Skip to end of metadata
Go to start of metadata


The purpose of this wiki article is to outline the essential steps in assigning roles to users for E-Recruiting application. 


The concept of roles is integral and most central to E-Recruiting given that the various functionalities available for Recruiter, Manager, Candidate etc. all require a level of authorization for access to carry out neccessary tasks, it is important to note that E-Recruiting is based on a stable CP-US relationship centered around Infotype 105 subtype 001 and this mandatory infotype is also required for subsequent creation of objects Candidate (NA) Business Partner (BP), User (US) etc. but in addition to this your users must also have relevant roles assigned to allow them to access and carry out various activities within the portal solution.

1. Assigning and customizing the role:

Firstly, there are standard roles shipped with E-Recruiting and these can all be customized via the transaction PFCG.

To see the authorizations for the E-Recruiting roles:  Transaction Code: PFCG  Profile Generator  Search on SAP_RCF*  Select a Role and click on Display> Click on the Authorizations Tab and then the Display Authorization Data Button


(Please see the SAP Help for more information on the standard delivered roles - Recruiter, Administrator, and Data Entry Clerk roles )

The standard roles are as follows:  These are taken from the IMG path: SAP E-Recruiting > Technical Settings > User Administration > Roles in E-Recruiting (or Table
1 Candidate (Internal) RCF_CAND_INT
3 Talent Consultant RCF_TC
4 Manager's Assistant RCF_MGRASS
5 Candidate (External) RCF_CAND_EXT
6 Administrator RCF_ADMIN
7 Recruiter RCF_RECRUIT
9 Data Entry Clerk RCF_DATA_TYP
10 Requester RCF_REQUEST
11 Decision Maker RCF_DECISION
12 Succession Planner RCF_SUCC_PL
13 Restricted Recruiter RCF_RES_REC
14 Restricted Succession Planner RCF_RES_SUCC 

Most importantly - whilst roles can be customized to adjust authorizations and access etc - the following roles should never be deleted:

You may change but not delete the following roles:

1 Candidate (Internal)
2 Manager
5 Candidate (External)
6 Administrator
7 Recruiter
9 Data Entry Clerk
10 Requester
11 Decision Maker

In E-Recruiting, a reference user is assigned to a role. The reference user incorporates user roles which, in turn, contain the authorization profiles. When you create a new user, you can assign it an E-Recruiting role. The new user inherits the authorization profiles of the reference user assigned to this role. 

2. Changing Authorizations for role:

With each standard role, the authorizations are automatically granted that each role grants access to perform and access certain tasks and pages (Ivews) within the Web Dynpro and BSP portal pages. For example  -  the recruiter needs to be able to create and release requisitions and job postings, search for candidates, create and maintain requisitions and perform various activities as part of their day to day tasks and so the following pages are stored with access for the recruiter role.

The following Web Dynpro applications of SAP E-Recruiting are stored in the authorization object P_RCF_WDUI for the recruiter:





Requisition Management


Maintain Agencies


Maintain Application Groups


Application Management


Background Check of Details of Activity


Maintain Candidate Profile


Display Candidate Profile


Candidate Selection


Candidate Search


Exclude Candidates from Search


Display Data Overviews


Personal Settings


Maintain Process Templates


Maintain Questionnaires


Maintain Questions


Quick Search


Search for Requisitions


Requisition Management


Maintain Talent Groups


Work Center Dashboard

In order for the recruiter to perform their tasks, the recruiter must have the relevant role (in this case) assigned to their user.

You can also determine the level of access that the recruiter has - for example you can choose whether they can maintain candidate data in the talent pool by customizing the authorization object by adjusting the authorization object here


Example: The following types of access to the candidate pool are stored in the authorization object P_RCF_POOL:

Access Types

Access Type



Maintenance of Candidate Data


Status-Independent Access to Candidates


Recognition of Multiple Applicants

The recruiter can change the status of the following object types that are stored in the authorization object P_RCF_STAT:

Object Types

Object Type













Questionnaire Template (AES: Appraisal Template)


Question (AES: Criteria Group)

You can choose to give a write, or display only authorization for your recruiter.

There is also the option for "restricted recruiter" (Functionality with EHP4) which is pre-configured as follows:

Technical name: SAP_RCF_REC_ADMIN_ERC_CI_2
object P_RCF_APPL administrator
ERC_A_DEL_EXT_CAND   Delete External Candidates
ERC_A_DEREG_CAND     Deregister External Candidates

Technical name: SAP_RCF_RECRUITER_ERC_CI_2
ERC_A_PROC_TEMPL_MAINTAIN  Maintain Process Templates
ERC_A_QUESNR_MAINT         Maintain Questionnaires
ERC_A_QUESNR_MAINTAIN      Maintain Questions
ERC_A_APPL_GRP             Maintain Application Groups
ERC_A_AGENCY               Maintain Agency

Finally on topic of recruiter role, note that with EHP4, a new recruiter role was delivered  - SAP_RCF_RECRUITER_ERC_CI_2 - 1241014 - Information for existing customers about EHP 4 

which came with business function - HCM_ERC_CI_3) and it is this role that should be used.

