orkungedik/SAP-basis-dataset huggingface dataset:
## 13.3.4.2.6.1.1  Authorizations
## Use
B2A: Communication with Authorities uses the authorization concept provided by AS ABAP . Therefore, the security recommendations and guidelines for authorizations as described in the SAP NetWeaver AS Security Guide ABAP also apply to B2A: Communication with Authorities .
## Roles and Authorization Concept for B2A: Communication with Authorities
## Standard Roles
Currently, there are no application-specific roles available.
## Standard Authorization Objects
The following table shows the authorization objects relevant for security used by B2A: Communication with Authorities .
Standard Authorization Objects
| Authorization Object          | Field     | Value                                                                          | Description                                                                                                                                                             |
|-------------------------------|-----------|--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| P_B2A ( HR-B2A: B2A Manager ) | MOLGA     | Country Grouping: Unique identifier for a country, for example, 01 for Germany | You use this authorization object to determine the au- thorization check for B2A Manager. You need to main- tain this authorization object only if you use B2A Manager. |
|                               | B2A_WERKS |                                                                                | Authorization Check - Per- sonnel Area                                                                                                                                  |
|                               | B2A_BTRTL |                                                                                | Authorization Check - Per- sonnel Subarea                                                                                                                               |
|                               | SAGRP     |                                                                                | Area - identifies an applica- tion in Human Resources                                                                                                                   |
| Authorization Object   | Field     | Value   | Description                                                                                                                           |
|------------------------|-----------|---------|---------------------------------------------------------------------------------------------------------------------------------------|
|                        | DOCTY     |         | Document Type - includes documents of the same type within an area within the framework of the B2A func- tions                        |
|                        | B2A_ACTIO |         | • S - Send Messages • D-Detail View for Mes- sages • R - Reorganize Mes- sages • L - Delete Messages • Z - Convert Status of Messages |
## 13.3.4.2.7  Country/Region-Specific Features
The following chapters contain information on country/region-specific features.
## 13.3.4.2.7.1  Country/Region-Specific Features: Australia
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the country version for Australia (PY-AU, PA-PA-AU), this affects the tax file number (TFN number) in the infotype TFN Australia (0227), for example.
## More Information
Payroll (PY)
## 13.3.4.2.7.3  Country/Region-Specific Features: Belgium
Overview of security-relevant information for payroll and personnel administration for the local version for Belgium.
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Belgium (PY-BE).
## Logical File Names Used in Payroll Belgium
The following logical file names were created to help with the validation of physical file names:
Logical File Names and Reports Used in Payroll Belgium
| Logical File Name      | Reports That Use These Logical File Names   | Logical File Path   |
|------------------------|---------------------------------------------|---------------------|
| HR_BE_B2A_AL01         | • RPCSRDB0 • RPUSRDB0_MONI                  | HR_BE_B2A_AL01      |
| HR_BE_B2A_UN05         | • RPCSRDB0 • RPUSRDB0_MONI                  | HR_BE_B2A_UN05      |
| HR_BE_B2A_BOWA         | • RPCBWAB0                                  | HR_BE_B2A_BOWA      |
| HR_BE_B2A_BOWM         | • RPCBWMB0                                  | HR_BE_B2A_BOWM      |
| HR_BE_B2A_DIMN         | • RPCDIGB0                                  | HR_BE_B2A_DIMN      |
| HR_BE_B2A_DMFA         | • RPCDMFB0                                  | HR_BE_B2A_DMFA      |
| HR_BE_B2A_DMUP         | • RPCDUPB0                                  | HR_BE_B2A_DMUP      |
| HR_BE_B2A_FO_IN        | • RPUSIFB0                                  | HR_BE_B2A_FO_IN     |
| HR_BE_B2A_FO_OUT       | • RPUSIFB0                                  | HR_BE_B2A_FO_OUT    |
| HR_BE_B2A_SMFA         | • RPCDMFB0                                  | HR_BE_B2A_DMFA      |
| HR_BE_B2A_SMPS         | • RPCDMFB0                                  | HR_BE_B2A_DMFA      |
| HR_BE_UPLOAD_FILE_DMFA | • RPCDMFB0                                  | HR_BE_B2A_DMFA      |
| HR_BE_B2A_PY2P         | • RPCDPPB0                                  | HR_BE_B2A_PY2P      |
## More Information
See Payroll (PY) in the S/4HANA Security Guide for Human Resources.
