BPC in CUA environment

Dear colleagues,
Could you pls share your experience with BPC in CUA environment. I know that OSS note http://service.sap.com/sap/support/notes/1757825 provides the workaround. My questions are:
is handling high number of BPC teams with workaround feasible (more then 50 / up to 300)
transporting roles to QA and PROD: as far as I understand technical names of the BPC roles may change when they are transported. There is a document which describes this - but I am not sure if it is relevant in our case http://scn.sap.com/docs/DOC-29197
Thank you
Ivan

Hi Carlton,
I have implemented BPC on CUA environment with approx 300 users previous year. I was involved as a external consultant so I don't have insight into daily operations. There are couple of admin settings for the environment to work and here I cannot give you details as it was done by BC team. After this is ready then daily operations are the following:
So everything is same except user's maintenanance (assign DAP, TP, team). This cannot be done in BPC. Instead you have to find technical names of the roles created during DAP, TP, team creation and assign these roles to users in BW user administration. The technical names of the roles are in tables which you can see in the note 1757825.
Regars
Ivan

Similar Messages

Role Validity Query in CUA environment

Hi Guys,
Need your kind assistance here.
We have CUA in our environment.
Our requirement is that we need to change "Valid to" date for some roles (approx 10) for some users (approx 200)in a particular child system.Now the problem is that role and user combinations are not unique.
Please suggest a solution for the issue.
Peeyush
Edited by: PEEYUSH SHARMA on Nov 1, 2011 1:32 PM

Hi Peeyush,
I have gone through the same requirment but for largers numbers of users - 500 +
The best approach would be,
Pull out the details of assignment of roles to user from SUIM,
Users By Complex Selection Criteria -->Giv the users details --> execute -->when the users are displyed click on the Roles icon,here you can find out the roles assignment to the users.
Now copy them to an excel,FILTER on the roles column...
Select a role and you can find the users assigned to the role... Go to su10 ,give the user details for the first role, and delete the assignment of the role from the users.Now again give the same users list in su10 and add the deleted role with new VALID date.

Use of SQL Reporting Services in BPC (multi-server environment) - concept

Hello Experts,
I have the following scenario:
2 BPC application servers. Lets call them BPCA1 and BPCA2.
Load Balancer with virtual name BPCA
SQL 2005 database server BPCDB
Database server would hold BPC databases and Report Server database - requires 1 SQL Server license.
Each application server requires SQL Server Integration Services to be installed - 2 SQL Server Standard Edition licenses in my scenario.
Now, is Reporting Services a required component and needs to be installed on both application servers?
Because "scale-out" deployment for Reporting Services is only supported in SQL Server Enterprise Edition. Price difference between Standard and Enterprise Editions are quite sufficient.
So, can I install SQL Server Reporting Services only on BPCA1 and point BPC configuration to BPCA1 for all applications servers?
What is the use of SQL Server Reporting Services in BPC besides running Admin Reports?
Thanks in advance,
Akim

Hi RS is not required to be installed into db server or app server. It can be even an external RS server.
You are right if you will try to install RS in both app server you need Enterprise Edition because is required by Microsoft for RS web farm.
If you will install RS into database server then you don't need other license for SQL but if you will use SQL Server 2005 you have to install IIS into database server.
For many companies this broke some security policies and for this reason you have to install RS into appserver.
If you will use SQL Server 2008 then IIS is not required anymore and this is another plus in favor of SQL 2008.
Also SAP recomendations is to use SQl Server 2008 for SAP BPC 7.0 SP3 or later becaiuse the performances are better.
RS is used for:
Admin reportts. Audit Reports Journal Reports.
But without RS working you can have issue also with some Admin components not really just with reports.
Regards
Sorin Radulescu

CUA environment - changing the initial password of a user.

Hi Gurus,
I've encounter a perculiar issue when I assign an initial password to a user.
My system setup is based on CUA where my Central admin is client 100, with child client 200.
- I create an ID in client 100, set it to system 200, set initial password as "passW0rd". Save
- The ID was created in 200
- Logged in Client 100 using ID and "passW0rd", prompted for new password (i canceled the login)
- When back to client 100 CUA, in SU01 I select ID and click "EDIT", under the logon data I retype the initial password to "P4ssword"
- checked SCUL, it's green and user change
- Logged in Client 100 using ID and "P4ssword", error in password
- tried the old "passW0rd", prompted for new password.
I puzzled why the CUA did not redistribute the changed initial password to client 200, another can any ideas?
I also tried SU01 and click "reset password" button instead of "edit", the changed password was able to distributed to client 200.
By password change is ok this way or not ok if change within edit mode?
Thanks,
Jansen

Hi Sergo,
Yes I realise the "change password" works but for my case I cannot use that function. Any other suggestions. Cos by right even if I were to change in the logon data it should work right?
Hi Juan,
Yes I've checked, the IDOCs are in and successful.

