orkungedik/SAP-basis-dataset huggingface dataset:
## 13.3.5.1.5  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the backend system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for SAP E-Recruiting is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also apply to SAP E-Recruiting. Details that specifically apply to SAP E-Recruiting are described in the following topics:
- Communication Channel Security This topic describes the communication paths and protocols used by SAP E-Recruiting.
- Network Security
This topic describes the recommended network topology for SAP E-Recruiting. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection. It also includes a list of the ports needed to operate SAP E-Recruiting.
- Communication Destinations This topic describes the information needed for the various communication paths, for example, which users are used for which communications.
For more information, see the following sections in the ABAP Platform Security Guide:
- Network and Communication Security
- Security Aspects for Connectivity and Interoperability
## 13.3.5.1.5.1  Communication Channel Security
## Use
The table below shows the communication channels used by SAP E-Recruiting, the protocol used for the connection, and the type of data transferred.
Communication Paths
| Communication Path                                                       | Protocol Used                                          | Type of Data Transferred   | Data Requiring Particular Protection   |
|--------------------------------------------------------------------------|--------------------------------------------------------|----------------------------|----------------------------------------|
| Front-end client that uses SAP GUI for Windows as the application server | DIAG                                                   | All Customizing data       | Passwords                              |
| Front-end client that uses a Web browser as the applica- tion server     | HTTP, HTTPS  Note Wegenerally recom- mend using HTTPS | All application data       | Passwords, personal data               |
<!-- image -->
DIAG and RFC connections can be protected using Secure Network Communications (SNC). HTTP connections are protected using the Secure Sockets Layer (SSL) protocol.
##  Recommendation
We strongly recommend that you use secure protocols (SSL, SNC) where possible.
For more information, see the SAP NetWeaver Security Guide under Transport Layer Security.
## Printing
SAP E-Recruiting has numerous options for printing contents. For information about security while printing, see the SNC User's Guide .
## 13.3.5.1.5.2  Network Security
## Definition
You can operate SAP E-Recruiting in different ways. You can run the front end and backend for candidates' users on different systems. You can also operate SAP E-Recruiting and the HR system integrated on one system or on different instances.
We recommend that you run the front end and backend of candidates' users on different systems and that you do not integrate SAP E-Recruiting and the HR system on one system.
## Firewall Settings
For more information, see Using Firewall Systems for Access Control in the ABAP Platform Security Guide.
## Ports
SAP E-Recruiting runs on SAP NetWeaver and uses the ports from AS ABAP. For more information, see the topics for AS ABAP Ports in the corresponding ABAP Platform Security Guides.
For other components, for example, SAPinst, SAProuter, or SAP Web Dispatcher, see https:/ /help.sap.com/ viewer/ports.
## 13.3.5.1.5.3  Communication Destinations
The following sections provide an overview of the communication destinations that are relevant for the user in the SAP E-Recruiting roles.
## 13.3.5.1.5.3.1  Communication Destinations (Recruiter, Administrator, and Data Entry Clerk)
The following table provides an overview of the communication destinations that SAP E-Recruiting uses.
You use the following communication destinations depending on which application you use to manage your HR master data:
- If you use the SAP GUI transactions to maintain HR master data (for example, transactions PA*), communication with SAP E-Recruiting runs via RFC connections.
- If you use the HR Administrative Services application, communication with SAP E-Recruiting runs via SAP PI (Process Integration).
| Destination                                        | Delivered   | Type   | Users, Authorizations   | Description                                                                                |
|----------------------------------------------------|-------------|--------|-------------------------|--------------------------------------------------------------------------------------------|
| SAP E-Recruiting to SAP Human Resources Management | No          | RFC    | See Customizing         | IMG: SAP E-Recruiting Applicant Tracking Activities Set Up Data Transfer for New Employees |
| Destination                                               | Delivered   | Type        | Users, Authorizations   | Description                                                                                                                                                           |
|-----------------------------------------------------------|-------------|-------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| From SAP Human Re- sources Management to SAP E-Recruiting | No          | RFC         | See Customizing         | SAP E-Recruiting Technical Settings SAP ERP Central Component (ECC) Integration Software Runs on Different Instances Set Up Data Transfer from SAP ECC                |
| From SAP E-Recruiting to TREX                             | No          | RFC         | See Customizing         | SAP E-Recruiting Technical Settings User Administration Create Special Users SAP E-Recruiting Technical Settings Search Engine Set Up Search Engine for E- Recruiting |
| From SAP E-Recruiting to HRAdministrative Services        | No          | XI messages |                         | Transfer external can- didate's data when hir- ing                                                                                                                    |
| From HRAdministra- tive Services to SAP E- Recruiting     | No          | XI messages |                         | Return personnel num- ber of former external candidate to SAP E-Re- cruiting                                                                                          |
##  Note
Changes to the HR master data are transferred to SAP E-Recruiting using the master data distribution in the ALE scenario.
