AE 5.2 Auto Provisioning a role to a position problem

Hi All
We have a problem where one of our systems is position based and all roles are assigned to the position. The workflow works and AE approves the request and provisions but when we check to see if the user is getting the role provisioned we find that no roles were provisioned. We have set up the config as the config guide suggest.
Any suggestions will be helpful!

Hi,
Does your user id for your connector have sufficient access on the backend client?
Also can you tell me what settings you have in the table PRGN_CUST on your backend client?
Regards
Edited by: S Morar on Jul 14, 2008 1:40 PM

Similar Messages

Provisioning Allowed and Allow Auto-provisioning YES Role exists No

Hello,
I am unable to select the roles while submitting the user provisioning request.
The role additional details are set Yes for Provisioning Allowed and Allow Auto-provisioning
But Role exists is showing No; i have tried updating the roles in many ways, everything is getting updated except this paricular field.
Could you pls help me ...
Regards,
Sumanth

Hello Sumanth,
Can you successfully generate roles using the role generation option?
I have the same issue but I presently have issues with generating single roles ONLY as posted on this thread - "Illegal tcodes" error during the role generation phase of ERM in AC10
...so I am thinking it is becuase I can't generate single roles that is why the roles are not displaying. However, I can view the roles in other environments like risk analysis but not at the point of access request provisioning. It tells me no roles are available.
I sure hope someone will be able to help us out.
Thanks

CUP auto provision to position

Hello Experts
I hope you can help me on this issue. We have just implemented CUP (SP14) and have set up auto provisioning, indiirect to a position.
Despite this CUP is provisioning all requests directly to the User ID. There are no error messages to indicate that provisioning to the position has failed or even if it has been attempted. All back end funtionality is standard and working when tested manually. The CUP logs are not showing anything that I can decipher. It is as if the auto provision configuration indirect to the position is being ignored.
Any ideas what could cause this behaviour?
Thanks
Barry

Hi Jwalant
Thanks very much for the reply,
I am using SAPHR as the data source and for authentication. However we only want the user id to authenticate.
Auto provisioning is set to indirect with position for Global and by System and I have tried Provisioning at end of request and at end of each path. This should work without using the personnel number in the authentication shouldn't it?
The users Hr information is being pulled into the request without problem. It seems that CUP is making no effort to provision to the position, it just does it to the user every time.
Any ideas?
Thanks
Barry

CUP - Initiator for roles not requiring approval (i.e. auto provisioned)

We recently upgraded to GRC 5.3, SP10 and started noticing that using CUP, for roles that should be automatically provisioned (i.e. no approval required), it is taking between 3 minutes 45 seconds to 5 minutes for the request to be successfully submitted and automatically approved with provisioning. I was wondering if anyone is experiencing simlar system performance
Our set-up for auto provisioned role requests is as follows:
1. Created initiator INI_NO_APPROVE using role for attribute
2. Created stage STG_NO_STAGE with Approver Determinator = No Stage
3. Created path definition PATH_NO_APPROVE with number of stages =2 and initiator = INI_NO_APPROVE
Thanks!

F.Y.I.
As per SAP's recommendation - we applied note:1423983 in all target provisioningn systems and this resolved the issue.

SP12: Auto-provisioning failed for role with action "keep"

Hi,
If you want to keep an exisiting role for a user in CUP. It wasn't possible to change the validity of the role. Therefor you have to set parameter 145 value to 1 in database table VIRSA_AE_ERMCONFIG and refresh cache in CUP(solution with SP11).
But know we have problemes with the auto-provisioning.
We can enter the other validity of the role and after that the request provisioning failed. In our workflow the request rerouted to the admin because of escape-route settings. All other new roles in the request are assigned well to the user in the backend system.
Any ideas?
Many thanks,
Alexa