User Master Data Changes in CUA Environment

Hello,
when a new user gets created.we have requirement for Indian system to set the decimal notation in user master data by default to 1,234,567.89 ,instead users doing it manually using SU3.We are using workflow tool for user creation.Globally our systems are connected to CUA system.User gets created in CUA system and then master data is distributed through IDOC to child systems.
Now by defalut it the decimal notation is set to 1.234.567,89.

Dear Sagar,
Try to see which tables are changing when you chage that field with help of ABAP and then incorporate the same logic in your workflow for India User. I think there will be a need to add one more field in your workflow and should be done.
But make sure you put some logic in your workflow if this India user then add this new field.
Regards
Shailesh Mamidwar

Contact Person for Vendor in SRM/CUA

Hello SRM Expert,
We are using Central user administration (CUA and like other system SRM is connected to CUA. I am getting the error 'Central system not accessible' while creating the employee (manage business partner) for business partner (Vendor). When we remove CUA then the error disappear.
Could you please let us know would be our approach for creating employee for vendors (for bidding, auction etc..).
Steps for Reconstruction
1. Login to SRM
2. Click on Manage business partner (BBPMAININT)
3. Look for Employee for Business Partner 'Create' option and create a employee for one of the vendors.
4. You will get the message Central 'System not accessible' .
I know one approach where I can create a SU01 in advance from CUA and then in manage business partner use this user but this is very long approach looking at the number of vendors we have. Is there a simpler way ?
Thanks,

Pradeep
Sorry yes it is not specifically about external users. You should review the note again, particularly scenario 2.
Essentially the note explains that, in a CUA environment, to create a user for an external contact person you need to create the following entry in table "BBP_CUST":
Key = "EBP_CUA_SCENARIO"; Value = "ACTIVE".
If you do not want to user table maintenance you can create the entry via the following IMG menu path:
Supplier Relationship Management > SRM Server > Technical Basic Settings >
Deactivate User Access to Solution Manager.
(Ignore the transaction title this transaction is essenatially maintenance of table "BBP_CUST").
Then you must ensure that the user specified on the RFC Definition for the CUA client has authorisations to create users IN THE CUA CLIENT, (it already has authorisations to create in the SRM client). This lack of authorisation is probably the reason for your error message.
Mike

To get the logical system names of all the child systems in a CUA envirnmnt

Hi Gurus ,
Is there any table where we can find the logical system names of all the child sytems in a CUA environment .
This is for a requirement that i need to develop an automated process where we can reset the password of all the child system in a CUA environemt when requested by the user at once .
I found some tables such as V_TBDLS , but they do not contain the exact information what i need .
Thanks in advance ,
Harshit Rungta

Hi,
You are in the right track. BD54 will show you the logical system name for all the existed systems in CUA.
Else you can also go to your CUA system and execute t-code SALE --> Basic Setting --->Logical Systems ---> Assign logical system to client -
> Display details
here you can see logical system names for all the clients assigned to CUA.
Thanks,
Deb

ABAP prog with Call Transaction to SU01 will not add roles in a CUA client

I am modifying a current ABAP program that works in a non-CUA client to hopefully execute in a CUA client. This program performs a Call Transaction to tcode SU01 and adds roles to an existing user. I used tcode SHDB to identify the new BDC commands needed for CUA when using tcode SU01. When executing the program in the CUA client it does not save the roles to the user. There is no error message or abnormal termination.
When I assign the role to the same user that's referenced in my program directly with tcode SU01 it works fine. Its just when I run the ABAP program the role assigment is not retained. I opened a Customer Message with SAP and they referenced OSS Note 93802 and said this was a consulting question. My program is not abending as referenced in Note 93802, it just does not add the role.
Has anyone been able to get this to work in a CUA client?

