Question { Cognizant, 13842 }

we have one parent role and we derived five roles from that
and i assigned these derived roles to five users now i want
to restrict 2 users for couple of T-codes and rest of the
users work with those T-codes , How we can solve the problem

Answer

We can change the Authorizations of those 2 specific derived roles by removing the desired tcodes and generate. But this actually defies the derived - template roles concept.

Also, whenever the template role is modified for some reason i future, and if the change is inherited via the template role, then the 2 specific derived roles will lose all the changes made to them (as above) and will get the same auths as the template role again.
The only solution in this case is to not derive all roles from the template role after template roles modification, but to derived individually each of those 3 derived roles, and make the changes exclusively to those 2 derived roles. This is possible but proposes a very weak and unnecessary overhead task for Security administrator.

Question { HCL, 2182 }

what is user master record and what it contains?

Answer

User master record is a set of information that is stored about a user in various categories or subsets of information such as his Address (First, Last, Full names, department, function, address...); Logon data (logon password, user type, user logon group, account ....), Default settings (Date, Decimal and Time formats, output devices, Start menu, logon lang ..), SNC (Secure N/w Connection to provide ext security); Roles, Profiles, Groups and the ilk.

Question { 1349 }

What is a derived role?

Answer

Any role that is inherited from a Parent or Template role is called derived role.
It basically has the same authorizations as a template role, but differs in Org levels (e.g., company code, plant , distr channel ..).
However, it is technically possible for a derived role to have different authorizations from a template role, but in that case, it defies the very concept of template -derived roles.

It is mainly used to have the same set of authorizations for various Org level sets, so that users of a specific Org levls set could use the access to only those Org levels and not outside the set.