## 13.3.5.1.5.3.2  Communication Destinations for Manager Involvement
The following table provides an overview of the communication destinations that SAP E-Recruiting uses for Manager Involvement.
Communication Destinations for Manager Involvement (Manager Self-Service)
| Destination                                                | Delivered   | Type   | Users, Authorizations   | Description                                                                                                                                                                                                  |
|------------------------------------------------------------|-------------|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| From HRsystem (Man- ager Self-Service) to SAP E-Recruiting | No          | RFC    | See Customizing         | SAP Customizing Implementation Guide → Integration with Other SAP Components → Business Packages / Functional Packages → Manager Self Service → Recruitment → Create RFC Connection to E-Recruiting System . |
In the HR system, the methods of the CL\_IM\_HRRCF\_REQUI\_REQUEST class use the RFC connection to call function modules in the E-Recruiting system.
The IF\_HRASR00 GEN \_SERVICE\_ADVANCED~FLUSH method transfers information from the requisition request form to the corresponding infotypes of SAP E-Recruiting.
The methods call the following function modules in the E-Recruiting system:
- HRRCF\_MDL\_ UIS \_ATT\_TYPE\_ GET
- ERC\_SE\_REQUI\_CREATE\_RC
The IF\_HRASR00 GEN \_SERVICE~ GET \_HELP\_VALUES method fills the value helps for input fields in the requisition request form with values from SAP E-Recruiting.
The method calls the following function modules in the E-Recruiting system:
- HRRCF\_MDL\_ UIS \_VH\_COMMON
- HRRCF\_ GET \_MANAGERS\_FOR\_SUBST
- HRRCF\_MDL\_VH\_EMPLOYMENT\_FRACT
- HRRCF\_MDL\_VH\_SALARY\_CURRENCY
- HRRCF\_MDL\_VH\_SALARY\_RANGE
- HRRCF\_MDL\_VH\_CONTRACT\_TYPE
- HRRCF\_MDL\_ UIS \_SUPPORT\_GRPS\_ GET
The IF\_HRASR00 GEN \_SERVICE~DO\_OPERATIONS method determines the manager's substitutes in SAP E-Recruiting. In addition, you can use the method to determine a user in SAP E-Recruiting for a personnel number.
The method calls the following function modules in the E-Recruiting system:
- HRRCF\_ GET \_MANAGERS\_FOR\_SUBST
- HRRCF\_MDL\_ UIS \_USER\_ GET
- HRRCF\_MDL\_ UIS \_ASSIGNED\_ GRP \_GET
## 13.3.5.1.5.3.3  Communication Destinations (Candidates)
The following table provides an overview of the communication destinations that SAP E-Recruiting uses for the candidate scenario with the front-end and backend on separate systems.
<!-- image -->
<!-- image -->
<!-- image -->
| Destinations                                                | Delivered   | Type   | Users, Authorizations   | Description                                                                                                                                                                                                 |
|-------------------------------------------------------------|-------------|--------|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP E-Recruiting (front-end) to SAP E- Recruiting (backend) | No          | RFC    | See Customizing         | SAP E-Recruiting Technical Settings User Interfaces Candidate Frontend Candidate Enter RFC Destination of Receiving Backend System You enter the RFC des- tination as a value of the RECFA UI2BL parameter. |
| SAP E-Recruiting (backend) to SAP E- Recruiting (front-end) | No          | RFC    | See Customizing         | SAP E-Recruiting Technical Settings User Interfaces Candidate Backend Candidate Specify System Parameters for Web Dynpro You enter the RFC des- tination as a value of the RECFA BL2UI parameter.           |
Note that the communication destination "SAP E-Recruiting (front-end) to SAP E-Recruiting (backend)" was defined as a "trusted system connection". In this connection, no users can be stored in the credentials. For more information, see consulting note 1017866.
## 13.3.5.1.6  Internet Communication Framework Security
You should only activate those services that are needed for the applications running in your system. For SAP E-Recruiting, the following services are needed for the relevant roles:
- Administrator and Recruiter
- All services with the prefix ERC in the path /default\_host/sap/bc/webdynpro/sap/
You activate the services in Customizing for SAP E-Recruiting under Technical Settings → User Interfaces → Administrator and Recruiter → General Settings → Determine E-Recruiting Services .
## · Candidates
- All services with the prefix hrrcf in the path /default\_host/sap/bc/webdynpro/sap/
- All services in the path /default\_host/sap/bc/erecruiting/
- All services with the prefix hrrcf\_wd in the path /default\_host/sap/bc/bsp/sap/ You activate the services in Customizing for SAP E-Recruiting under Technical Settings → User Interfaces → Candidate → Front-End Candidate → Specify E-Recruiting Services (Web Dynpro ABAP) .
