SAP Business One has no PFCG roles or authorization objects. Each user and each authorization group carries a tree of general authorizations set to Full, Read-Only or No Authorization, plus report, query and add-on authorizations, and a user can be flagged as superuser. This data source reads those tables and turns them into users and roles the risk engine can analyze.
Setup
- Click Add → SAP Business One
- Choose the Source:
- DI API on this computer: select a data directory for the extracted files, then enter the
Database type(SAP HANA, or Microsoft SQL Server 2016, 2017, 2019 or 2022), theServer(for exampleHDB@host:30013on HANA,host\instanceon SQL Server), theSLD server(for examplehost:40000), theCompany database(for exampleSBODEMOGB), and aB1 userand password. On SQL Server without SLD, also enter the database user and password. Test the connection, then extract. - Extracted files: select the folder holding the five files produced by the MTC PowerShell script.
- DI API on this computer: select a data directory for the extracted files, then enter the
- Click Save
The DI API extraction requires the SAP Business One DI API to be installed on the computer running MTC Skopos.
Required tables
All five are mandatory. Each is written as <TABLE>.csv: semicolon-separated, every value quoted, UTF-8.
| Table | Provides | Columns read |
|---|---|---|
| OUSR | Users, superuser flag, user's own general authorizations | USERID, USER_CODE, U_NAME, SUPERUSER, Locked, Department, SupportUsr, ALLOWENCES |
| OUGR | Authorization groups and their general authorizations | GroupId, GroupName, GroupDec, Allowences, StartDate, DueDate, GroupType |
| USR7 | Group membership | UserId, GroupId, StartDate, DueDate |
| USR3 | User's report, query and add-on authorizations | UserLink, PermId, Permission |
| UGR1 | Group's report, query and add-on authorizations | GroupLink, PermId, Permission |
Only the listed columns are selected. OUSR also holds password hashes; they are never extracted.
How the data is modelled
| Business One | In MTC Skopos |
|---|---|
| Authorization group | Role B1G_<GroupName> |
| A user's own authorizations | Role B1U_<USER_CODE> |
| Superuser flag | Role B1_SUPERUSER |
| Group membership | Role assignment, valid only between its start and due dates |
A ruleset function names the Business One permission ID and the level it needs, F (Full) or R (Read-Only). Business One permissions are a different model from SAP ERP, so an ECC or S/4HANA ruleset will not fire against this data source; keep a separate ruleset. See Creating Custom Rulesets.
Analyzing alongside SAP ERP
A Business One company can be loaded with ECC, S/4HANA or other systems and analyzed together. Conflicts spanning two systems need identity mapping; see Cross-System Analysis.