## 13.3.4.2.7.5  Country/Region-Specific Features: Bulgaria
Overview of security-relevant information for payroll and personnel administration for the local version for Bulgaria.
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Bulgaria, this includes the unique personal ID (EGN) in the infotypes Personal Data (0002) and Family Member/Dependents (0021).
## Related Information
Authorizations [page 247]
Authorizations [page 235]
Payroll (PY) [page 245]
## 13.3.4.2.7.6  Country/Region-Specific Features: Canada
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security under Payroll .
The following contains specific information about the logical file names and path names for Payroll Canada (PY-CA).
## Logical File Names Used in Payroll Canada
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name                | Reports That Use These Logical File Names   |
|----------------------------------|---------------------------------------------|
| HR_CA_DIR_CRA_XML_FILE_NAME_APPV | RPCYERK3_XML                                |
| HR_CA_DIR_CRA_XML_FILE_NAME_FEND | RPCYERK3_XML                                |
| HR_CA_DIR_CRA_XML_SCH_NAME_FEND  | RPCYERK3_XML                                |
| HR_CA_DIR_MRQ_XML_FILE_NAME_APPV | RPCYERK3_MRQ_XML                            |
| HR_CA_DIR_MRQ_XML_FILE_NAME_FEND | RPCYERK3_MRQ_XML                            |
| Logical File Name               | Reports That Use These Logical File Names   |
|---------------------------------|---------------------------------------------|
| HR_CA_DIR_MRQ_XML_SCH_NAME_APPV | RPCYERK3_MRQ_XML                            |
| HR_CA_DIR_MRQ_XML_SCH_NAME_FEND | RPCYERK3_MRQ_XML                            |
| HR_CA_DIR_ROE_FILE_NAME         | RPCROEK0_DISPLAY_XML                        |
| HR_CA_DIR_ROE_FILE_NAME         | RPCROEK0_XMPORTER                           |
| HR_CA_DIR_XML_FILE_NAME_FEND    | RPCXMLK0_VALIDATE                           |
| HR_CA_DIR_XML_SCH_NAME_FEND     | RPCXMLK0_VALIDATE                           |
## Logical Path Names Used in Payroll Canada
The logical file names listed above all use the logical file path HR\_CA\_FILE\_PATH .
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Canada, this includes the social insurance number (SNI number) in the infotype Personal Data (0002).
## Related Information
Authorizations [page 247]
Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.7  Country/Region-Specific Features: Croatia
Overview of security-relevant information for payroll and personnel administration for the local version for Croatia.
## Authorizations
The local version for Croatia uses the standard authorization concept used by SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to the local version for Croatia.
## Standard Authorization Objects
The local version for Croatia uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
The following table shows the security-relevant authorization objects that are also used in the local version for Croatia.
Country/Region-Specific Authorization Objects
| Authorization Object   | Field                                   | Value   | Description                                       |
|------------------------|-----------------------------------------|---------|---------------------------------------------------|
| P_HR_EROIB             | P58_EROIB (OIB company - Tax ID number) |         | PY-HR: Authorization check for company OIB number |
| P_HR_RTEEX             | REPID (ABAP Program Name)               |         | Croatia: Export Runtime En- vironment             |
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Croatia (PY-HR).
## Logical File Names Used in Payroll Croatia
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
|                     | HHRCEEB2                                    | HR_HR_PDF           |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Croatia, this includes the OIB number in the infotype Personal Data - Croatia (0562).
