Action fo Request Type 21: Role Approval.

Hello All,
Can anyone please share what would be the Actions associated with the Request Type 21: Role Approval? I seached a lot in BRM dosuments but its not mentioned anywhere.
The tasks that I would like to do from this is the changesor creation for the roles should go through an approval process.
Thankyou.

Hello Sudesh,
Thank you for your reply. My question however is that for BRM request for triggering a mail when the role approval is requested(for which I assume I have to activate the request type "Role Approval"), which is the corresponding Action type. My intension is not to create a user when it does not exist or not, but to create a request when the role is changed or created. My emials are getting triggered for other request types, but not only for BRM.
Thank you!

Similar Messages

Role Approval request not visible in Role Approvers ToDo tab

Hi IDM Experts,
We have implemented IDM 7.2 SP8 in our project. We have performed the basic configuration for Identity center and IDM UI. The initial load from CRM is also completed successfully.
We followed the steps in guide https://scn.sap.com/docs/DOC-26322 to configure workflow such that in case role is requested to be assigned to user, the request goes to role approver(in his todo tab) for approval. The access will then be provisioned into backend CRM system on successfully
approval. However, we are facing an issue where the Role approver does not get anything in "TODO" tab for approval. The request shows in "Pending" status and logs show that tthe request is pending approval, however, it never appears in role approvers queue.
Kindly help on the issue. Please provide below information:
1) We can check in logs that the request is pending approval. Is there any way we can check where is the request routed to and whoose approval is pending here if it did not goto "Role Approver" for approval.
2) Any trouble shooting mechanism/tool available in IDM to debug issues like this.
Thanks in advance for your help.
Thanks and regards,
Nitin

Hi Nitin,
How do you assign the role to the user? if it's trought IDM UI, you loggin with which user?
There is a limitation on approval with SP08 : the requestor of the assignement can not be define as an approver.... but in this case the approval is automaticaly rejected by the system ...
in which logs / table can you see that your request is "pending for approval" ?
I also would recomand you to use the simple scenario "get approver from role/privs" of as krishna mentioned. (unless you need to do more custum actions)
Besides, you can check approval entries and status in DB views :MXWV_ApprovalQueue ...
Fadoua

Values Under CUP Request type Available Actions

Hi Experts,
Please let me know the concept of option avaiable actions under option Request Type.How CUP perform the mentioned action exactly under request type?From where i can configure these actions?are these default?
Thank you,
Mukesh

Hello Mukesh,
Actions are basically activities that you can perform using a request during provisioning. You have the following actions available in requests to use:
1.Create User u2013 create the user record during provisioning
2 Change User u2013 change the user record during provisioning
3 Delete User u2013 delete the user from the target system during provisioning
4 Lock User u2013 lock the user in the target system during provisioning
5 Unlock User u2013 unlock the user in the target system during provisioning
6 Assign Roles u2013 assign roles to the user during provisioning
7 Superuser Access u2013 give superuser access to the user during provisioning
8 User Defaults u2013 action to apply user defaults to the user during provisioning
You can configure them by going into CUP configuration -> Request configuration -> configuring request types. Here when you select a request for eg. "Change" you click on edit. When the request opens up on next screen, there are 2 panels available on the bottom of the screen. One lists the available actions and other one lists the assigned ones. Click on the Go button available on the available actions panel and you should be able to see the above mentioned actions. You select any one of them and move that one to assigned actions panel. Once you save, then in that request type you would be able to perform that particular selected action during provisioning.
Please refer to the configuration guide available on SAP Service Market Place for more information about this. You can find this documentation from the below location on SMP:
Logon to service.sap.com -> Software Download -> Release & Upgrade info
-> Installation & Upgrade Guides -> SAP BusinessObjects ->SAP BusinessObjects Governance, Risk, Compliance (GRC) -> Access Control -> SAP GRC Access Control 5.3.
Regards,
Varun

Role Approver Actions-Add, Keep, Remove

Currently, our role approvers were not able to modify the action of (ADD, KEEP, REMOVE). This fields was greyed out and it was passed in by IDM as ADD or REMOVE depending on what the user selected. We just implemented SP12 for CUP. We noticed that under Workflow>Stage>Change Request Content if this is set yo YES then the approver has the ability to do perform these functions below. 1 & 2 are ok. We reject roles at the role level on the request. However, we want to disable the ability for the role approver to modify ADD, REMOVE, KEEP on #3.
1. Approver can reject
2. Approver can modify the Valid State Date and Valid To Dates
3. Approver can modify the action and change it to KEEP or REMOVE. We wnat to disable this drop-down selection.
We noticed that if we Workflow>Stage>Change Request Content and change the value to No then the role approver can no longer reject the role.
Does anyone know how to disable this functionality so that role approvers cannot change the action on the request?