Hi,
it should be fairly simple to create a new ABAP using the BAPI's related to business object USER. Call BAPI_USER_CREATE1 to create the users, and BAPI_USER_LOCACTGROUPS_ASSIGN to assign roles in a CUA environment. It should go something like this:
[read file with user data into internal table wt_users]
[read file with role assignments into internal table wt_roles]
Loop at wt_users into wa_user.
[create LOGINDATA, ADDRESS and other structures for user in BAPI below, based on the data in wa_user]
call 'BAPI_USER_CREATE1'
exporting
    username                      = [the user name from input file]
NAME_IN                       =
    logondata                     = [structure for logondata]
    password                      = [initial password value]
DEFAULTS                      =
    address                       = [address structure created above]
    [etc.]
if sy-subrc eq 0.
Assign roles for the user
clear wt_activitygroups. refresh wt_activitygroups.
loop at wt_roles into wa_roles where username = wa_user-username.
    [build an internal table, wt_activitygroups, for system/role assignments for the user]
endloop.
    call BAPI_USER_LOCACTGROUPS_ASSIGN
      exporting
        username                      = [the users name]
      tables
        activitygroups           = wt_activitygroups
        return                       = wt_return.
Endloop.
Ideally, you would have two input files: one with the user data (one record per user), and another one containing the data for the BAPI_USER_LOCACTGROUPS_ASSIGN (on the format USERNAME, SYSTEM, ROLENAME); one entry per line. You'd loop at the first table, containing the user data, then create the user, then loop at all entries in the system/role assignment file for the same username, building an internal table of role assignemnts; then call the second BAPI (provided there were any role assignments to assign for that user!)
Hope this makes sense. It's not rocket science really; you can omit most of the parameters of BAPI_USER_CREATE1, and the second BAPI is even simpler. You could consider validating the input data by checking entries in table USRSYSACT, which contains all valid system/role assignments as seen from the CUA system (this table gets updated every time you do a "text compare" from within SU01.
Regards,
Trond

CUA has lot of problems !! Please help

Hello all,
We have 10 systems(multiple clients in few systems) configured in CUA. Sometimes the roles dont get replicated, sometimes the IDOCs are not passed from parent to child,
I added a new system to the Parent CUA and when I was assigning roles to a user for that child system thru CUA, the CUA surprisingly deleted all the other roles the user had in other system. The new system access was not touched
*Question 1: I have 3 jobs running PFCG_TIME_DEPENDENCY, RBDAPP01 and SUSR_ZBV_GET_RECEIVER_PROFILES in all the child systems. I know PFCG is a needed job for user comparison. Do I need the other jobs ?*
I have RBDAPP01 to process IDOCs and SUSR for the user comparison of roles.
Since there are a lot of issues in our current CUA environment( our CUA is on Solution Manager 4.0), I am thinking of deleting the current CUA and configuring it again. Its very difficult to do trouble shooting going in SCUL logs and pin point what really happened.
In RSDELCUA there are 3 options. Can I select " Delete CUA" and will it delete the CUA landscape or I would still need to go in WE20 and delete the partner profiles and do other steps?
What I am looking for is a way where I can configure CUA from scratch by deleting the current CUA
( It sits on Sol Man 4.0). I am thinking if I configure if properly, it will function smoothly
Any comments?

Hi,
"In RSDELCUA there are 3 options. Can I select " Delete CUA" and will it delete the CUA landscape or I would still need to go in WE20 and delete the partner profiles and do other steps?"
For deactivating the Child system you need to run RSDELCUA from se38. We can delete the Child system from SCUA but that is not recomended. It creates a problem related to the Partner Profiles and related Ports for which the Icons in respective Child may not be active. For this we need to run WE20.
The job PFCG* should be scheduled to run at a particular time. As for the other 2 jobs you mentioned I dont see any harm in running those but in most cases PFCG* is sufficient. (Ans to Ques 1).
Any reason that you want to recreate the CUA? It may be the case that SCUM is not configured properly for the new system that you have added. Instead of starting from scratch I beleive its best you check with the new system where the other roles are getting deleted.
Please let me know if any issue.
Regards
Aveek.

User roles un-assigned in CUA but acces in child system is ok

hi
i am have a really weird issue. a user who has access in roles in child clients, suddenly his roles disappeared from CUA. it did not effect access in child systems. any suggestions how to investigate this.
thanks