## Related Information
Authorizations [page 247]
Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.9  Country/Region-Specific Features: Denmark
## Authorizations
The country version for Denmark (PA-PA-DK, PY-DK) uses the standard authorization concept used by SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to the country version for Denmark.
## Standard Authorization Objects
The country version for Denmark uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
For more information, see the following:
- Authorizations (Personnel Management)
- Authorizations (Payroll)
The following table shows the security-relevant authorization objects that are also used in the country version for Denmark.
Country-Specific Authorization Objects
| Authorization Object   | Field                                 | Value   | Description                                                                                                  |
|------------------------|---------------------------------------|---------|--------------------------------------------------------------------------------------------------------------|
| P_DK_PBS               | PBSFIRMA HR_DK (Company Used for PBS) |         | Authorization check for PBS companies (see P_DK_PBS (HR-DK: Authorization check for access to PBS company) ) |
For the documentation for the authorization object P\_DK\_PBS , see SAP Library for SAP S/4HANA and choose Human Resources HR Tools Authorizations for Human Resources Technical Aspects Authorization Objects .
## More Information
See Payroll (PY) under SAP S/4HANA Security Guide for Human Resources
## 13.3.4.2.7.10  Country/Region-Specific Features: Egypt
Overview of security-relevant information for payroll and personnel administration for the local version for Egypt ( PA-PA-EG , PY-EG ).
## Authorizations
The local version for Egypt uses the standard authorization concept of SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to this local version.
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Egypt, this includes the social security number (SINUM) in the Social Insurance Egypt (3390) infotype.
## Related Information
Authorizations [page 247]
Authorizations [page 235]
## 13.3.4.2.7.11  Country/Region-Specific Features: Finland
Overview of security-relevant information for payroll and personnel administration for the local version for Finland.
## Communication Destinations
You can exchange data with local servers or terminals for the VET and EEO reports for the local version for Finland. You can use this function to download files from the application server to a presentation server. You then receive the text files required by the authorities with the output format .txt . This output format complies with the law.
The data is not encrypted in the standard system. It is your decision as to the level of encryption that you want to use if you want to send the data to the Federal Commission or Department of Labor.
The following table presents an overview of the communication destinations that the local version for Finland uses.
Communication Destinations
| Destination               | Provided                      | Type                                     | Description   |
|---------------------------|-------------------------------|------------------------------------------|---------------|
| National Incomes Register | For local version for Finland | Personnel data, Income, Company, Details |               |
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Finland (PY-FI).
## Logical File Names Used in Payroll Finland
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
| HR_FI_HPA_QTA       | HFILHPA0_FI_DATA                            |                     |
| HR_FI_HPA_ACCR      | HFILHPA0_FI_DATA                            |                     |
| HR_FI_DIR_DOWNLOAD  | HFISTBC0_SUBR HFISTWC0_FORMS HFIUTMS0       |                     |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Finland, this includes the social security number (SSN number) in the infotype Personal Data (0002).
## Related Information
Authorizations [page 247]
Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.13.1  B2A: Communication with Authorities (PY-DEBA)
This section of the Security Guide provides an overview of security-relevant information for B2A: Communication with Authorities (PY-DE-BA) .
## References to Cross Chapters
B2A: Communication with Authorities (PY-DE-BA) is based on SAP S/4HANA, Human Resources, or Personnel Management. Therefore, the corresponding Security Guides also apply to B2A: Communication with Authorities (PY-DE-BA) . Note in particular the most important sections or specific restrictions that are entered in the following table.
## Underlying Security Guides
| Security Guide of Scenario, Application, or Component       | Path                                                                                                    |
|-------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| Secure Store and Forward (SSF)                              | SAP NetWeaver Developers' Guide in SAP NetWeaver Library under Secure Store and Forward Mechanism (SSF) |
| SAP Business Connector (BC)                                 | SAP Business Connector Security Guides                                                                  |
| SAP Process Integration / SAP Process Orchestration (PI/PO) | SAP Process Integration Security Guides                                                                 |
| SAP Cloud Integration (CI)                                  | SAP Cloud Integration Security Guide                                                                    |
## Important SAP Notes
Currently, there are no security-relevant SAP Notes for B2A.