Hi,
we actually have the same Problem, that changes to the role validity with action "keep" are not provisioned to the SAP system.
If it is only possible to change the validity with the action "add" it is not possible to limit the validity of a previously unlimited role. Because as you said another role with the new validity dates is simply added to the existing roles.
The only workaround would be to delete the old role and add a new one with new validity dates. But in my opinion this workaround is not acceptable for the users.
Best Regards
Jonas

CUP Provisions user to SAP successfully but gives "Auto-Provisioning" error

Hi All,
I'm getting an "auto-provisioning" error in CUP when a "Change Account" workflow is approved. The strange thing is, CUP does successfully provision the change to the SAP backend. Yet, the "New Account" provisions successfully without the error.
Here is an example of the audit trail log from Change Account:
Request submitted for approval by Dylan Hack(HACKDY) on 06/28/2010 17:14
Approved By Dylan Hack(HACKDY) Path AE_AUTO_APPROV_ERROR and Stage AE_AUTOPROV_ERR on 06/28/2010 17:14
   Approved FI_xxxxx-DEV role for Add action with validity dates 06/28/2010-12/31/9999
   Approved FI_xxxxx-DEV role for Add action with validity dates 06/28/2010-12/31/9999
   Approved FI_xxxxx-DEV role for Add action with validity dates 06/28/2010-12/31/9999
   Approved FI_xxxxx-DEV role for Add action with validity dates 06/28/2010-12/31/9999
Auto provisioned for request on 06/28/2010 17:14
   User Provisioning failed for System(s) : DEV. Error Message :
   Role: FI_xxxxx assigned to user: testngin in System(s): DEV.
   Role: FI_xxxxx assigned to user: testngin in System(s): DEV.
   Role: FI_xxxxx assigned to user: testngin in System(s): DEV.
   Role: FI_xxxxx assigned to user: testngin in System(s): DEV.
Request submitted for reroute by system on 06/28/2010 17:14 due to auto provisioning failure
   Rerouted in the Path : AE_AUTO_APPROV_ERROR and Stage : AE_AUTOPROV_ERR to Path : AE_AUTO_APPROV_ERROR and Stage : AE_AUTOPROV_ERR
Note: the role names were replaced with "xxxxxxx."
The system log gives an error, but it is very vague:
2010-06-28 17:14:34,682 [SAPEngine_Application_Thread[impl:3]_33] ERROR com.virsa.ae.service.ServiceException
com.virsa.ae.service.ServiceException
     at com.virsa.ae.service.sap.SAPProvisionDAO.intializeWithChangeUserInputParameters(SAPProvisionDAO.java:762)
     at com.virsa.ae.service.sap.SAPProvisionDAO.changeUser(SAPProvisionDAO.java:3457)
     at com.virsa.ae.service.sap.SAPProvisionDAO.changeUser(SAPProvisionDAO.java:3419)
Any ideas or suggestions?
Current software level AC5.3 SP12.
-Dylan

Hello Varun,
Thanks for the thought on this. We don't use User Defaults for Change Account, but do for New Account. You question prompted me to do more testing with very interesting results.
Results
New Account with User Defaults configured:
User provisioned successfully, no Auto-Provision error, Defaults NOT provisioned.
New Account without User Defaults configured:
User provisioned successfully, no Auto-Provision error.
Change Account with User Defaults configured:
User provisioned successfully, no Auto-Provision error, Defaults NOT provisioned.
Change Account without User Defaults configured:
User provisioned successfully, Auto-Provision ERROR, Defaults NOT provisioned.
In both New and Change Account, the configured User Defaults are NOT provisioned even though the user is provisioned. AC5.3 is on SP12, the RTA is VIRSANH SP12 and VIRSAHR SP10.
For the Change Account, the user is always provisioned regardless of User Defaults; however, when no User Default is configured, the Auto-Provisioning error occurs. The User Defaults NOT provisioning is a real problem, the CUP error message, I can work around for now.
What about on your side? Am I the only guy using SP12 here?

