Skip to end of metadata
Go to start of metadata

Purpose:

The purpose of this wiki article is to outline the essential steps in assigning roles to users for E-Recruiting application. 

Overview:

The concept of roles is integral and most central to E-Recruiting given that the various functionalities available for Recruiter, Manager, Candidate etc. all require a level of authorization for access to carry out neccessary tasks, it is important to note that E-Recruiting is based on a stable CP-US relationship centered around Infotype 105 subtype 001 and this mandatory infotype is also required for subsequent creation of objects Candidate (NA) Business Partner (BP), User (US) etc. but in addition to this your users must also have relevant roles assigned to allow them to access and carry out various activities within the portal solution.

1. Assigning and customizing the role:

Firstly, there are standard roles shipped with E-Recruiting and these can all be customized via the transaction PFCG.

To see the authorizations for the E-Recruiting roles:  Transaction Code: PFCG  Profile Generator  Search on SAP_RCF*  Select a Role and click on Display> Click on the Authorizations Tab and then the Display Authorization Data Button

Example



(Please see the SAP Help for more information on the standard delivered roles - Recruiter, Administrator, and Data Entry Clerk roles )

The standard roles are as follows:  These are taken from the IMG path: SAP E-Recruiting > Technical Settings > User Administration > Roles in E-Recruiting (or Table
T77RCF_ROLE)
1 Candidate (Internal) RCF_CAND_INT
2 Manager RCF_MANAGER
3 Talent Consultant RCF_TC
4 Manager's Assistant RCF_MGRASS
5 Candidate (External) RCF_CAND_EXT
6 Administrator RCF_ADMIN
7 Recruiter RCF_RECRUIT
9 Data Entry Clerk RCF_DATA_TYP
10 Requester RCF_REQUEST
11 Decision Maker RCF_DECISION
12 Succession Planner RCF_SUCC_PL
13 Restricted Recruiter RCF_RES_REC
14 Restricted Succession Planner RCF_RES_SUCC 

Most importantly - whilst roles can be customized to adjust authorizations and access etc - the following roles should never be deleted:

You may change but not delete the following roles:

1 Candidate (Internal)
2 Manager
5 Candidate (External)
6 Administrator
7 Recruiter
9 Data Entry Clerk
10 Requester
11 Decision Maker

In E-Recruiting, a reference user is assigned to a role. The reference user incorporates user roles which, in turn, contain the authorization profiles. When you create a new user, you can assign it an E-Recruiting role. The new user inherits the authorization profiles of the reference user assigned to this role. 

2. Changing Authorizations for role:

With each standard role, the authorizations are automatically granted that each role grants access to perform and access certain tasks and pages (Ivews) within the Web Dynpro and BSP portal pages. For example  -  the recruiter needs to be able to create and release requisitions and job postings, search for candidates, create and maintain requisitions and perform various activities as part of their day to day tasks and so the following pages are stored with access for the recruiter role.

The following Web Dynpro applications of SAP E-Recruiting are stored in the authorization object P_RCF_WDUI for the recruiter:

Applications

Application

Name

ERC_A_ADJUST_REQ_RET

Requisition Management

ERC_A_AGENCY

Maintain Agencies

ERC_A_APPL_GRP

Maintain Application Groups

ERC_A_APPL_MGMT

Application Management

ERC_A_BGC_ACTIVITY_DETAIL

Background Check of Details of Activity

ERC_A_CAND_OVERVIEW

Maintain Candidate Profile

ERC_A_CAND_OVERVIEW_DISPLAY

Display Candidate Profile

ERC_A_CAND_SELECT

Candidate Selection

ERC_A_CAND_SRCH

Candidate Search

ERC_A_CAND_SRCH_EXCL_CAND

Exclude Candidates from Search

ERC_A_DATAOVERVIEW

Display Data Overviews

ERC_A_PERS_SETTINGS

Personal Settings

ERC_A_PROC_TEMPL_MAINTAIN

Maintain Process Templates

ERC_A_QUESNR_MAINT

Maintain Questionnaires

ERC_A_QUESNR_MAINTAIN

Maintain Questions

ERC_A_QUICK_SEARCH

Quick Search

ERC_A_REQUI_SEARCH

Search for Requisitions

ERC_A_REQ_MGMT

Requisition Management

ERC_A_TG

Maintain Talent Groups

ERC_A_WORKCENTER

Work Center Dashboard


In order for the recruiter to perform their tasks, the recruiter must have the relevant role (in this case) assigned to their user.

You can also determine the level of access that the recruiter has - for example you can choose whether they can maintain candidate data in the talent pool by customizing the authorization object by adjusting the authorization object here

Example: 


Example: The following types of access to the candidate pool are stored in the authorization object P_RCF_POOL:

Access Types

Access Type

Name

CAND_MAINT

Maintenance of Candidate Data

DIRECT_ACC

Status-Independent Access to Candidates

DUPL_CHECK

Recognition of Multiple Applicants


The recruiter can change the status of the following object types that are stored in the authorization object P_RCF_STAT:

Object Types

Object Type

Name

NA

Candidate

NB

Requisition

NC

Posting

ND

Application

NE

Candidacy

VA

Questionnaire Template (AES: Appraisal Template)

VB

Question (AES: Criteria Group)


You can choose to give a write, or display only authorization for your recruiter.