## Configuration
For information about the general settings for setting up B2A: Communication with Authorities (PY-DE-BA) , see Customizing for Payroll under Payroll: Germany Communication with Authorities (B2A) .
## Data Flow and Process
- ELSTER: The data is encrypted and signed before being transferred to the tax authorities.
- eSTATISTIK.core: The data is encrypted (HTTPS) before being transferred to the statistical authorities.
- SI (DEUEV, …): The data is encrypted and signed before being transferred from the HR system to the health insurance fund or pension insurance fund.
- ZfA/PRN: The data is encrypted (VPN) before being transferred to the authority.
## Authorizations
For more information, see Authorizations under B2A: Communication with Authorities .
## 13.3.4.2.7.14  Country/Region-Specific Features: Greece
Overview of security-relevant information for payroll and personnel administration for the local version for Greece.
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Greece (PY-GR).
## Logical File Names Used in Payroll Greece
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
|                     | HGRLE2T0                                    | HR_GR_DIR_DOWNLOAD  |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Greece, this includes the AFM tax registration number (AFM) in the infotype 3219 and the AMKA Social security number (AMKA) and the IKA Social security number (RGIKA) in the infotype 3220.
## Related Information
Authorizations [page 247]
Authorizations [page 235]
Payroll (PY) [page 245]
## 13.3.4.2.7.17  Country/Region-Specific Features: Italy
Overview of security-relevant information for payroll and personnel administration for the local version for Italy.
## Important SAP Notes
The following table presents the most important SAP Notes regarding security for the local version for Italy (PA-PA-IT, PY-IT).
<!-- image -->
| Title                                         |   SAP Note | Comment   |
|-----------------------------------------------|------------|-----------|
| Change of master data in a productive payroll |     385319 |           |
## Authorizations
The local version for Italy uses the standard authorization concept used by SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to the local version for Italy.
## Standard Authorization Objects
The local version for Italy uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
For more information, see the following:
- Authorizations (Personnel Management)
- Authorizations (Payroll)
## Country/Region-Specific Authorization Objects
The following table shows the security-relevant authorization objects that are also used in the local version for Italy.
Country/Region-Specific Authorization Objects
| Authorization Object   | Field                                                                                                                                   | Value   | Description                                                                                     |
|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|---------|-------------------------------------------------------------------------------------------------|
| P_IT_UERST             | P_RESET (Reject posting for social insurance)                                                                                           |         | Authorization for termination of social insurance (report RPCUEDI0 )                            |
| P15_MATRIC             | ACTVT (Activity) P15_MODMN (Calculation grouping DM10) P15_INPSC (INPS Indicator)                                                       |         | Authorization for reading, creating, changing, and de- leting UniEmens cluster data             |
| PAYIT_CUD              | ACTVT (Activity) BUKRS (Company Code) PERSA (Personnel Area) BTRTL (Personnel Subarea) PERSG (Employee Group) PERSK (Employee Subgroup) |         | Authorization for adding, cre- ating, displaying, and locking Certificazione Unica cluster data |
## Related Information
Payroll (PY) [page 245]
## 13.3.4.2.7.18  Country/Region-Specific Features: Japan
Overview of security-relevant information for payroll and personnel administration for the local version for Japan ( PA-PA-JP , PY-JP ).
## Authorizations
The local version for Japan uses the standard authorization concept used by SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to the local version for Japan.
## Standard Authorization Objects
The local version for Japan uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
The following table shows the security-relevant authorization objects that are also used in the local version for Japan.