- Manager (within the framework of Manager Involvement)
- default\_host/sap/bc/erecruiting/dataoverview
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_dataoverview
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_requi\_monitor
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_req\_assess
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_tp\_assess
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_qa\_mss
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_substitution\_manager
- default\_host/sap/bc/webdynpro/sap/hrrcf\_a\_substitution\_admin You activate the services in Customizing for SAP E-Recruiting under Technical Settings → User Interfaces → Manager Involvement → Specify E-Recruiting Services for MSS .
If your firewall(s) use(s) URL filtering, also note the URLs used for the services and adjust your firewall settings accordingly.
For more information, see Activating and Deactivating ICF Services in the SAP NetWeaver documentation in SAP Library.
For more information about ICF security, see the RFC/ICF Security Guide
## 13.3.5.1.7  Data Storage Security
## Data Storage
The SAP E-Recruiting data is saved as follows:
- If you use SAP E-Recruiting integrated with other SAP applications, the data is saved in the SAP Web AS or SAP ECC databases.
- If you use SAP E-Recruiting as a standalone application, the data is saved directly in the SAP E-Recruiting databases. You do not need to use any other databases in addition to these standard databases.
SAP E-Recruiting stores the data in the following locations:
## Data
## Storage Location
| Master data                        | PD infotype tables        |
|------------------------------------|---------------------------|
| Attachments and user-defined texts | Knowledge Provider (KPro) |
| Data              | Storage Location             |
|-------------------|------------------------------|
| Search query logs | Cluster table PCL _ RCF (SI) |
| Audit Trails      | Cluster table PCL _ RCF (SI) |
| Infotype Log      | Cluster table PCI_ RCF (IL)  |
## Cookies
The application uses a Web browser. The SAP Web AS must issue cookies as well as accepting them.
## 13.3.5.1.8  Enterprise Services Security
The following chapters in the ABAP Platform Security Guide and documentation are relevant for all enterprise services delivered with SAP E-Recruiting:
- Security Guide Web Services
- Recommended WS Security Scenarios
- SAP Process Integration Security Guide
## 13.3.5.1.9  Other Security-Relevant Information
## Virus scan when uploading attachments
SAP E-Recruiting allows the user to upload files as attachments at various times in the program. Since attachments can potentially contain viruses, these viruses could enter your system when you upload the attachments. To reduce this risk as much as possible, we recommend you use an external virus scanner and restrict the MIME types of the attachments.
In the Virus Scan when Uploading Documents Customizing activity, you activate the virus scan profile / PAOC\_ RCF \_BL/HTTP\_UPLOAD that you use in SAP E-Recruiting to perform a virus check when uploading attachments. This enables you to include external virus scanners to increase the security of your system.
You can use the Business Add-In (BAdI) HRRCF00\_ DOC \_UPLOAD to check files that are uploaded as attachments to the E-Recruiting system. When doing so, you can use the CHECK\_ATTACH\_ FILE \_TYPE method to specify which MIME types are permitted for the attachments. You call the BAdI using the BAdI: Upload Documents Customizing activity.
## Access to attachments via Microsoft Internet Explorer
You use Microsoft Internet Explorer and want to display attachments in the browser. To do this, Microsoft Internet Explorer checks the content of the attachment to determine the file type and display the attachment correctly ( MIME Type Sniffing ). In the worst case, it is thus possible that damaging files of an undesired file type are displayed in the browser or cause damage in another way. To avoid this potential threat to security, deselect MIME Type Sniffing in the security settings of Microsoft Internet Explorer .
## 13.3.5.1.10  Security-Relevant Logging and Tracing
## Application Log
SAP E-Recruiting uses the logging and tracing mechanisms from ABAP Platform. SAP E-Recruiting then writes exceptions in the Application Log. These exceptions can occur due to failed authorization checks, for example, and are therefore relevant for security.
For information about logging and tracing mechanisms of Application Server ABAP, see Auditing and Logging under Application Logging , there is more information about the application log.
You can access the part of the application log specific to SAP E-Recruiting by using the transaction SLG1 (Analyze Application Log) and entering the parameter Object = HRRCF .
## Audit Trail
SAP E-Recruiting creates an audit trail with the candidate profile and search queries. For more information, see Access Audit Trails .
## 13.3.5.1.11  Services in Lifecycle Management for Security
The following services are available from SAP Active Global Support to assist you in maintaining security in your SAP systems on an ongoing basis.