New authorization roles are provided for the recruiter, administrator and the data entry clerk. These contain all of the authorizations that the user requires to call the new Web Dynpro
applications (see transaction PFCG).

The following roles are delivers in the standard SAP system:

SAP_RCF_DATA_TYPIST_ERC_CI_2: Data entry clerk

SAP_RCF_REC_ADMIN_ERC_CI_2: Administrator


SAP_RCF_RES_RECRUITER_ERC_CI_2: Restricted recruiter

In addition, a new authorization object is provided: P_RCF_WDUI

This authorization object (P_RCF_WDUI) contains all Web Dynpro applications that the user is authorized to execute in SAP E-Recruiting.

3. Further information on roles for Candidates

In much the same way that roles must be assigned for recruiter and administrator etc. Also, candidates need to have roles assigned to their user to be able to apply for job postings and maintain their profile etc. We have two types of role for candidate in E-Recruiting  - Internal candidate (Hired or already in HR) and External candidate. Both have different access as end users and are dependent on the status in table HRP5102. This is also dependent on your landscape  - whether you are in an integrated scenario or standalone system, in integrated scenario employees are loaded by ALE to the E-Recruiting system and automatically assigned a reference user. 

So as the status of the candidate changes so the user can be set to change from internal candidate to external candidate allowing a greater degree of security as to what data you allow this candidate to access.  See SAP note for more information 997181

4. Customizing for Reference, System and Service Users:

In E-Recruiting system as we already mentioned you have to first define a user as a reference user (transaction SU01). the reference user is then assigned to another user. This user inherits all attributes of the reference user.

This is essential also in the standard system for internal and external candidate and we have reference users* RCF_CAND_INT* and RCF_CAND_EXT* Normally, reference users are required since users can be created dynamically in E-Recruiting (registrations and non-registration applications). Reference users are used as a template for assigning authorization for such users and for external candidates, these are also assigned a user when they register.

Service users and System users must be set up in E-Recruiting as without role assignment to these users , you will find that authorization for certain activities such as WF-BATCH these will simply not work as the system user has no access to key authorizations and transactions to generate emails or to perform certain activities. Please see the related document below for more guidance on setting up WF-BATCH user with email address, printer and reference role.

These special users can be generated for necessary objects such as NA, CP etc.  by the report RCF_CREATE_USER run from transaction SE38:



5. Setting up un-registered service user:

Please ensure to assign the following roles to your unregistered service user  - example RCF_UNREGSER

  • Assign the service user the SAP_RCF_UNREG_CANDIDATE_CLIENT role or one of the user roles you copied.
  • Assign the reference user for external candidates the SAP_RCF_EXT_CANDIDATE_CLIENT role or one of the user roles you copied.
  • Assign the reference user for internal candidates the SAP_RCF_INT_CANDIDATE_CLIENT role or one of the user roles you copied.

Then this service user should be assigned to SICF services as follows:  /default_host/sap/bc/webdynpro/sap/

1. hrrcf_apply_ext
2. hrrcf_cand_reg
3. hrrcf_password
4. hrrcf_pinstappl
5. hrrcf_pinst_pbl
6. hrrcf_search
7. hrrcf_unrg_appl
8. hrrcf_unrg_srch



Most importantly for the unregistered service user, please ensure that the unregistered service user must only have the unregistered roles assigned (not external ones) and also that NO candidate object is assigned to it.

How the services are maintained for SICF is described in the documentation of IMG step:

 Technical Settings -> User Interface -> WD -> Candidate Frontend -> Specify E-Recruiting Services (Web Dynpro ABAP)

6. New roles delivered with Enhancement Pack 6.

Please refer to the following wiki page Enhancment pack 6 - role concept as new roles were delivered for the 606 version which render the roles delivered in earlier versions obsolete. These were delivered for security reasons and with changes to authorization objects and this is explained further in the role concept section of the wiki page with a full list of the new roles delivered. In particular for recruiter it should be noted that SAP_ERC_RECRUITER_CI_4 supercedes the previosly delivered role for recruiter of SAP_ERC_RECRUITER_ERC_CI_2 and these roles are maintained in the transaction SU22.

Related content

Related documents

Enhancement Pack 6 - new roles

Adding and assigning portal roles to users in E-Recruiting

Forgotten password and objects for WF-BATCH user

Setting up users for ESS

Related notes

1241014 - Information for existing customers about EHP 4
997181 - ERP Integration SAP E-Recruiting
1394119 - EHP4 information about application SAP E-Recruiting