Country/Region-Specific Authorization Objects
| Authorization Object   | Field                                                                                                     | Value   | Description                         |
|------------------------|-----------------------------------------------------------------------------------------------------------|---------|-------------------------------------|
| P_22_INMAO             | P22INMROLE (Role Definition for Individual Number Au- thorization) P22CPNMFRO (Corporate Number Modifier) |         | Authorization to Individual Numbers |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Japan, this includes the individual number in the Individual Numbers JP (3386) infotype.
## Related Information
Authorizations [page 247] Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.20  Country/Region-Specific Features: New Zealand
Overview of security-relevant information for payroll and personnel administration for the local version for New Zealand ( PY-NZ , PA-PA-NZ ).
## Authorizations
The local version for New Zealand uses the standard authorization concept used by SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to this local version.
## Standard Authorization Objects
The local version for NZ uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
Further, the following security-relevant authorization objects are used specifically in the local version for NZ:
Country/Region-Specific Authorization Objects
| Authorization Object   | Field                                                                           | Value   | Description                         |
|------------------------|---------------------------------------------------------------------------------|---------|-------------------------------------|
| P_NZ_PDF               | P43_ABKRS (Payroll Area) PNZ_ERIRD (Employer/Com- pany Inland Revenue Num- ber) |         | Authorizations for NZ Payday Filing |
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The logical file names and path names created specifically for Payroll New Zealand (PY-NZ) to facilitate the validation of physical file names are as follows:
Logical File Names and Reports
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
| HR_NZ_EMS_FILENAME  | HNZLEMPD0 HNZLPDS0                          | HR_NZ_EMS_FILEPATH  |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for New Zealand (PY-NZ, PA-PA-NZ), this includes the employee IRD number in the infotype IRD Nbr New Zealand (IT0309). You can access the number in the following ways:
- Directly using infotype IRD Nbr New Zealand (IT0309) with transaction Maintain HR Master Data (PA30)
- By choosing the IRD Number pushbutton in infotype Tax New Zealand (IT0313).
The authorizations required to read or change the IRD number depend on the authorizations in the user profile.
## Related Information
Authorizations [page 247]
Authorizations [page 235]
Payroll (PY) [page 245]
## 13.3.4.2.7.22  Country/Region-Specific Features: Romania
Overview of security-relevant information for payroll and personnel administration for the local version for Romania
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Romania (PY-RO).
## Logical File Names Used in Payroll Romania
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name   | Reports That Use These Logical File Names   | Logical File Path   |
|---------------------|---------------------------------------------|---------------------|
| HR_RO_DIR_DOWNLOAD  | HROCBT20                                    |                     |
| HR_RO_CFIS0         | HROCFIS1                                    |                     |
| HR_RO_CRS10         | HROCRS10                                    |                     |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Romania, this includes the ID number (CNP/NIF) in the infotype Personal Data (0002), the ID number (CNP/NIF) - Family member in the infotype Family Member/Dependents (0021) and the Labour Card (01), Identity Card (02), Passport (03), Driving License (04), Residence Permit (07), Fiscal Identification Number (08), Other type RO Ident. Card (09) and CIS Number (ID for Health Houses) (10) in the infotype 0185.
## Related Information
Authorizations [page 247]
Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.24  Country/Region-Specific Features: Saudi Arabia
Overview of security-relevant information for payroll and personnel administration for the local version for Saudi Arabia ( PA-PA-SA , PY-SA ).
## Authorizations
The local version for Saudi Arabia uses the standard authorization concept of SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to this local version.
## Standard Authorization Group
The local version for Saudi Arabia uses the security-relevant authorization objects that are available for Personnel Management and Payroll. Authorization group PCSA is provided with this local version.
The following table shows the security-relevant authorization objects that are also used in this local version.
