Skip to main content

Celonis Product Documentation

SAP User Role CELONIS/AUTOMATION_BASIS

Celonis provides an ready-to-use user role which can be imported in SAP.

This user role contains the permissions that are necessary to get started with the simple & advanced SAP Action.

Overview
Permissions included in CELONIS/AUTOMATION_BASIS user role

Similar to the Extractor setup, Celonis provides an ready-to-use user role which can be imported in SAP for Automation. This role can be considered the minimum set of permissions required to use the integration, use-case specific RFC permissions will be required on top of this.

The user role CELONIS/AUTOMATION_BASIS has permissions to use the following BAPIs & RFC calls:

Object

Field

Activities/Values

S_RFC

ACTVT

16

S_RFC

RFC_NAME

BAPI_TRANSACTION_COMMIT, BAPI_TRANSACTION_ROLLBACK, FUNCTION_IMPORT_INTERFACE, RFCPING, RFC_FUNCTION_SEARCH, RFC_GET_STRUCTURE_DEFINITION, RFC_GET_FUNCTION_INTERFACE, RFC_PING, DDIF_FIELDINFO_GET, RFC_METADATA_GET

S_RFC

RFC_TYPE

FUNC

Object

Field

Activities/Values

S_RFC

ACTVT

16

S_RFC

RFC_NAME

RFC1, SYST, /CELONIS, SDIFRUNTIME, SDTX, SRFC, SYSU

S_RFC

RFC_TYPE

FUGR

Warning

Please note that FUNC RFC_METADATA_GET and FUGR SDIFRUNTIME, SDTX, SRFC, SYSU have been added compared to the permissions required for skills, as they are required for the communication via JCo. Thus, these permissions need to be added if you are switching from an agent older than 1.0.0.

Warning

Note that RFC_METADATA_GET might not be present in old SAP installations. In case it's not present, our integration will resort to a fallback solution and work as well.

→ Depending on your use case it might be necessary to manually add permissions for additional BAPIs or RFC calls in addition to the ones included in the user role.

Use case examples:

  • If you would like your users to be able to change a purchase order, you will have to add permissions for BAPI_PO_CHANGE.

  • To post a goods movement document for an order that has been delivered by the vendor, you will need to add permissions for BAPI_GOODSMVT_CREATE.

Missing permissions

In case of your user lacking permissions for a certain SAP action that is supposed to be performed, a standard way of dealing with this is to leverage transaction SU53 within SAP to communicate with the SAP basis the authorizations required.

Download - SAP User Role CELONIS/AUTOMATION_BASIS

The SAP user role "CELONIS/AUTOMATION_BASIS" can be downloaded here. Please engage your SAP admin to import the user role in your SAP instance.

Minimal set of recommended permissions

Instead of importing the user role, it is also possible to create the corresponding role manually or add the required permissions to an existing role. The following minimal set of permissions is required (or at least recommended) for using Celonis Agent. Please not as mentioned above that depending on your use case it might be necessary to manually add permissions for additional BAPIs or RFC calls in addition to the ones included here.

For SAP release 7.10 or newer:

Object

Field

Activities/Values

S_RFC

ACTVT

16

S_RFC

RFC_NAME

BAPI_TRANSACTION_COMMIT, BAPI_TRANSACTION_ROLLBACK, FUNCTION_IMPORT_INTERFACE, RFCPING, RFC_FUNCTION_SEARCH, RFC_GET_STRUCTURE_DEFINITION, RFC_GET_FUNCTION_INTERFACE, RFC_PING, DDIF_FIELDINFO_GET, RFC_METADATA_GET

S_RFC

RFC_TYPE

FUNC

For older SAP releases, permissions have to be granted on FUGR level, requiring:

Object

Field

Activities/Values

S_RFC

ACTVT

16

S_RFC

RFC_NAME

RFC1, SYST

S_RFC

RFC_TYPE

FUGR