SAP confirmed that there is no way turn this feature off if the approver needs to reject at the role level so this will be a process change we need to implement most likley. However, it would appear that with the Add Role feature turned on there is a new button called Existing Roles/Groups that is displayed. Approver can now view the roles assigned in the SAP ABAP back-end without adding new roles which is very nice that it is display only. Thank you for your quick response to my question.
New question: Do you know if there is a web service that is used to call this new feature Existing Roles/Groups. We would like to utilize that for our IDM system to call a web service and display this on the request form.

In Request type, what is the difference between action 'Change user' and 'Assign object'

Dear All,
I have used only 'Assign Object' for my 'Change User' request type. But the standard request type has 'Change user'. So, could you suggest , what additional purpose does Change Object serve
Regards
Plaban

HI Plaban
not sure if you answered your own question here?
Change User - by itself would allow update of address data, user parameters, defaults, etc
Assign Object - as you mentioned roles and profiles.
However, if assigning, I think you need to have both actions: change and assign
I recall (ages ago) that change was only the user details and not the role or profiles. As a result, there were a few threads where people had to update the action for the request type of provisioning would not occur.
This is something you could test
Regards
Colleen

Access Enforcer(error in approving the request) and import roles

Dear all,
error in approving the request at security stage(last)
manager and role owner are successfully approved.
and also importing roles into access enforcer was not successful.
imortstatus : 0 roles imported of 28 records found.
please find the system log:
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.messaging.MessageFormatter : parseDesc :   : INTO the method : desc :Please specify a file to import.paramNames :paramsMap :{FIELD_NAME=#_!FIELD_NAME#_!}
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:02:28,234 [Thread-47] DEBUG

In Addition to my previous response:
I meant to include the following:
Some of the fields that need to be properly defined with attributes are:
       System: must have the know SAP system defined here
       Role Approver (i presently are using most of the roles without having need for approval; I created a user called NOAPPRV in AE)
       Functional Area: need to have all the areas defined that roles will be assigned to
       Company: I only have one company so that's an easy one
Some areas I presently do not use but found they must ne coded and coded properly:
       ResponsibilityID:   N/A (coded as is)
       CommentsMandatory: NO (coded as is)
       Parent Role Owner:   NO
       Business Process: NA (I believe I originally coded N/A and it did not like that)
       Sub Process: NA (again N/A I believe error on me)
       Reaffirm Period: presently I am using 0 (zero)
       LastReaffirm: presently using 12/31/9999
Hope this helps a bit
I wanted to include an attachment with a sample of my Role Import spreadsheet but I'm not sure exactly how to do that; if I figure that out or someone can provide me the process I will include it
Jerry Synoga
Ryerson Inc.
630-758-2021

Access Request "Model User" - Role Type "Role" disabled in "Select Model Access" screen.

Hi All,
I am implementing GRC AC 10.0 - ARM for provisioning in SAP R/3 and Enterprise Portal systems.
While using "Model User" access request, I find that UME portal groups are coming as disabled and are not available for selection in tab 'Select Model Access'.
Also only Type "Single Roles" appear for assignment or selection in the "Model User" form. Type "Role" appears disabled.
Request help, thanks.
Regards,
Piyush.

Thanks all for the suggestions but issue persists.
I ran repository object sync in full sync mode for the portal system.
I re-imported the portal groups.
Still as earlier while using "Model User" request, I can see the groups with the reference user but it is grayed out and not available for selection.
The other three scenarios (Access request, Copy Request & Template) work fine. In those request I can select the portal groups as well.

CUP: Request type change account- Change of user data other than roles

Hi Experts,
I am using the request type change account to change the user type and/or validity of the user. In the description of this request type it says I can use it to request additional access and other changes to an account. Yet when i try to change user validity.. CUP asks me to select one role when I try to submit the request..
Is there any thing else that I need to do so that the request type works for account changes as well?
Thanks!

Hi,
Go to End Configuration -> End user personlization, select the checkbox next to 'Roles' and click on change. Change the 'Manadatory' dropdown to 'No'. Now, save the changes and create the change request.
Alpesh

AE-How can we restrict a role approver to request or approve is own access?