## Security Chapter in the EarlyWatch Alert (EWA) Report
This service regularly monitors the Security chapter in the EarlyWatch Alert report of your system. It tells you:
- Whether SAP Security Notes have been identified as missing on your system. In this case, analyze and implement the identified Notes, if possible. If you cannot implement the Notes, the report should be able to help you decide on how to handle the individual cases.
- Whether an accumulation of critical basis authorizations has been identified.
In this case, verify whether the accumulation of critical basis authorizations is okay for your system. If not, correct the situation. If you consider the situation okay, you should still check for any significant changes compared to former EWA reports.
- Whether standard users with default passwords have been identified on your system. In this case, change the corresponding passwords to non-default values.
## Security Optimization Service (SOS)
The Security Optimization Service can be used for a more thorough security analysis of your system, including:
- Critical authorizations in detail
- Security-relevant configuration parameters
- Critical users
- Missing security patches
This service is available as a self-service within the SAP Solution Manager or as a remote or on-site service. We recommend you use it regularly (for example, once a year) and in particular after significant system changes or in preparation for a system audit.
## Security Configuration Validation
The Security Configuration Validation can be used to continuously monitor a system landscape for compliance with predefined settings, for example, from your company-specific SAP Security Policy. This primarily covers configuration parameters, but it also covers critical security properties like the existence of a non-trivial Gateway configuration or making sure standard users do not have default passwords.
## Security in the RunSAP Methodology / Secure Operations Standard
With the E2E Solution Operations Standard Security service, a best practice recommendation is available on how to operate SAP systems and landscapes in a secure manner. It guides you through the most important security operation areas and links to detailed security information from SAP's knowledge base wherever appropriate.
## More Information
For more information about these services, see:
- SAP EarlyWatch Alert: https:/ /support.sap.com/en/offerings-programs/support-services/earlywatchalert.html
- SAP Security Optimization Service / Security Notes Report: https:/ /support.sap.com/en/offeringsprograms/support-services/security-optimization-services-portfolio.html
- Comprehensive list of SAP Security Notes: https:/ /support.sap.com/en/my-support/knowledge-base/ security-notes-news.html
- Configuration Validation
- SAP Activate Methodology Roadmaps: https:/ /support.sap.com/en/offerings-programs/methodologies/ implement.html
## 13.3.5.2  Performance Management
## About This Chapter
This chapter of the Security Guide provides an overview of the security-relevant information for the Performance Management (PA-PD-PM) application component.
##  Note
We use the name of the Performance Management to mean the same as the name Objective Setting and Appraisals . Both names correspond to the technical application component ID PA-PD-PM .
## Overview of the Main Sections of This Chapter
The following sections contain the security-relevant information that is specific to 'Performance Management':
- Important SAP Notes
This section provides information on why security is necessary and how the document is used, as well as references to other Security Guides on which this Security Guide is based.
- Security Aspects for Data, Data Flow, and Processes This section provides an overview of the security aspects of the most frequently used processes in
Performance Management.
- Authorizations
This section provides an overview of the authorization concept used for Performance Management.
- Network and Communication Security
This section provides an overview of the following aspects:
- Communication Channel Security
- Network Security
- Internet Communication Framework Security This section provides an overview of the services for the Internet Communication Framework (ICF) used by
Performance Management.
- Data Storage Security
This section provides an overview of all critical data used by the scenario, component, and application as well as the security mechanisms used.
- Other Security-Relevant Information
This section contains information on uploading and displaying attachments.
- Security-Relevant Logging and Tracing
This section provides an overview of the trace and log files that contain security-relevant information and that enable you to reproduce activities, for example, if there is a security violation.
## 13.3.5.2.1  Technical System Landscape
Overview of the technical system landscape for Performance Management:
- Front-end system: Web Dynpro for ABAP in applications in Manager Self-Service and Employee SelfService
- Back-end system: Customizing for the Objective Setting and Appraisals application component (for example, Customizing for applications using Web Dynpro technology for ABAP).
- Back-end system: Transactions for administrators and HR specialists
- Download of Documents from the Back-End System in Knowledge Provider (KPRo)
- Workflow Example: Sending notifications to mangers or employees
- SAP Interactive Forms by Adobe
- For offline processing of the appraisal document (downloading and uploading of appraisal documents).
For more information, see the guide for SAP Interactive Forms by Adobe under SAP Interactive Forms by Adobe Security Guide .
- Printing of Appraisal Documents
- SAP Smart Forms
- PDF-based print form
## 13.3.5.2.2  Security Aspects for Data, Data Flow, and Processes
In Performance Management, data for the appraisal process are processed as follows:
- For Managers in the Manager Self-Service applications.
- For more information about the Manager role, see the SAP S/4HANA Security Guide and choose: Human Resources Self-Services Manager Self-Service .
