects relevant for security that are used by the Business Package for Employee Self-Service (up to and including 1.50).
Standard Authorization Objects for Self-Service Applications
| Authorization Object   | Field    | Value              | Description                                                                |
|------------------------|----------|--------------------|----------------------------------------------------------------------------|
| S_RFC                  | RFC_NAME | Depends on service | Saves data from RFC access to Web Dynpro front end to the back-end system. |
Apart from these authorization objects, all Employee Self-Service deployment options use the authorization objects from the following application areas or application components:
## · Human Capital Management
See the SAP S/4HANA Security Guide at Human Capital Management Authorizations
- SAP E-Recruiting
See the SAP S/4HANA Security Guide at Human Capital Management Talent Management SAP E-Recruiting Authorizations .
- HCM Processes and Forms
See the SAP S/4HANA Security Guide at Human Capital Management Personnel Administration (PA) HCM Processes and Forms Authorizations .
- Travel Management
See the SAP S/4HANA Security Guide at Accounting Financial Accounting Travel Management (FITV) .
- .