Currently, in our AE a role approver can submit a request to add a role for which he is the approver and therefore he will be able to approve it as well.
We would like to not authorize someone to approve his own access request.
Is that possible and how ?

Patrick-
That enhancement is available in Access Control (CUP, formerly AE) 5.3. It is not available in 5.2.
Ankur

Creating a request based on a new request type

Hi all,
We are trying to create a request for updating the SPM FF ID authorization.
We created a new request type since the path for this WF is different from other paths that we configured.
We based the initiator for this new WF on a new request type called "SPM change FF ID" that holds the actions CHANGE_USER, ASSIGN_ROLES and SUPER_USER_ACCESS (we added the action SUPER_USER_ACCESS because the first stage in the WF is the "SPM Controller" based on the controller that the FF ID has in SPM).
When creating the request we populate the user ID field in the request with the existing FF ID that has a controller defined for it in SPM + we indicate the new roles to assign the FF ID via entering the "select role" functionality.
After pressing the submit button we receive the error "Error creating request. Approver not found".
What are we missing?
Thank you for your help

Shira,
Sorry, just re-read your post. Am I correct in thinking that you want to use the Controllers assigned within SPM to act as the approvers in CUP?
If so, what support pack version are you on as I believe that this only works in SP08 due to a technical bug. This also impacts the SPM Owners acting as approvers.
You may also wish to check the connectors and authorisations of the connector IDs as without being able to read the tables, the approvers may not be found.
Simon
Edited by: Simon P Persin on Nov 16, 2009 4:37 PM

Error in Workflow For Role Approval

Hello ,
While i am approving the request i am getting the following error:
Error processing your request, Request no: 2 in stage : ERM_STAGE
What could be the cause for this error?
Logs are pasted for your reference:
2009-08-19 14:31:40,244 [SAPEngine_Application_Thread[impl:3]_6] ERROR com.virsa.ae.service.ServiceException: Exit URI is not defined for wfType : RE
com.virsa.ae.service.ServiceException: Exit URI is not defined for wfType : RE
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.getDocument(RequestExitServiceHelper.java:188)
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.callExitService(RequestExitServiceHelper.java:157)
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.callExitServiceForApprovedRequest(RequestExitServiceHelper.java:56)
     at com.virsa.ae.accessrequests.bo.RequestBO.callExitService(RequestBO.java:5335)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:5174)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:4967)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.confirmRequestApproval(RequestViewAction.java:928)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.execute(RequestViewAction.java:103)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:271)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:425)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:455)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:455)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
2009-08-19 14:31:40,260 [SAPEngine_Application_Thread[impl:3]_6] ERROR com.virsa.ae.service.ServiceException: Exit URI is not defined for wfType : RE
com.virsa.ae.service.ServiceException: com.virsa.ae.service.ServiceException: Exit URI is not defined for wfType : RE
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.getDocument(RequestExitServiceHelper.java:209)
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.callExitService(RequestExitServiceHelper.java:157)
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.callExitServiceForApprovedRequest(RequestExitServiceHelper.java:56)
     at com.virsa.ae.accessrequests.bo.RequestBO.callExitService(RequestBO.java:5335)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:5174)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:4967)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.confirmRequestApproval(RequestViewAction.java:928)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.execute(RequestViewAction.java:103)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:271)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:425)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:455)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:455)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by: com.virsa.ae.service.ServiceException: Exit URI is not defined for wfType : RE
     at com.virsa.ae.accessrequests.bo.RequestExitServiceHelper.getDocument(RequestExitServiceHelper.java:188)
     ... 32 more
Regards,
Kumar Rayudu

Hello Gangadhar,
What you want to say is i have not specified the correct URL in Custom Approver Determinator but i have not used the Webservice option in CAD Type but specified the Attribute as Request Type.
In ERM i have specified the correct URL by copying the correct URL using the WSDL.
Can you please brief it?
Regards,
Kumar Rayudu
Edited by: Kumar Rayudu on Aug 19, 2009 3:10 PM

Provisioning log is not available on Access request type Change Account

Hi,
So I have and issue when I try to submit a request to add a role to a user and I'm trying to understand what could be the reason for it. Basically I have a workflow that works perfectly for a "Change Request". I can see that all the steps are executed and then at the end of the request when is suppose to do the actual role assignment I see the message "Provisioning log is not available" then the approval path is finish and the request is closed but when I take a look at the user in the back end the role is not assign. In terms of access I have try giving SAP_ALL to WF-Batch, nothing shows in Yellow or Red on SLG1 and in SPRO->AC-> User Provisioning -> Define request Type I see "Change Account" with SAP_GRAC_ACCESS_REQUEST. What else can I do to troubleshoot this error?
Note: I when back to the to the AC 10.0 Pre-Implementation From Post-Installation to First Access Request and everythings looks right in terms of the AC Configuration settings.