- For Employees in the Employee Self-Service applications.
For more information about the Employee role, see the SAP S/4HANA Security Guide and choose
Human Resources Self-Services Employee Self-Service .
##  Example
<!-- image -->
Managers as well as employees can work on appraisal documents in the applications (Web Dynpro for ABAP). The system saves the relevant data to the database. The system saves attachments to files (such as appraisals by an additional appraiser) in the Knowledge Provider (KPro).
## 13.3.5.2.3  Authorizations
Performance Management uses the authorization concept provided by Application Server ABAP (AS ABAP). Therefore, the security recommendations and guidelines for authorizations detailed in the ABAP Platform Security Guide ABAP also apply to Performance Management.
The ABAP Platform authorization concept is based on the assignment of authorization to users based on role. For role maintenance, use the profile generator (transaction: Role Maintenance ( PFCG )) on the AS ABAP.
##  Note
For more information about creating roles, see Role Maintenance under Identity Management .
Authorizations for personnel appraisal implemented in Human Resources have a special significance. The Performance Management application component uses objects from the following components, among others:
- Manager Self-Service
For more information, see Authorizations in Manager Self-Service.
- Employee Self-Service For more information, see Authorizations in Employee Self-Service.
- Organizational Management
- Personnel Development
- Training and Event Management
- SAP Learning Solution
For more information, see Authorizations in SAP Learning Solution .
The Performance Management application component is therefore subject to the general authorization checks in the corresponding application component. Furthermore, the object type Person (P) in Performance Management is of central importance since this object type can be used for appraisers and appraisees (particularly for personnel appraisals). This means that standard checks for people in the SAP system are also valid for Performance Management. Furthermore, Performance Management has additional authorization aspects for controlling authorizations in this application that are realized using specific authorization object and authorization controlling in the Customizing settings for the appraisal template.
For more information about the authorization checks, see General Authorization Check and Structural Authorization Check (see SAP Library for SAP S/4HANA and choose Human Resources HR Tools Authorizations for Human Resources ).
## 13.3.5.2.3.2  Overview of Authorization Objects
In Performance Management, the following authorization objects are essential for enabling users to access the application component for the following roles:
- Transaction authorizations (S\_TCODE, P\_TCODE)
- Access to HR master data (P\_ORGIN/CON, P\_PERNR)
- Access to objects in the Personnel Planning database (PLOG)
- Access to appraisals (P\_HAP\_DOC)
You can control the following for users with named roles using various authorization object fields:
- Activity (display, edit, delete)
- Object set (persons, appraisal templates)
- Content (infotypes)
For more information about these authorizations, see SAP Library under ERP Central Component Human Resources Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources .
## 13.3.5.2.3.2.1  Authorization Objects S\_TCODE and P\_TCODE
Authorization object that is used to check whether a user is authorized to start the different HR transactions. The transaction code is checked.
## Use
Regardless of the application, the authorization object S\_TCODE is used to check authorizations for starting the transactions defined for an application.
The authorization object P\_TCODE is used to check the authorization for starting various HR transactions. The additional check using P\_TCODE provides added security for personal data and is therefore used for numerous transactions in HCM applications (such as PA40, PHAP\_CHANGE\_PA). The authorization object P\_TCODE is not used in all HR transactions. Generally, it is used in HR applications where HR-specific authorization objects are not checked when a transaction is called. For more information about this authorization object, see P\_TCODE (HR transaction code) .
## Necessary Setting for Performance Management:
Transaction code field: PHAP\_*\_PA (depending on role, specify exact transaction). For administrators, you must include transactions starting with OOHAP\_*.
For more information about the authorizations, see SAP Library under ERP Central Component
Human Resources Management Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources Management .
## 13.3.5.2.3.2.2  Authorization object PLOG (Personnel Planning)
An authorization object that is used to check the authorization for specific fields in the Personnel Management components ( Organizational Management , Personnel Development , Training and Event Management , SAP Learning Solution , and so on).
## Use
## Necessary Setting for Performance Management:
INFOTYP: 1000, 1001, 1002, 1048, 5020, 5021, 5022, 5023, 5024, 5025, 5026
ISTAT: 4, 3
OTYPE: VA, VB, VC
PLVAR: *
PPFCODE: Change for Customizing/Administrators, Display for End-Users
SUBTYP: 0001, 5020, A605, A606, A607, B605, B606, B607
## Note
The object types have the following meaning:
- VA = Appraisal template
- VB = Criteria group
- VC = Criterion
The Customizing settings for the appraisal templates are made in the aforementioned infotypes (transaction PHAP\_CATALOG\_PA). Therefore, end users must have at least read authorization for these infotypes. If the appraisal templates include further object types as a result of using free enhancements (such as Add Business Event Type ) or fixed enhancements (such as Add Individual Development Plan Item ), additional authorizations are required for these object types, for example:
- Q = Qualifications
- O = Organizational unit
- S = Position
- C = Job
- D = Course type
- F = Location
- A = Work center
Since individual development plans can also include further standard object types and customer-specific object types, you must also include these when setting up authorizations according to the particular implementation.