There is also the option for "restricted recruiter" (Functionality with EHP4) which is pre-configured as follows:

Technical name: SAP_RCF_REC_ADMIN_ERC_CI_2
object P_RCF_APPL administrator
ERC_A_DEL_EXT_CAND   Delete External Candidates
ERC_A_DEREG_CAND     Deregister External Candidates

Technical name: SAP_RCF_RECRUITER_ERC_CI_2
ERC_A_PROC_TEMPL_MAINTAIN  Maintain Process Templates
ERC_A_QUESNR_MAINT         Maintain Questionnaires
ERC_A_QUESNR_MAINTAIN      Maintain Questions
ERC_A_APPL_GRP             Maintain Application Groups
ERC_A_AGENCY               Maintain Agency

Finally on topic of recruiter role, note that with EHP4, a new recruiter role was delivered  - SAP_RCF_RECRUITER_ERC_CI_2 - 1241014 - Information for existing customers about EHP 4 

which came with business function - HCM_ERC_CI_3) and it is this role that should be used.

New authorization roles are provided for the recruiter, administrator and the data entry clerk. These contain all of the authorizations that the user requires to call the new Web Dynpro
applications (see transaction PFCG).

The following roles are delivers in the standard SAP system:

SAP_RCF_DATA_TYPIST_ERC_CI_2: Data entry clerk

SAP_RCF_REC_ADMIN_ERC_CI_2: Administrator

SAP_RCF_RECRUITER_ERC_CI_2: Recruiter

SAP_RCF_RES_RECRUITER_ERC_CI_2: Restricted recruiter

In addition, a new authorization object is provided: P_RCF_WDUI

This authorization object (P_RCF_WDUI) contains all Web Dynpro applications that the user is authorized to execute in SAP E-Recruiting.

3. Further information on roles for Candidates

In much the same way that roles must be assigned for recruiter and administrator etc. Also, candidates need to have roles assigned to their user to be able to apply for job postings and maintain their profile etc. We have two types of role for candidate in E-Recruiting  - Internal candidate (Hired or already in HR) and External candidate. Both have different access as end users and are dependent on the status in table HRP5102. This is also dependent on your landscape  - whether you are in an integrated scenario or standalone system, in integrated scenario employees are loaded by ALE to the E-Recruiting system and automatically assigned a reference user. 

So as the status of the candidate changes so the user can be set to change from internal candidate to external candidate allowing a greater degree of security as to what data you allow this candidate to access.  See SAP note for more information 997181

4. Customizing for Reference, System and Service Users:

In E-Recruiting system as we already mentioned you have to first define a user as a reference user (transaction SU01). the reference user is then assigned to another user. This user inherits all attributes of the reference user.

This is essential also in the standard system for internal and external candidate and we have reference users* RCF_CAND_INT* and RCF_CAND_EXT* Normally, reference users are required since users can be created dynamically in E-Recruiting (registrations and non-registration applications). Reference users are used as a template for assigning authorization for such users and for external candidates, these are also assigned a user when they register.

Service users and System users must be set up in E-Recruiting as without role assignment to these users , you will find that authorization for certain activities such as WF-BATCH these will simply not work as the system user has no access to key authorizations and transactions to generate emails or to perform certain activities. Please see the related document below for more guidance on setting up WF-BATCH user with email address, printer and reference role.

These special users can be generated for necessary objects such as NA, CP etc.  by the report RCF_CREATE_USER run from transaction SE38:

Example

 


5. Setting up un-registered service user:

Please ensure to assign the following roles to your unregistered service user  - example RCF_UNREGSER

  • Assign the service user the SAP_RCF_UNREG_CANDIDATE_CLIENT role or one of the user roles you copied.
  • Assign the reference user for external candidates the SAP_RCF_EXT_CANDIDATE_CLIENT role or one of the user roles you copied.
  • Assign the reference user for internal candidates the SAP_RCF_INT_CANDIDATE_CLIENT role or one of the user roles you copied.

Then this service user should be assigned to SICF services as follows:  /default_host/sap/bc/webdynpro/sap/

1. hrrcf_apply_ext
2. hrrcf_cand_reg
3. hrrcf_password
4. hrrcf_pinstappl
5. hrrcf_pinst_pbl
6. hrrcf_search
7. hrrcf_unrg_appl
8. hrrcf_unrg_srch

Example:

 

Most importantly for the unregistered service user, please ensure that the unregistered service user must only have the unregistered roles assigned (not external ones) and also that NO candidate object is assigned to it.

How the services are maintained for SICF is described in the documentation of IMG step:

 Technical Settings -> User Interface -> WD -> Candidate Frontend -> Specify E-Recruiting Services (Web Dynpro ABAP)

6. New roles delivered with Enhancement Pack 6.

Please refer to the following wiki page Enhancment pack 6 - role concept as new roles were delivered for the 606 version which render the roles delivered in earlier versions obsolete. These were delivered for security reasons and with changes to authorization objects and this is explained further in the role concept section of the wiki page with a full list of the new roles delivered. In particular for recruiter it should be noted that SAP_ERC_RECRUITER_CI_4 supercedes the previosly delivered role for recruiter of SAP_ERC_RECRUITER_ERC_CI_2 and these roles are maintained in the transaction SU22.

Related content

Related documents

Enhancement Pack 6 - new roles

Adding and assigning portal roles to users in E-Recruiting

Forgotten password and objects for WF-BATCH user

Setting up users for ESS

Related notes

1241014 - Information for existing customers about EHP 4
997181 - ERP Integration SAP E-Recruiting
1394119 - EHP4 information about application SAP E-Recruiting