Country/Region-Specific Authorization Objects
| Authorization Object   | Field                                                                                                    | Description                                  |
|------------------------|----------------------------------------------------------------------------------------------------------|----------------------------------------------|
| P_SA_VMLIN             | P24_VISFUN ( HRKSA: Function Codes for Visa Management )                                                 | HR: KSA Visa Line                            |
| P_SA_VMBLK             | • P24_VISFUN ( HRKSA: Function Codes for Visa Management ) • P24_ASTUS ( Visa Block Application Status ) | HR: KSA Visa Block Request                   |
| P_SA_PROM              | ACTVT ( Activity )                                                                                       | Authorization Object for Promotion Workbench |
| FISA_ADP               | • PERNR ( Personnel Number ) • ACTVT ( Activity )                                                        | Advance Payment Request - KSA                |
| FISA_EXPO              | • BUKRS ( Company Code ) • ACTVT ( Activity )                                                            | Expenditure Order - KSA                      |
| FISA_PYMO              | • BUKRS ( Company Code ) • PAYTYPE_SA ( Payment Type ) • ACTVT ( Activity )                              | Payment Order - KSA                          |
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Saudi Arabia, this includes the GOSI number in the Social Insurance SA (3252) infotype.
## Related Information
Authorizations [page 247]
Authorizations [page 235]
## 13.3.4.2.7.25  Country/Region-Specific Features: Singapore
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll Singapore (PY-SG).
## Logical File Names Used in Payroll Singapore
The following logical file names were created to facilitate the validation of physical file names:
Logical File Names and Reports
| Logical File Name     | Reports That Use These Logical File Names   |
|-----------------------|---------------------------------------------|
| HR_SG_DIR_NRSFILENAME | RPCNRSR0_XML_ALV                            |
## Logical Path Names Used in Payroll Singapore
The logical file names listed above all use the logical file path HR\_SG\_DIR\_NRS .
## More Information
See Payroll (PY) in the SAP S/4HANA Security Guide for Human Resources.
## 13.3.4.2.7.28  Country/Region-Specific Features: Spain
## Authorizations
The country version for Spain (PA-PA-ES, PY-ES) uses the standard authorization concept used by SAP S/ 4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to the country version for Spain.
## Standard Authorization Objects
The country version for Spain uses the security-relevant authorization objects that are available for Personnel Management and Payroll.
For more information, see the following:
- Authorizations (Personnel Management)
- Authorizations (Payroll)
The following table shows the security-relevant authorization objects that are also used in the country version for Spain.
Country-Specific Authorization Objects
| Authorization Object   | Field                                                                                                                      | Value   | Description                                                                                                            |
|------------------------|----------------------------------------------------------------------------------------------------------------------------|---------|------------------------------------------------------------------------------------------------------------------------|
| P_ES_PA_OK             | INFTY (Infotype) SUBTY (Subtype) PES_SPRPS (Lock indicator for HRmaster record) PES_FCODE (Function code) ACTVT (Activity) |         | Authorization check for the function codes that are per- mitted for the HRmaster data of the country version for Spain |
## More Information
See Payroll (PY) under SAP S/4HANA Security Guide for Human Resources.
## 13.3.4.2.7.32  Country/Region-Specific Features: Turkey
Overview of security-relevant information for payroll and personnel administration for the local version for Turkey.
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for Turkey, this includes the social security no. (SSKNO) and the tax id number (TAXKN) in the infotype 0769 and the id card no. (IDCNO), TR identity no. (MERNI) and the driv. licns. no. (DLNUM) in the infotype 0770.
## Related Information
Authorizations [page 247]
Authorizations [page 235] Payroll (PY) [page 245]
## 13.3.4.2.7.33  Country/Region-Specific Features: United Arab Emirates
Overview of security-relevant information for payroll and personnel administration for the local version for the United Arab Emirates ( PA-PA-AE , PY-AE ).
## Authorizations
The local version for the United Arab Emirates uses the standard authorization concept of SAP S/4HANA. Therefore, the recommendations and guidelines for authorizations as described for SAP S/4HANA also apply to this local version.