For more information on the authorizations, see the SAP Library under ERP Central Component Human Resources Management Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources Management .
## 13.3.5.2.3.2.5  Authorization Object P\_ORGINCON
An authorization object that is used during the authorization check for HR data. This check takes place when HR infotypes are edited or read.
## Use
You can use this authorization object if structural authorizations are to be checked in context when checking the authorization to access HR master data. This authorization object is used for the authorization check for personnel data. This check takes place when HR infotypes are edited or read. This authorization object consists of the same fields as the authorization object P\_ORGIN, and also includes the field PROFL (structural profile). Running the check against this object enables user-specific contexts (using Organizational Management) to be depicted in HR master data.
## Structural Profile 1
<!-- image -->
The checks are made context-sensitive by controlling the various structural sets of persons to different contexts as shown in the example above.
The PROFL field determines the structural profiles the user can access for a particular context. These structural profiles must be assigned to the user in table T77UA.
If you use the Business Add-In (BAdI) HRBAS00\_GET\_PROFL, you do not need to maintain table T77UA manually. This BAdI enables you to implement an alternative method for determining structural profiles. The example source code in the standard system determines the user's structural profiles by reading the values entered for the authorization object P\_ORGINCON in the user master record.
Structural authorizations in authorization object P\_ORGINCON can also be used in combination with structural authorizations in Performance Management (see structural authorizations in Performance Management).
For more information on the authorizations, see the SAP Library under ERP Central Component Human Resources Management Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources Management .
## 13.3.5.2.3.2.6  Authorization Object P\_PERNR
This authorization object is used to control the user's access to his or her own personnel number and the related HR data separately.
## Use
The personnel number is assigned to the user in the Communication infotype (0105) (subtype 0001 System User Name). Access to an employee's own master data is used primarily in ESS scenarios in which the user is only to have access to his or her own master data to edit or display this information. To enable access authorizations for the employee's own personnel number to be controlled using the authorization object P\_PERNR, the main switch must be activated in table T77S0 (transaction OOAC, switch AUTSW/PERNR). The authorization check is run for the following fields:
| Authorization Field   | Description                                                                                                 |
|-----------------------|-------------------------------------------------------------------------------------------------------------|
| INFTY                 | Infotype                                                                                                    |
| SUBTY                 | Subtype                                                                                                     |
| AUTHC                 | Authorization level (such as read, write, matchcode)                                                        |
| PSIGN                 | Interpretation of own personnel number (I, include own per- sonnel number, E, exclude own personnel number) |
## Necessary Settings for Performance Management:
INFTY: Dummy-depends on the ESS scenarios used outside of Performance Management.
SUBTY: Dummy-depends on the ESS scenarios used outside of Performance Management.
AUTHC: *
PSIGN: I (include)
## Note
If you use the authorization object P\_PERNR, the authorization object P\_ORGIN/CON is superfluous. That is, a user who is to be permitted to access his or her own personnel number only (for example, for ESS scenarios), is given all the authorizations required using the authorization object P\_PERNR. Therefore, an additional setting for the authorization object P\_ORGIN/CON is not required. This also applies to Performance Management.
For more information on the authorizations, see the SAP Library under ERP Central Component Human Resources Management Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources Management .
## 13.3.5.2.3.3  Structural Authorizations in Performance Management
Special structural authorizations exist for Performance Management. These authorizations enable you to control access to appraisal documents for persons from defined areas of Organizational Management.
This extended authorization check (structural, context-sensitive authorizations) is activated using the switch HAP00/AUTHO in table T77S0. This switch is specific to Performance Management authorizations.
##  Example
Example A: Structurally controlled access
The standard SAP authorization check assumes that, once defined, the authorizations (such as change appraisal documents) for a user always apply even when a manager takes on a substituting role for a different organizational unit. If you activate the extended authorization check, you can dictate that a manager can change appraisal documents for employees in his or her organizational unit while he or she can only display appraisal documents for employees in the organizational unit for which he or she is a substitute.
##  Example
Example B: Structurally controlled access
A user has authorization to read the mini-master record for all employees at a company (P\_ORGINCON for infotypes 0000, 0001, 0002 for structural profile A, which is valid for the entire company). This user can maintain simultaneously all infotypes for the employees in his or area of responsibility, displayed via a link between his or her position and the organizational unit for which the user is a substitute (P\_ORGINCON for all infotypes for a structural profile B that is valid for the entire area of responsibility). Y ou can use the authorization object P\_HAP\_DOC to enable the user to display and change the appraisal documents for employees in his or her area of responsibility (structural profile B) and to specify that the user cannot display or change the appraisal documents for employees with structural profile A.
