## 13.13.3.2.6.1  Authorizations
The Multichannel Foundation for Utilities and Public Sector solution uses the authorization concept provided by the Application Server ABAP.
Therefore, the recommendations and guidelines for authorizations as described in the Application Server ABAP Security Guide also apply to the Multichannel Foundation for Utilities and Public Sector solution. The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator transaction on the Application Server ABAP (AS ABAP).
## Reference Role Templates and Authorizations in SAP CRM
You create a reference user ( UMC\_REF\_USR ) during system installation. The reference user provides the necessary authorizations for each online user. This means the reference user can access data in the back end systems and Gateway.
PFCG role templates ( SAP\_CRM\_UMC\_ODATA and SAP\_ISU\_UMC\_ODATA for SAP CRM and SAP S/4HANA, respectively) are delivered with SAP CRM and SAP S/4HANA, which can be used (together with role templates delivered by Gateway, for example, /IWBEP/RT\_USS\_INTUSR ) to create the PFCG role for the reference user.
## Reference Role Templates and Authorizations in SAP S/4HANA
For SAP S/4HANA, the PFCG role template ( SAP\_ISU\_UMC\_ODATA ) is delivered with the SAP S/4HANA system, which can be used together with role templates delivered by Gateway, for example, /IWBEP/ RT\_USS\_INTUSR to create the PFCG role for the reference user.
## Service Role Templates and Authorizations in SAP CRM
In addition to the reference user, you create a service user ( UMC\_SRV\_USR ) during installation. The service user is responsible for creating the application users. Since the service user is used for anonymous logon, the user should be granted minimum authorizations.
PFCG role templates ( SAP\_CRM\_UMC\_SRV and SAP\_ISU\_UMC\_SRV for SAP CRM and SAP S/4HANA, respectively) are delivered in SAP CRM and SAP S/4HANA systems, which can be used (together with role templates delivered by Gateway, for example, /IWBEP/RT\_USS\_SRVUSR ) to create the PFCG role for the service user.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Roles in the SAP Gateway Landscape into the search bar, press Enter , and open the search result with that title.
## Service Roles and Authorizations in SAP S/4HANA
For SAP SAP S/4HANA, the PFCG role template SAP\_ISU\_UMC\_SRV is delivered in SAP S/4HANA system, which can be used together with role templates delivered by Gateway, for example, /IWBEP/RT\_USS\_SRVUSR to create the PFCG role for the service user.
## Creating and Assigning Roles in SAP CRM
To create the required users ( UMC\_SRV\_USR , UMC\_REF\_USR ), you must perform the following steps in SAP S/4HANA, SAP CRM, and the Gateway systems.
##  Note
In role maintenance, choose Utilities Templates to display the available templates, copy templates delivered by SAP, change the copies, and create templates for yourself. You will need the authorization User Master Record Maintenance: User Groups (S\_USER\_GRP) with value * in the fields CLASS and ACTVT . SAP template names start with the letter S ; therefore, templates that you create must not start with S .
You require administrator authorizations to create roles and users, and to assign roles to users.
1. Create a role and enter a description.
2. Insert the authorizations using the role templates. Depending on the system and the role type, you can combine different role templates; see the following table:
| Templates   | SAP CRMSystem        | SAP S/4 HANA System   | Gateway              |
|-------------|----------------------|-----------------------|----------------------|
| UMC_SRV_USR | SAP_CRM_UMC_SRV      | SAP_ISU_UMC_SRV       | /IWFND/RT_GW_USR     |
|             | /IWBEP/RT_USS_SRVUSR | /IWBEP/RT_USS_SRVUSR  | /IWBEP/RT_USS_SRVUSR |
| Templates   | SAP CRMSystem        | SAP S/4 HANA System   | Gateway              |
|-------------|----------------------|-----------------------|----------------------|
| UMC_REF_USR | SAP_CRM_UMC_ODATA    | SAP_ISU_UMC_ODATA     | /IWBEP/RT_USS_INTUSR |
|             | /IWBEP/RT_USS_INTUSR | /IWBEP/RT_USS_INTUSR  |                      |
##  Note
Add additional required authorization objects /IWFND/SRV , S\_SECPOL and S\_TCODE
3. You must manually add authorization object CRM\_IUPROC to the reference user in the SAP CRM system. The recommendation is to add activity 16 (execute) on all the processes (*) as shown below:
4. Verify and edit the authorizations, if necessary. For the UMC\_SRV\_USR , check role access to the following services (authorization object: S\_SERVICE ):
- Activate OData Services in the Gateway system.