Auto provisioning for AD is not working in oim11gr2

Hi All,
I have current environment as OIM 11.1.2.0.7 and AD connector MSFT_AD_Base_11.1.1.5.0 with patch applied 14190610 and Connector_Server_111200
I configured an auto provisioning to AD
I created an access policy based on a role MSAD Users.
i am expecting when i assign this role user should provisioned to AD automatically but it is not done. I also ran the Evaluate User policies scheduler which in enable state.
i provisioned user manualy and its working fine. also i checked access policy with another target application R12 application it is also working fine.
but i dont y it not working for AD . I filled all required fields in process form lyk organisation and AD Server.
I ran in to same issue in DEV at that time i applied BP07 to oim and 14190610 patch to AD connector, after that it was worked
Now my UAT is in same environment still it is not working
Please suggest me some solution
Regards
$sid

Hi All,
I have current environment as OIM 11.1.2.0.7 and AD connector MSFT_AD_Base_11.1.1.5.0 with patch applied 14190610 and Connector_Server_111200
I configured an auto provisioning to AD
I created an access policy based on a role MSAD Users.
i am expecting when i assign this role user should provisioned to AD automatically but it is not done. I also ran the Evaluate User policies scheduler which in enable state.
i provisioned user manualy and its working fine. also i checked access policy with another target application R12 application it is also working fine.
but i dont y it not working for AD . I filled all required fields in process form lyk organisation and AD Server.
I ran in to same issue in DEV at that time i applied BP07 to oim and 14190610 patch to AD connector, after that it was worked
Now my UAT is in same environment still it is not working
Please suggest me some solution
Regards
$sid

EBusiness Suite User "Auto-provisioning" and "Self-Request" Problem

I have two types of OIM User, Staff and Contingent
Staff (Role = Full-Time)
Contingent (Role = Contractor / Role = Consultant)
Resource Object: eBusiness Suite User
Here's my RO configuration:
Auto Pre-populate: true
Allow Multiple: true
Self Request Allowed: true
Allow All: true
Auto-Launch: true
EBS Connector, by default has two forms:
UD_EBS_UO: Object Form
UD_EBS_USER: Process Form
I have requirement which will auto-provision eBusiness Suite User resource to Staff users.
Originally, UD_EBS_OU is the table name used by the RO. For auto-provisioning to work, I have implemented it this way:
First, I have defined a User Group for Staff and assign an Access Policy to it (for users with Role == Full-Time).
Then, I have detached Object Form UD_EBS_UO from the RO. This way, when Staff user is created in OIM, it is automatically provisioned with eBusiness Suite User, though it won't have a Resource Form, only a Process Form. Process Form fields are automatically pre-populated with values (via my Pre-populate adapters).
Now my problem is during Self-Request. Contingent user doesn't get auto-provisioned with EBS RO, but he can self-request for it. Problem is, since I detached the Object Form from the RO, user is not seeing any form during request. And I have a requirement that approver of the request should also be able to view/modify the details of the request form. But that is not possible now that Object Form does not exist for this RO.
Is it possible that Self-Request and Auto-Provisioning works both ways under the same Resource Object? How do I configure that? Appreciate your quick response and help. :)
Edited by: user10202544 on Feb 10, 2010 3:27 AM

Yes I have set permissions to all users for the Object Form.
It is required for me to have both Self Request and Auto-provisioning work for eBusiness Suite RO.
During approval, however, the approver needs to see the Object Form (where he can view/modify its values before approving it). That's impossible for me since I detached the Object Form from the Resource Object. I need do to this for auto-provisioning to work.
It seems that it doesn't work both ways. Any other suggestions?

