SAP User Role CELONIS/AUTOMATION_BASIS
Celonis provides an ready-to-use user role which can be imported in SAP.
This user role contains the permissions that are necessary to get started with the simple & advanced SAP Action.
Overview
Permissions included in CELONIS/AUTOMATION_BASIS user role
Like the Extractor setup, Celonis provides a ready-to-use user role that can be imported into SAP for Automation. This role can be considered the minimum set of permissions required to use the integration, use-case specific RFC permissions will be required on top of this.
The user role CELONIS/AUTOMATION_BASIS has permission to use the following BAPIs & RFC calls:
Object | Field | Activities/Values |
|---|---|---|
S_RFC | ACTVT | 16 |
S_RFC | RFC_NAME | BAPI_TRANSACTION_COMMIT, BAPI_TRANSACTION_ROLLBACK, FUNCTION_IMPORT_INTERFACE, RFCPING, RFC_FUNCTION_SEARCH, RFC_GET_STRUCTURE_DEFINITION, RFC_GET_FUNCTION_INTERFACE, RFC_PING, DDIF_FIELDINFO_GET, RFC_METADATA_GET |
S_RFC | RFC_TYPE | FUNC |
Object | Field | Activities/Values |
|---|---|---|
S_RFC | ACTVT | 16 |
S_RFC | RFC_NAME | RFC1, SYST, /CELONIS, SDIFRUNTIME, SDTX, SRFC, SYSU |
S_RFC | RFC_TYPE | FUGR |
Warning
Please note that FUNC RFC_METADATA_GET and FUGR SDIFRUNTIME, SDTX, SRFC, SYSU have been added compared to the permissions required for skills, as they are required for the communication via JCo. Thus, these permissions need to be added if you are switching from an agent older than 1.0.0.
Warning
Note that RFC_METADATA_GET might not be present in old SAP installations. In case it's not present, our integration will resort to a fallback solution and work as well.
→ Depending on your use case it might be necessary to manually add permissions for additional BAPIs or RFC calls in addition to the ones included in the user role.
Use case examples:
If you would like your users to be able to change a purchase order, you will have to add permissions for BAPI_PO_CHANGE.
To post a goods movement document for an order that has been delivered by the vendor, you will need to add permissions for BAPI_GOODSMVT_CREATE.
Missing permissions
In case of your user lacks permissions for a specific SAP action that is supposed to be performed, a standard way of dealing with this is to leverage transaction SU53 within SAP to communicate with the SAP basis the authorizations required.
Download - SAP User Role CELONIS/AUTOMATION_BASIS
The SAP user role "CELONIS/AUTOMATION_BASIS" can be downloaded here. Please engage your SAP admin to import the user role in your SAP instance.
Minimal set of recommended permissions
Instead of importing the user role, creating the corresponding role manually or adding the required permissions to an existing role is possible. The following minimal set of permissions is required (or at least recommended) for using Celonis Agent. Please note, that depending on your use case it might be necessary to manually add permissions for additional BAPIs or RFC calls in addition to the ones included here.
For SAP release 7.10 or newer:
Object | Field | Activities/Values |
|---|---|---|
S_RFC | ACTVT | 16 |
S_RFC | RFC_NAME | BAPI_TRANSACTION_COMMIT, BAPI_TRANSACTION_ROLLBACK, FUNCTION_IMPORT_INTERFACE, RFCPING, RFC_FUNCTION_SEARCH, RFC_GET_STRUCTURE_DEFINITION, RFC_GET_FUNCTION_INTERFACE, RFC_PING, DDIF_FIELDINFO_GET, RFC_METADATA_GET |
S_RFC | RFC_TYPE | FUNC |
For older SAP releases, permissions have to be granted on FUGR level, requiring:
Object | Field | Activities/Values |
|---|---|---|
S_RFC | ACTVT | 16 |
S_RFC | RFC_NAME | RFC1, SYST |
S_RFC | RFC_TYPE | FUGR |