Hi Jonathan,
In my question I was referring to SPRO - GRC/access control/user provisioning / maintain provisioning settings. Those need to be setup (min. global provisioning settings) in order to have role being assigned to user at the end of path.
Change account option you can see under request type is referring to change user master data(e.g. password/ account validity / details).
Is this system maintain by CUA? If so settings have to be different (see CUA settings in SPRO)
I would recommend moving to SP14 as in SP13 there were many bugs, by the way I believe the worst SP ever since beginning of AC is SP13 (maybe due to number), as it destroys many working functionality.
Filip

SOD Detour in Role Approval Workflow possible?

Hello GRC Experts,
we have implemented an Access Request Approval Workflow with a Detour Rule (GRAC_MSMP_DETOUR_SODVIOL).
The second workflow we are working at is the Role Approval Workflow. Is it possible to use the SOD Detour Rule also in Role Approval Workflow? I didnt find the SOD Detour Rule in the MSMP Role Approval Workflow.
We would like to implement a following Scenario:
if the role contains an SOD the request should take Path 1 and if not Path 2.
Is it in MSMP Standard possible or should we use BRF+ for creating a Detour Rule?
Thanks,
Best Regards
Sabrina

Hi Sabrina,
For Access Request workflow, we generally use GRAC_MSMP_DETOUR_SODVIOL to implement routing rule(based on detour condition - risk found). Purpose of same (if I am not mistaken) is to through the request to another level of approver wherein mitigation monitor agent reviews the mitigation performed by role owner stage and approve/reject the request.
But, when we create a role same is not the condition as we do not mitigate role level risk thus no need to go for mitigation monitor stage. May be you have some business scenario, if you can let us know will be gr8.
For the rule ID, did you try adding the rule ID ?(you may already know, still would like to cross check with you).
GRAC_MSMP_DETOUR_SODVIOL under list of rules for "
Role Approval Workflow" In the screenshot you have shown, just click on ADD feed -
Rule ID -GRAC_MSMP_DETOUR_SODVIOL.
Rule description - same as Access request.
Rule type - Function module based
rule kind - routing rule.
Add this and check if it works and let us know the result too.
Regards,
Nishant

AE 5.2 - Detour Workflows - One of the Role Approver not found

Hi All,
My question is regarding using the Detour workflow functionality for the situation below - pls let me know if this possible or if any alternates are available.
- Main path has 2 stages (1) manager approver, (2) Role Approver.
If the Requestor asks for a Role that Does not have a Role Approver we would like to route this request to the Security lead.
- I have created a Detour Path with 1 stages - Secuity lead and associated with Stage 2 (Role approver) of the Main path based on the condition "No Role Owners"
- I still get the error "Approver not found at Stage @@@@"
Is the condition "No Role Owner" in the Detour workflow config for "Role Expert" workflows or for Access requests?
Is it possible to route the Request to Security if the Role being requested does not have a Role Approver? IF yes How?
thanks
T

Hi,
sometimes in the Detour configuration you have the problem that the "Save" action is not saved properly.
If this entry is empty, please go into edit mode and save the detour config again, so that the action will actually display "Save".
Hopefully it works, then.
Regards,
Daniela

Role Approver of Removal of Roles

HI Everyone,
We are coming across a situation where the management team would like to have the "removed roles" in the access request not require the role approver approval and review.
Is there a way that AE allows for this? I have tested various ways and can only come up with situations where the role approver has to approved removed roles.
Thoughts?
Thanks,
Jerri,

Hello Jerri,
For achieving the role deletion without the approver of the role owner, create a different initiator with Request type change and probably some custom attribute and have this initiator configured with a path which has no Role Owner at any of the stages.
This wil have the Request type "role deletion" with no Role Owner required to approve.
Regards,
Hersh.

Action fo Request Type 21: Role Approval.

Similar Messages

Maybe you are looking for