## Sensitive Data
The Human Resources infotypes often contain sensitive data. This data is protected by central authorization objects. For the local version for the United Arab Emirates, this includes the social security number (SINUM) in the Social Insurance AE (3251) infotype.
## Related Information
Authorizations [page 247]
Authorizations [page 235]
## 13.3.4.2.7.37  Country/Region-Specific Features: Other Countries
## Data Storage Security
For general information about data storage security in Payroll, see Data Storage Security .
The following contains specific information about the logical file names and path names for Payroll for Other Countries (PY-XX).
## Logical File Names Used in Payroll for Other Countries
The following logical file names and logical file paths were created to facilitate the validation of physical file names:
Logical File Names, Reports/Function Modules, and File Paths
| Logical File Name   | Reports or Function Modules That Use These Logical File Names   | Logical File Path   |
|---------------------|-----------------------------------------------------------------|---------------------|
| HR_XX_DIR_B2AFILE   | Report H99_B2AFILE                                              | HR_XX_DIR_B2AFILE   |
| HR_XX_DIR_RPUFCP01  | Report RPUFCP01                                                 | HR_XX_DIR_RPUFCP01  |
| Logical File Name            | Reports or Function Modules That Use These Logical File Names   | Logical File Path            |
|------------------------------|-----------------------------------------------------------------|------------------------------|
| HR_XX_DIR_RH_CALL_ORGDISPLAY | Function module RH_CALL_ORGDISPLAY                              | HR_XX_DIR_RH_CALL_ORGDISPLAY |
| HR_XX_DIR_RHMOVE40           | Report RHMOVE40                                                 | PD_DATASET                   |
| HR_OT_FILEPORT               | Report RPUOTFL0                                                 | HR_OT_DIR_FILEPORT           |
## More Information
See Payroll (PY) in the SAP S/4HANA Security Guide for Human Resources.
## 13.3.4.3   Self-Services
## 13.3.4.3.1  Important SAP Notes
## Definition
This chapter of the Security Guide provides you with information about the following self-service components:
- Business Unit Analyst (BUA)
- Project Self-Services (PSS)
- Higher Education and Research (IS-HER-CSS)
- General Parts (PCUI\_GP)
If not stated otherwise, the security settings for user management and authorizations apply to all of the afore-mentioned components.
The following self-service components have their own sections in this chapter:
- Employee Self-Service
- Manager Self-Service
##  Note
For these components, all security-relevant information is included in the relevant subsections.
## Important SAP Notes
The table below shows important SAP Notes that apply to the security for some Self-Service applications. For more information about standard roles for assigning authorization in the Self-Service applications, see the Authorizations section of this Security Guide.
Important SAP Notes
|   SAP Note Number | Title                                        | Comment                                                                                                                                                                   |
|-------------------|----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|            846439 | PSS: Authorizations and roles for Web Dynpro | This SAP Note contains the authoriza- tion objects and the default values de- fined for the Web Dynpro applications for Project Self-Services (component EP-PCT-PLM-PSS). |
## 13.3.4.3.2  User Management
## Use
User management for Self-Service applications uses the mechanisms provided with ABAP Platform, for example, tools, user types, and password policy. For an overview of how these mechanisms apply for SelfService applications, see the sections below.
## User Administration Tools
The table below shows the tools to use for user management and user administration with the Self-Service applications.
User Management Tools
| Tool                                                              | Detailed Description                                                                                  | Prerequisites   |
|-------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|-----------------|
| User and role maintenance in AS ABAP (transactions SU01 and PFCG) | You can use the Role Maintenance (PFCG) transaction to generate profiles for your self-service users. |                 |
For more information, see the User and Roles section.
## User Types
For information about the user types, see the Application Server ABAP Security Guide.
##  Recommendation
For portal roles, we recommend that you set up the connection between the portal and the connected systems ( ECC system, J2EE Engine, BW system) such that each individual user has access.
