# Configure custom authorization and role management

The Palantir Foundry Connector 2.0 for SAP Applications supports custom authorization management from SP16 onwards. Roles and object access definitions can be defined on transparent tables instead of SAP Standard Authorization Management (`PFCG`).

To enable this feature, run the `/PALANTIR/PARAM` transaction and maintain the following parameter values:

* **Param ID:** `SYSTEM`
* **Param Name:** `AUTH_CHECK_SOURCE`
* **Param Value:** `TABLE`

If this feature is enabled, existing content roles will not be checked. To deactivate this feature, delete the parameter or change the parameter value from `TABLE` to `PFCG`.

To create custom roles, follow the steps below:

* Run the `/PALANTIR/AUTH_01` transaction to define new roles.
  * Role ID is the unique identifier for the role. It can be used across all contexts.

  * Object Type is the object type supported by the Foundry SAP Connector:
    * `TABLE`
    * `REMOTETABLE`
    * `INFOPROVIDER`
    * `REMOTEINFOPROVIDER`
    * `BEX`
    * `FUNCTION`
    * `REMOTEFUNCTION`
    * `SLT`
    * `EXTRACTOR`

  * Object is the main extraction object. For example, if the object type is `TABLE` then the object should be the table name (`BSEG` or `B*`; wildcards are supported).

  * Configure the `Exc/Inc` setting to allow or deny access. Use `Exclude` to deny access to objects.

* Run the `/PALANTIR/AUTH_02` transaction and assign roles to users and contexts.
  * The user is the one used by Foundry to connect to SAP, defined in the Foundry Source configuration.
  * If there is no remote agent, extractor, or SLT, then context should be left blank.
  * The same role can be used for multiple contexts and users.