Johan van Zijl

Despite the multitude of options available for loading data into SAP, it seems the stapler still remains popular…

This an extremely poorly documented area in SAP CRM, here are some useful notes:

Note 847643 – Composite SAP Note: Configuration in CRM

Note 741586 – Working with a knowledge base

Note 659608 – Replication of configurable materials

Note 161660 – Product configuration on Mobile Sales client

I recently read a very interesting post by Martin Ceronio that explains an innovative way of gaining shell access to any SAP system.

Obviously, Basis and Security consultants all over will have a fit when they realise this is possible on their precious SAP systems. I must admit though, this is so easy that I am not 100% comfortable with this hole.

But, In order to exploit this you do need access to an SAP system and a fair amount of knowledge of how SAP works …and sufficient authorization.

This brings me to something that has been bothering me lately, which is customers need to trust the consultants they give access to their systems, especially ABAP consultants as they no more about the internals of SAP than anyone else.

The latest trend  is to lock down authorizations in development systems to the point where consultants are unable to perform their work and there is always doubt as to whether the problem is code related or authorization related. I completely support the full lock down of Quality Assurance and Production Systems, but is it really necessary in Development?

The moment you give a consultant debug with variable change authorization(which ABAP consultants must have in development), virtually any check can be bypassed (you can even grant yourself SAP_ALL and a Developer Key).

The other major threat is ABAP developers writing malicious programs and slipping them into production under the radar.

In my view draconian restrictions in development systems frustrates your consultants and leads to a real increase in development time. The assumptions made by the implemter of these authorizations must be(maybe a bit harsh):

• The consultants cannot be trusted to act responsibility
• They are too stupid to find their way around all the restrictions

There is a lighter side to this though and that involves phoning the authorization consultant at 2:00 AM for that transaction code you really need now to the fix problem(and going to bed and booking a delay against him if he doesn’t answer).

Someone finally performed a Salary Survey that is specific to the South African SAP Market.

You can find the Salary Survey here. Unfortunately, you must register at your own risk to see the results.

The survey makes for good reading and caters for both contractors and permanent employees. It provides data such as average contract rates, contract lengths, and salaries by sap component.

A slight concern I have concerning the survey is that they don’t release the size of the sample used, and I am not 100% convinced the sample is truly representative(I have asked and they’re not telling). Still, I think this is a good thing and hopefully next year’s survey will be better.

I stumbled upon Digiata’s site by accident. Have a look at it.

It is really simple, nothing flashy… but, it gets the message across.  The content is structured logically and describes the products and services clearly.  

For each product there is a short and sweet description, that includes the following:

• What is ProductX?
• Business need 
• How we solve it
• 10 Reasons to use ProductX
• Features
• Requirements 
• Screenshots