Auto-provisioning new users with GRC 10.1

There is some lack of clarity at my client on auto-provisioning new users into SAP systems with GRC 10. Here's what they want and I'm telling them they need SAP IdM.
The client will regularly have upwards of 500 new users on an on-going basis. These users are approved and created in Active Directory. The client believes that GRC 10 can now pick up these new users from Active Directory and then go ahead and provision them into ECC and CRM automatically, as soon as they're created, with no further approval required.
To the best of my knowledge, the easiest way to do this would be for IdM to do this, and have IdM trigger GRC for certain users, and to provision users who fall into this group of 500 users.
These users are different from regular users, who need to go through the approval workflows. Regular users will have managers and roles that need approval. These 500 or so users are approved to be created in the system and don't need to get caught up in the approval workflow.
Am I wrong in saying that IdM 7.2 is the best way to do this, or am I missing something about what GRC 10 can do?
Thanks for your help. I really appreciate it.

Hi Santosh,
In AC 10.1, I created one brf plus initiator rule.Although I saved it in GRAC_ACCESS_REQUEST package.Transport button is not available(Not greyed).
Dis you faced this issue..How to get this change in transport??
PS:Application are activated.
Thanks,
Mamoon

GRC 5.3 CUP auto provisioning of Mitigation Assignment in RAR

Hello,
Is there any other workflow that needs to be triggered for the auto provisioning of the Mitigation control id assignment to the userid in RAR system from CUP, upon request completion?
I created a request that after the final stage of sox approver, got auto provisioned roles assigned to the user id in the SAP system , but it also stated that auto provisioning failed and got re-routed to the detour path of the security admin as I configured in case of auto provisioning failure. When I look at the error log, it states:
User Provisioning failed for System(s) : XYZ. Error Message : User type TE is unknown
Role: ROLEA assigned to user: TESTER1 in System(s): XYZ.
1). So, even though the approved role is being assigned to the user in the backend system, some other stuff is failing at auto provisioning. And I thought it might be the mitigation control assignment to the userid in RAR. I have the mitigation fields/objects active. But how do I ensure the auto-assignment of mitigation control ids also gets assigned on the same request upon sox approval?
2). The other question is where is the value of the 'controller' stored when configuring a stage for workflow approver determinator in the sox approver stage? Where is this value picked up from? We don't want to use the RAR mitigation approvers or monitors, we want to use a custom approver id from CUP and then the control id to be assigned upon approval automatically to the userid in RAR via CUP request completion during auto provisioning. Is this possible? The only thing failing for us is trying to determine how to create the custom approver determinator for SOX approver in CUP since it asks for 'attribute' value for workflow type 'Compliant User Provisioning' which doesn't make sense for this.
And then the above error even though the user role assignment is auto provisioning already but still giving the error as I listed above and re-routing to detour path instead of completing the request. Is it due to auto provisioning failure of mitigation control assignment in RAR?
Thanks in advance,
Alley
Edited by: Alley1 on Sep 20, 2011 1:15 AM

Hi Karell,
Here is response to your questions:
I can use the following CAD in an AE workflow: web service to fetch role approvers. I question this as it is merely a RE workflow service : No. As far as I know the web service is only for RE/ERM.
Can the Risk Analysis be initiated in stage x automatically once stage (x-1) was completed. So no person involved, it is mandatory however, in my opinion there should be no extra person involved to actually press the button "Risk Analysis" : No. There is no way to automate the risk analysis part. Someone will have to click on the button to check for SoD violations. You can configure to run automatic risk analysis when the request is submitted but this is not 100% perfect. If someone adds or removes role during approval phase, it will invalidate the risk analysis which was run during request submission.
Can somehow the Risk Owners defined in the RAR componed be asked to approve/reject risk that came out of the Risk Analysis described in my previous point. They should only be contacted when there is a risk indicated. : This is possible by following Babak's workflow.
Regards,
Alpesh

GRC 5.3 - Auto Provisioning completed but Status remains Open

Hi All,
Lately GRC 5.3 does not change the status to closed once approval has been submitted. Auto Provisioning completed successfully as roles was assigned to back end ABAP system.
Please advice how to change the status to CLOSED once auto provisioning completes.
Thank you
Jacky.