## Standard Users
| Component                                  | Standard Users                                                                                            |
|--------------------------------------------|-----------------------------------------------------------------------------------------------------------|
| Project Self-Service Business Unit Analyst | No standard users exist in the standard SAP system for these components.                                  |
| Higher Education and Research              | For information about the standard users for this compo- nent, see the Security Guide for this component. |
## 13.3.4.3.3  Authorizations
## Use
The Self-Service applications use the authorization concept provided by Application Server ABAP . Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guide for ABAP also apply to the Self-Service applications.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the Profile Generator (transaction PFCG). For more information, see Editing Roles and Authorizations for Web Dynpro Services .
## Standard Roles
## Business Unit Analyst and Project Self-Services
There are no standard roles for these components.
## Higher Education and Research
For information about the standard roles for this component, see the Security Guide for this component.
## Standard Authorization Objects
The table below shows the general security-relevant authorization objects that are used by the Self-Service applications.
Standard Authorization Objects for Self-Service Applications:
| Authorization Object   | Field    | Value              | Description                                                                             |
|------------------------|----------|--------------------|-----------------------------------------------------------------------------------------|
| S_RFC                  | RFC_NAME | Depends on service | Saves data when the back- end system is accessed via RFC from the Web Dynpro front end. |
## Higher Education and Research
For information about the standard authorization objects for this component, see the Security Guide for this component.
## Internal Service Request and Personnel Change Requests
For information about standard authorization objects for the Internal Service Request (ISR) and Personnel Change Requests , see SAP Note 623650.
## 13.3.4.3.3.1  Maintain Roles and Authorizations for Web Dynpro Services
## Use
You use this procedure to maintain roles, their associated Web Dynpro services, and authorizations.
## Procedure
1. In transaction PFCG, create a role or select an existing default role for the component. Choose Create Role or copy the existing default role.
2. Assign the services you require to the role.
1. On the Menu tab page, choose Authorization Default . The Service dialog box appears.
2. Select the External Service checkbox.
3. Select WEBDYNPRO as the external service type.
4. In the Service field, select the Web Dynpro service you require.
5. Choose Save .
The authorization objects and default values maintained for the service are then displayed in the menu tree structure.
In the same manner, select all the Web Dynpro services that you want to use.
3. Assign the required authorizations.
2. To do this, choose the Authorizations tab page to maintain the authorization objects and values in
accordance with your requirements.
For more detailed information about role maintenance, see Role Administration [page 13].
## 13.3.4.3.3.2  Authorizations for Controlling Services (BUA)
The table below shows the standard authorization objects that are used by the controlling services in Business Unit Analyst (BUA) .
##  Note
These authorization objects are also used by the controlling services in Business Package forManager Self-Service (MSS) .
| Authorization Object   | Description                                                                                                                                                                                                                                                 |
|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| K_CCA                  | General authorization object for Cost Center Accounting. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services.                                                                                                      |
| K_ORDER                | General authorization object for internal orders. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services.                                                                                                             |
| K_PCA                  | Area responsible, Profit Center. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services.                                                                                                                              |
| K_CSKS_PLA             | Cost element planning. Is checked in the relevant Express Planning services.                                                                                                                                                                                |
| K_FPB_EXP              | Authorization object for Express Planning. This authorization object checks the Express Planning Framework call and the planning round call. The actual plan data is protected by the authorization objects for the individ- ual Express Planning services. |
##  Note
For more information about the fields for the authorization objects K\_CCA, K\_ORDER, and K\_PCA, see SAP Note 15211.
## 13.3.4.3.4.1  User Administration and Authentication
User management for Employee Self-Service uses the mechanisms provided with the Application Server ABAP:
The security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP Security Guide apply for Employee Self-Service (WDA) in SAP Business Client for HTML apply to the ESS business packages ( Business Package for Employee Self-Service ) and Business Package for Employee Self-Service (WDA) .
In addition to these guidelines, information about user administration and authentication that specifically applies to Employee Self-Service is included in the following sections:
- User Management
- Integration into Single Sign-On Environments