##  Example
Example C: Structurally and context-sensitively controlled access
A user has the structural profiles outlined in example B.
- Structural profile A for access across whole company
- Structural profile B for area of responsibility
You can also use the authorization object P\_HAP\_DOC to create a context-sensitive reference to the permitted templates. This means the user can see appraisals from a certain appraisal template, such as qualification checklists, for structural profile A, that is, company-wide. By defining a further setting for the authorization object P\_HAP\_DOC, you can give the user authorization to access all appraisal templates (such as objective setting agreements, assessments of potential, performance appraisals) that exist in his or her area of responsibility (structural profile B) for the same user.
For more information about structural authorizations, see SAP Library under ERP Central Component Human Resources Personnel Management Personnel Administration Technical Processes in Personnel Administration Authorizations for Human Resources .
## 13.3.5.2.3.3.2  Activating HAP00/AUTHO and Using P\_ORGINCON (with Structural HR Authorizations)
This setting means that structural authorizations are used to control access to HR master data and personnel appraisals in Performance Management.
To use the authorization object P\_ORGINCON, activate the switch AUTSW/INCON in table T77S0.
You must also enter a structural profile in the authorization object P\_ORGINCON and P\_HAP\_DOC.
The user requires a structural profile for all other object types in Organizational Management that do not belong to Performance Management but for which the user nevertheless has authorization using the authorization object PLOG.
In this combination, authorizations between HR master data and appraisals generally work in the same way as described in Structural Authorizations in Performance Management [page 424]. In addition, further contextsensitive authorization checks (in combination with structural profiles from Organizational Management) are possible.
If you use both structural, context-sensitive authorization objects P\_ORGINCON and P\_HAP\_DOC, note the following:
- It is not sufficient to give the user a structural profile using authorization object P\_HAP\_DOC. To enable the user to access employee master data, you must also make a setting for the authorization object P\_ORGINCON [page 422] (see also Authorization Object P\_HAP\_DOC [page 419]).
- You can give the user authorization to access a broader range of HR master data compared with appraisal documents.
##  Example
In the profile for P\_ORGINCON, a user can access the infotypes 0000, 0001, 0002 for all employees at the company who belong to the employee subgroup AT . The structural profile ALL in the authorization object P\_ORGINCON (structural profile A) provides the user with this authorization. The user also has a further instance of the authorization object P\_ORGINCON that permits him or her to maintain all infotypes for employees in his or her area of responsibility (structural profile B for defining the area of responsibility in Organizational Management).
In the user profile for the authorization object P\_HAP\_DOC, the user is given authorization to access appraisal documents for employees in his or her area of responsibility (structural profile B) as opposed to for the entire company, 'ALL' profile (structural profile A). This ensures that the user can access the appraisal documents for employees in his or her area of responsibility but not the appraisal documents for employees who belong to the employee subgroup AT , which is valid for the whole company.
- If you use the BAdI HRBAS00\_GET\_PROFL as opposed to maintaining table T77UA manually (see also Authorization Object P\_ORGINCON [page 422]), note that you must also consider the structural profiles from the authorization object P\_HAP\_DOC.
## 13.3.5.2.3.4  Controlling Authorizations and Access Using Customizing
The following infotypes are displayed in the form of tab pages and control authorization and access:
- Column Access
- Processing
- Roles
## 13.3.5.2.3.4.2  Tab: Processing (Infotype 5025)
- Setting: Self Appraisal Not Allowed
If this setting is activated, a user (that is the user who is logged on) cannot simulataneously perform the role of appraiser and appraisee.
- Setting: No Authorization Check for Appraiser
If this setting is activated, an authorization check is not performed for the appraiser. This means that even if a user does not have authorization for the appraiser's person, he or she can nevertheless display and edit all appraisal documents that include this appraiser.
<!-- image -->
##  Example
An appraiser has access only to the HR master data of employees in the employee subgroup Salaried Employees . That is, he or she can display and edit the appraisal documents for these employees. However, these employees can be appraised by an employee from a different employee subgroup (such as Managing Employees ). In this case, the administrator does not have access to the appraiser's person. To enable the administrator to nevertheless evaluate and edit appraisal documents for employees in the Employees subgroup, you use the setting No Authorization Check for Appraiser setting. Consequently, the appraiser's data is not checked for authorization and the administrator can also access the appraisal documents of appraisers in different areas.