Hi,
I'm not sure if this is the new issue with SP17. Everything is working fine before we upgrade to SP17. Is anyone can help to solve this issue?
Thank you.
Regards,
Merdelyn

CUP - How to handel requests with no auto provisioning

Dear Friends,
We are not using Auto-Provisioning in our CUP component.
We don't know how to handle a situation when although the request was approved at all stages, the provisioning it self (which is executed manually) does not happen (for example, the security manger forgot to do the changes).
How can we detect those differences ?
And if we did detect them, is there a possibility to add some comments to a request that was fully approved.
thanks
Yudit

Hi Yudit,
Not exactly. It is some manual work.
CUP>>Informer>>Provisioning
Run these two reports (select specific period):
Role Assigned / Removed
User Processed
Run t-code RSSCD100_PFCG_USER (You find this repot in SUIM).
Use the same period as above.
Export the report to Excel. If many entries, create a function to compare the results orilter the result by Action and compare to CUP reports.
Good luck,
Vit

Access Enforcer 5.2 - auto-provisioning error

Hi all,
i have come across strange quirk in AE 5.2 that is causing my client some issues. During UAT, a scenario was tested for a new user request with two roles with different role managers. The results i obtained were as follows:
1. Role manager 1 rejects 1st role then role manager 2 approves 2nd role (in that order). Expected result is that the user is created and the 2nd role is provisioned in the system. Actual result was that user was created and 2nd role was provisioned in system. PASS
2. Role manager 1 approves 1st role and then role manager 2 rejects 2nd role (in that order). Expected result is that the user is created and the 1st role is provisioned in the system. Actual result was that the request was closed and no auto provisioning was done. FAIL
For some reason, AE is only picking up the last approval/rejection when deciding whether to auto-provision or not. So when the last role manager rejects their role that was requested, AE closes the entire request and does not provision other roles in the request even though they were already approved. If the last role manager approves their role that was requested, AE will provision access according to the roles that were previously approved/rejected.
This does not occur for multiple roles that have the same role manager, as they are able to reject some roles and approve others without any problems with the provisioning. Config is set up so that the role manager stage approvals are at the role level, and approval type is "all approvers". We have also configured auto-provisioning type as "Auto provision at end of request" and provision effective immediately as "Yes".
Any ideas what is going on?
Thanks,
Alexi

Hi all,
i've tried to resolve this issue by changing the configuration, however this has not resolved it. I've attached the audit log of two requests for the same roles, only difference is the order of the role approvals. In request 226, the first role manager approved their role and the second role manager rejected their role and AE did not auto-provision the approved role (the whole request appears to be rejected).
Request 226 Submitted by Alexi Tsafos(k01232) on 07/30/2008 15:44
   YBC:ROLE_921-QAS Role Added
   YBC:ROLE_922-QAS Role Added
   ZU:COMMON-QAS Default Role Added By system
   Request submitted for approval by Alexi Tsafos(K01232) on 07/30/2008 15:44
Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage LINE_MANAGER on 07/30/2008 15:44
   ZU:COMMON-QAS Role Approved
   YBC:ROLE_921-QAS Role Approved
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level approval by Carmen Richardson(K01231) on 07/30/2008 15:45
Approved By Carmen Richardson(K01231) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:45
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level rejection by Alexi Tsafos(K01232) on 07/30/2008 15:45
Rejected By Alexi Tsafos(K01232) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:45
   YBC:ROLE_921-QAS Role Rejected
   Request Closed By Alexi Tsafos(K01232) on 07/30/2008 15:45
   Auto provisioned for request on 07/30/2008 15:45
In request 227, the first role manager rejected their role and the second role manager approved their role and AE auto-provisioned the approved role.
Request 227 Submitted by Alexi Tsafos(k01232) on 07/30/2008 15:50
   YBC:ROLE_921-QAS Role Added
   YBC:ROLE_922-QAS Role Added
   ZU:COMMON-QAS Default Role Added By system
   Request submitted for approval by Alexi Tsafos(K01232) on 07/30/2008 15:50
Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage LINE_MANAGER on 07/30/2008 15:50
   ZU:COMMON-QAS Role Approved
   YBC:ROLE_921-QAS Role Approved
   YBC:ROLE_922-QAS Role Approved
   Request submitted for role level rejection by Carmen Richardson(K01231) on 07/30/2008 15:50
Rejected By Carmen Richardson(K01231) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:50
   YBC:ROLE_922-QAS Role Rejected
   Request submitted for role level approval by Alexi Tsafos(K01232) on 07/30/2008 15:50
Approved By Alexi Tsafos(K01232) Path ERP_NEW and Stage ROLE_MANAGER on 07/30/2008 15:50
   YBC:ROLE_921-QAS Role Approved
Auto provisioned for request on 07/30/2008 15:50
   New User: AETEST20 created on 07/30/2008 15:50 in System(s): QAS.
   Role: ZU:COMMON assigned to user: AETEST20 in System(s): QAS.
   Role: YBC:ROLE_921 assigned to user: AETEST20 in System(s): QAS.
   Request Closed By Alexi Tsafos(K01232) on 07/30/2008 15:50
As described in an earlier post, the stage config is set for "role" level approval by "any approver". I've also tried "role" level approval by "All approvers" and have the same problem.
Any ideas?
Thanks,
Alexi

