ABAP prog with Call Transaction to SU01 will not add roles in a CUA client

Question

I am modifying a current ABAP program that works in a non-CUA client to hopefully execute in a CUA client.  This program performs a Call Transaction to tcode SU01 and adds roles to an existing user.  I used tcode SHDB to identify the new BDC commands needed for CUA when using tcode SU01.  When executing the program in the CUA client  it does not save the roles to the user.  There is no error message or abnormal termination.
When I assign the role to the same user that's referenced in my program directly with tcode SU01 it works fine.  Its just when I run the ABAP program the role assigment is not retained.  I opened a Customer Message with SAP and they referenced OSS Note 93802 and said this was a consulting question.  My program is not abending as referenced in Note 93802, it just does not add the role.
Has anyone been able to get this to work in a CUA client?

Answer 1

Hi,
it should be fairly simple to create a new ABAP using the BAPI's related to business object USER. Call BAPI_USER_CREATE1 to create the users, and BAPI_USER_LOCACTGROUPS_ASSIGN to assign roles in a CUA environment. It should go something like this:
[read file with user data into internal table wt_users]
[read file with role assignments into internal table wt_roles]
Loop at wt_users into wa_user.
  [create LOGINDATA, ADDRESS and other structures for user in BAPI below, based on the data in wa_user]
  call 'BAPI_USER_CREATE1'
  exporting
    username                      = [the user name from input file]
  NAME_IN                       =
    logondata                     = [structure for logondata]
    password                      = [initial password value]
  DEFAULTS                      =
    address                       = [address structure created above]
    [etc.]
  if sy-subrc eq 0.
Assign roles for the user
clear wt_activitygroups. refresh wt_activitygroups.
loop at wt_roles into wa_roles where username = wa_user-username.
    [build an internal table, wt_activitygroups, for system/role assignments for the user]
endloop.
    call BAPI_USER_LOCACTGROUPS_ASSIGN
      exporting
        username                      = [the users name]
      tables
        activitygroups           = wt_activitygroups
        return                       = wt_return.
Endloop.
Ideally, you would have two input files: one with the user data (one record per user), and another one containing the data for the BAPI_USER_LOCACTGROUPS_ASSIGN (on the format USERNAME, SYSTEM, ROLENAME); one entry per line. You'd loop at the first table, containing the user data, then create the user, then loop at all entries in the system/role assignment file for the same username, building an internal table of role assignemnts; then call the second BAPI (provided there were any role assignments to assign for that user!)
Hope this makes sense. It's not rocket science really; you can omit most of the parameters of BAPI_USER_CREATE1, and the second BAPI is even simpler. You could consider validating the input data by checking entries in table USRSYSACT, which contains all valid system/role assignments as seen from the CUA system (this table gets updated every time you do a "text compare" from within SU01.
Regards,
Trond