- CRM\_UTILITIES\_UMC\_URM (SAP CRM and Gateway)
- CRM\_UTILITIES\_UMC\_PUBLIC\_SRV (SAP CRM and Gateway)
- /IWBEP/USERMANAGEMENT (SAP CRM and Gateway)
For the UMC\_REF\_USR , check role access to the following services (authorization object: S\_SERVICE ):
- Activate OData Services in the Gateway system.
- CRM\_UTILITIES\_UMC (for SAP CRM system and Gateway)
- ERP\_UTILITIES\_UMC (for SAP S/4HANA system and Gateway)
- /IWBEP/USERMANAGEMENT (for SAP CRM system and Gateway)
This is especially true when some function enhancements are carried out.
5. Generate the authorizations. A profile is automatically generated for the role.
6. Assign the role to users (UMC\_SRV\_USR , UMC\_REF\_USR ) and run a user master comparison to enter the generated profile into the user master record.
## Creating and Assigning Roles in SAP S/4HANA
To create the required users ( UMC\_SRV\_USR , and UMC\_REF\_USR ), you must perform the following steps in SAP S/4HANA and the Gateway systems.
##  Note
In role maintenance, choose Utilities Templates to display the available templates, copy templates delivered by SAP, change the copies, and create templates for yourself. You will need the authorization User Master Record Maintenance: User Groups (S\_USER\_GRP) with value * in the fields CLASS and ACTVT . SAP template names start with the letter S ; therefore, templates that you create must not start with S .
You require administrator authorizations to create roles and users, as well as to assign roles to users.
1. Create a role and enter a description.
2. Insert the authorizations using the role templates.
Depending on the system and the role type, you can combine different role templates; see the following table:
| Templates   | SAP S/4HANA System                     | Gateway System                        |
|-------------|----------------------------------------|---------------------------------------|
| UMC_SRV_USR | SAP_ISU_UMC_SRV /IWBEP/RT_USS_SRVUSR   | /IWFND/RT_GW_USR /IWBEP/RT_USS_SRVUSR |
| UMC_REF_USR | SAP_ISU_UMC_ODATA /IWBEP/RT_USS_INTUSR | /IWBEP/RT_USS_INTUSR                  |
##  Note
Add additional required authorization objects /WFND/SRV , S\_SECPOL and S\_TCODE
3. Verify and edit the authorizations, if necessary.
For the UMC\_SRV\_USR , check role access to the following services (authorization object: S\_SERVICE ):
- ERP\_UTILITIES\_UMC\_URM (SAP S/4HANA and Gateway)
- /IWBEP/USERMANAGEMENT (SAP S/4HANA and Gateway): This only applies to the standalone SAP S/4HANA scenario
For the UMC\_REF\_USR , check role access to the following services (authorization object: S\_SERVICE ):
- ERP\_UTILITIES\_UMC (for SAP S/4HANA system and Gateway)
- /IWBEP/USERMANAGEMENT (for SAP S/4HANA system and Gateway)
This is especially true when some function enhancements are carried out.
4. Generate the authorizations.
A profile is automatically generated for the role.
5. assign the role to users ( UMC\_SRV\_USR , UMC\_REF\_USR ) and run a user master comparison to enter the generated profile into the user master record.
## Related Information
- SAP Gateway Foundation Security Guide
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Gateway Foundation Security Guide into the
- search bar, press Enter , and open the search result with that title.
- User and Role Administration of Application Server ABAP
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter User and Role Administration of Application Server ABAP into the search bar, press Enter , and open the search result with that title.