GRC Auto-Provisioning Behavior

Ellow Experts,
I am newbie in supporting GRC thus most of the errors encountered are crucial for me to resolve.
I have some inquiries with regards to GRCu2019s behavior.
1. If a GRC Request has been created to assign roles with validity date earlier than today, why does the GRC closes the request (with logs saying that auto-provision has been completed) but the roles were not assigned yet to the user id.
Ex. GRC CUP created March 22 to assign the following roles:
RoleXXX valid from March 26, 2010 to December 31, 2010.
RoleYYY valid from March 26, 2010 to December 31, 2010.
Upon checking useru2019s role, these roles were not assigned to his account.
2. We also have scenario where the role is requested to be added for next week but GRC auto-provisioned it today and closed the request.
Ex. GRC CUP created March 22 to assign the following roles:
RoleZZZ valid from March 26, 2010 to December 31, 2010.
RoleAAA valid from March 26, 2010 to December 31, 2010.
Upon checking user id, role has been assigned to him the same day the GRC request has been closed.
Please advice why this 2 new scenario has different result where as same type of request. Does workflow has something to do with it?
Version: GRC-SAC-SAE 5.3_09.1
Thanks.

Hi Santosh,
In AC 10.1, I created one brf plus initiator rule.Although I saved it in GRAC_ACCESS_REQUEST package.Transport button is not available(Not greyed).
Dis you faced this issue..How to get this change in transport??
PS:Application are activated.
Thanks,
Mamoon

Handling Auto-provisioning failure Manually?

Hi all,
WE are going with auto-provisioning for ECC and EP systems.
I am looking for some suggestions,incase auto-provisioning failed due to some reason.
I tweaked the connector settings in Portal that will throw some error. Then I configured the escape route for 'Auto Provisioning Failure'. The request goes thro' the escape route to the GRC Admin to fix the auto-provisioning issue. But this is delaying our access provisioning process. I am looking for ways to approve and close the request in case of errors.
Is there a way to let the user provision manually and document the reasons in the comments and close the request?
I should just approve and close the request without triggering auto-provision incase of errors.
Can this be done?
Thanks in advance..
Kee

Hi Siri,
There are two modes in CUP for provisioning manual and auto however it is not possible for approvers to switch between these two. This configuration is applicable only all the requests.
If you have auto provisioning off then in all the request approvers will get "Create User or Assign Role" buttons by which they have to do the manual provisioning.
The error in auto provisioning is not a usual thing which happen in production environment and when this happen this should be corrected immediately. If this take some time you can create system level auto provisioning setting where you can disable the auto provisioning for one system which is causing issue in your environment and provisioning in other system will be working automatically.
Thanks

AE 5.2 Auto Provisioning a role to a position problem

Similar Messages

Maybe you are looking for