Understanding concepts of Roles have become more and more complex over these years. However, it has enhanced re-usability and eliminated the need of repeated work. In good’ol days you always assigned roles to users, groups, and even used child roles but always thought of how to reduce the re-work and expedite the process? Here is the answer for you – Use composite roles when you have to manage multiple roles simultaneously and use single roles only when you need to work with that particular role ONLY.

Note 1: Please note that a there is nothing called as composite role in Portal. Composite roles are defined when you are using ABAP as an UME and when you import these composite roles into portal, they are converted as roles OR worksets.

What is a composite role?

As its name suggest, composite role is a collection of multiple roles grouped together for better management of user assignment & permissions. You no more need to keep on assigning multiple roles to user and configure set of permissions on certain content. Instead you club together a bunch of roles to create a composite role. You can manage all permissions and user assignment on composite level instead of managing multiple roles.

What is a single role?

I don’t think this needs any further explanation. A single role is a single role. Not assigned through any composite role or a group. For e.g. In case of ESS, you have many single roles specific to country that you are in. The composite role is SAP_EMPLOYEE_ESS_WDA_1 and there are many single roles such as SAP_EMPLOYEE_AU_ESS_WAD_1 or SAP_EMPLOYEE_DE_ESS_WDA_1 assigned to this composite role for Australia and Germany respectively. So instead of managing permissions and assignments for all these single roles, you can optimize the performance by using composite role.

Note 2: Please note that there are disputes amongst people about the usage of Composite roles. Some day that using composite roles is not a good practice however this is not entirely true. In terms of SAP Security and SAP Practice, Composite role is not considered a bad practice. Rather many administration documents released by SAP recommend using Composite roles. Remember this simple equation, When in SAP, Composite role is not a bad practice. It might not be true in case of other technologies.

Note 3: Also note that you cannot assign a composite role to another composite role.

What is the difference between a group and a composite role?

This was the obvious question and I am sure many of you must have considered composite role as group. On a technical level, both are almost the same but on functionality level they are not. The distinction is in server stacks and UME usage. Composite role is a concept used when you are using ABAP as an UME and when you import a composite tole into Portal they are converted into Role or Workset. Composite roles appear as group in UME when ABAP is being used as data source.  In short, there is no composite role in SAP Netweaver Portal.