What is PFCG?: Transaction PFCG is the profile generator. In this transaction you can generate or maintain PFCG profiles or roles.
How is a new role created?: Search for one of the SAP standard roles. These are templates that can be used for authorization purposes, but they are not to be changed. Create a new role if you want to make any change to it. Copy the standard role to a Y- or Z-role. In the maintenance screen, go to tab authorizations. Select maintain authorizations. Here you can maintain the required object ID settings. E.g. maintain the settings for editing of transactions, object id ‘XXXX’. Save the changes and generate. For creating a new composite role, select the botton ‘new composite role’ from the PFCG screen. In the tab roles, add the roles required for this role. Pfcg profiles can be transported. For this you go to the menu option ‘XXX’ in the pfcg start screen.
How do you assign a pfcg role to a user?: You can assign a pfcg role directly to the user id, in transaction SU01, tab ‘roles’. You can also assign a pfcg role to the WebUI business role (see chapter WebUI), at creation. Whomever logs on with this business role will then have the assigned authorizations of the pfcg.