- Setting: Processing Archived Appraisal Documents
Archived appraisal documents refer to completed appraisal documents. This setting determines whether completed appraisal documents can be deleted in transaction PHAP\_CHANGE\_PA. If you want this to be possible, select Delete or Reset and Delete . However, if you do not want this to be possible, select Do Not Reset or Delete .
To enable the user to delete completed appraisal documents in transaction PHAP\_CHANGE\_PA, he or she must have the relevant authorization in authorization object P\_HAP\_DOC (value 06 -Delete ). Regardless of this Customizing setting and the user's authorizations defined for this setting 06 -Delete , the user can always delete completed appraisal documents in transaction PHAP\_ADMIN\_PA provided that he or she is permitted to use this transaction.
## 13.3.5.2.3.4.3  Tab: Roles (Infotype 5024)
The Roles tab defines which roles in the appraisal templates are to be used for part appraisals.
You can use roles to define the relationship between the part appraiser and appraisee in the appraisal process. You can edit roles explicitly in the SAP system or have a BAdI (HRHAP00\_SELECTION) determine the roles from the enterprise's organizational structure.
You can use roles to restrict or control part appraisal authorizations at the level of individual elements. You make the relevant settings for individual elements in the Customizing settings for the Roles tab. If you do not use the role Colleague for a particular element in the appraisal template, this element cannot be appraised by the appraisee's colleague, for example.
This allows you to differentiate between the manager's part appraisal authorizations and the employee's part appraisal authorizations in relation to part appraisal columns in the same appraisal template.
##  Caution
The roles to be used in the appraisal process must be selected at category and appraisal-template level.
<!-- image -->
## 13.3.5.2.3.4.4  BSP-Specific Authorization Checks
For information about the authorizations for the BSP application, see SAP Note 616900 .
## 13.3.5.2.3.4.5  BAdI for Authorization Checks
The BAdI HRHAP00\_AUTHORITY is delivered for extended authorization checks and it can be used as a customer-specific implementation.
## 13.3.5.2.4  Network and Communication Security
Your network infrastructure is extremely important in protecting your system. Your network needs to support the communication necessary for your business needs without allowing unauthorized access. A well-defined network topology can eliminate many security threats based on software flaws (at both the operating system level and application level) or network attacks such as eavesdropping. If users cannot log on to your application or database servers at the operating system or database layer, then there is no way for intruders to compromise the machines and gain access to the back-end system's database or files. Additionally, if users are not able to connect to the server LAN (local area network), they cannot exploit well-known bugs and security holes in network services on the server machines.
The network topology for Performance Management is based on the topology used by the ABAP Platform. Therefore, the security guidelines and recommendations described in the ABAP Platform Security Guide also apply to Performance Management. Details that specifically apply to Performance Management are described in the following topics:
- Communication Channel Security This topic describes the communication paths and protocols used by Performance Management.
· Network Security This topic describes the recommended network topology for Performance Management. It shows the appropriate network segments for the various client and server components and where to use firewalls for access protection It also includes a list of the ports needed to operate Performance Management.
For more information, see the following sections of the ABAP Platform Security Guide:
- Network and Communication Security
- Security Aspects for Connectivity and Interoperability
## 13.3.5.2.4.1  Communication Channel Security
The table below shows the communication paths used by Peformance Management, the protocol used for the connection, and the type of data transferred.
| Communication Paths                                                    | Protocol Used     | Type of Data Transferred    | Data Requiring Particular Protection   |
|------------------------------------------------------------------------|-------------------|-----------------------------|----------------------------------------|
| Front-end client with SAP GUI for Windows for the ap- plication server | DIAG              | All application data        | Passwords and personal data            |
| Front-end client with a Web browser for the application server         | HTTP, HTTPS       | All application data        | Passwords and personal data            |
| Upload document                                                        | HTTP, HTTPS       | XMLdocument                 | Personal data                          |
| SAP Business Information Warehouse (SAP BW)                            | Extractor program | Performance Management data |                                        |
You can use Secure Network Communications (SNC) to protect DIAG and RFC connections. The Secure Sockets Layer protocol (SSL protocol) protects HTTP connections.
##  Recommendation
We strongly recommend that you use secure protocols (SSL, SNC) where possible.
For more information, see the SAP NetWeaver Security Guide under Transport Layer Security.
## Printing
Peformance Management provides the options for printing content. For information about security while printing, see the SNC User's Guide .
## 13.3.5.2.4.2  Network Security
## Ports
Performance Management runs on SAP NetWeaver and uses the ports from the AS ABAP. For more information, see the topic for AS ABAP Ports in the corresponding ABAP Platform Security Guides. For other components, for example, SAPinst, SAProuter, or the SAP Web Dispatcher, see https:/ /help.sap.com/viewer/ ports.