Did you click the Naughty Button in SCUL? Check OSS Note 1074552...
Could also be a cause of failing idocs.
Regards,
Trond
PS: The above note is for cases where users loose their visible role assignments in CUA, although roles remain assigned in the child system(s), not for cases where role assignments from CUA never trickles through to the child systems. The mentioned OSS note is a direct result of a case worked on by yours truly in 2007. I include below a warning I posted on sapfans about the issue:
Word of warning: RSUSR_CUA_CLEANUP_USZBVSYS is faulty!!!
The program RSUSR_CUA_CLEANUP_USZBVSYS is available as a standard SAP program from at least version 6.20. It can be run from SE38/SA38 or launched from a pushbutton (far right) on the "results" screen of transaction SCUL.
The program is intended to delete "obsolete" entries from table USZBVSYS, which contains log entries for assigned child systems in a CUA environment. The program is run in the main CUA system, and supposedly deletes entries for systems where users no longer have access.
There is a serious problem with the program, as acknowledged and confirmed by SAP in an OSS note I opened a few days ago. Under certain circumstances (more than 500 entries for any child system in the CUA landscape), the program wipes clean the whole table, instead of just the obsolete entries.
The consequences are dire. Table USZBVSYS is used for several fundamental CUA functions, such as remote password reset from the CUA master system. After the wipe, executing SU01 and attempting to reset a users password in a child system will no longer work. The assigned child systems are no longer visible in the reset password pop-up (nor anywhere else in SU01, including the Roles tab). You'll have to edit the user via SU01, and click on the annoying pop-up showing "new system assigned to user" for each system where the user has access...
The only way to fix the issue is to re-run SCUG for all systems in the CUA landscape. We had to do this across 6 CUA's, each containing 30+ child systems/clients and 10000+ users, which was very time-consuming and annoying. Also, there seems to be cases where roles have been wiped out from users on the CUA master systems, possibly due to consequences of the empty USZBVSYS table.
SAP has conceeded the program is faulty, and have proposed a new version (note 1074551). Without applying this correction, the program should NOT be run.
Note that users can still log in to and work in the child systems, it's just the "visibility" from the CUA master system which is missing. Tables USLA04/USL04 are still intact.
Just wanted to warn the community; we've spent some considerable time discussing with SAP and rectifying the mess created by RSUSR_CUA_CLEANUP_USZBVSYS...
Edited by: Trond Stroemme on Aug 5, 2008 3:03 PM

BBPMAININT and CUA

Hello Experts,
We are implementing SRM 5.0 and CUA in our company. I have come across this situation due to the CUA. Our scenario is CUA is seperate system by itself and all the SRM, BW and EP clients/systems are set as Child.
And we have activate the workflow 1000209 for external userid creation and also developed a Zworkflow for creating userids for employees of Business Partners(suppliers).
Due to setup of CUA and Child restrictions, SU01 is locked which is causing the issues in EBP client. Is there any solutions you can recommend to resolve this will be greatly appreciated. We have no issues in creation internal userids. USERS_GEN is working as usual.
Please point me to right direction to have the workflows work as intended along with CUA.
Thanks in advance.
Vijay

Hi
Please refer the following SAP OSS Notes for all the detailed info on creation of users in EBP in CUA environment for SRM 5.0 -> 
Note 876186 - EBP 5.0+: USERS_GEN locked when CUA is active
Note 1022859 - USERS_GEN: Not able to include SU01 user in Org. Structure
Note 931570 - BBPUSERMAINT: user creation in SRM with CUA environment
Note 1002725 SRM 5.0: BBPUM01 - user creation in SRM with CUA
Note 931555 SRM 4.0/5.0: User administration with active HR integration
Note 937180 SRM 5.0: Deactivating the BBP_USER_DELETE function module
Note 906353 SRM/EBP: Deleting user in CUA environment
Note 794913 Additional fields in Internet Service BBPUSERMAINT
Note 844055 BBPUSERMAINT: Unnecessary error message BBP_IUM 014
Note 808872 Available fields in BBPUSERMAINT dependent on admin auth
Note 402592 - EBP in the environment of a Central User Administration
In case of SRM there are 2 SAP OSS Notes which we have applied. They are 402592 and 772347 for customising. Kindly apply the second note also.
Refer to the following OSS Consulting note and all other related OSS notes (mentioned inside it).
Note 312090 - Integration HR - EBP/CRM
Other related links ->
Re: Not able to generate user users_gen
Re: Error with Importing Users via RFC
BBPMAININT with CUA
Re: HR Org model replication vs. Manual creation of Org. Structure
User creation error
Re: "Error Reading roles (Not maintained/no authorization?)
EBP and SUS in CUA.
Do let me know.
Regards
- Atul

Role creation in CUA

Hi All,
We have a CUA environement in our lab.
There is CUA admin sytem and one cua child system.
Admin system :HR6CLNT800
Child system :HR4CLNT800
I wanted to know how to create the role in CUA.
If i create locally on CUA admin system by going to Menu Tab ,specifying the
Target system "HR6CLNT800".
I get the following error
"Role TestRole has been edited in the system .HRCLNT800 distribution cancelled".
Please let me know if any one has come across this problem.
best Regards
Manoj

>
sap.sec.akshay wrote:
> Hi,
>
> I have a list of around 1000 existing users whose password need to be changed in different systems(selective).For example if user is having access to 20 systems his password need to be changes in just 2 systems. All the systems are connected to one Central system.
>
> I agree for user creation/role assignment in CUA landscape is possible through Ecatt. But password change in CUA landscape doesn't seems to work with ecatt as there are multiple systems to select.
I agree but not because of the "multiple systems to select" but the lack of a consistent pattern that you stated in your example.
-John N.

Data migration from OutlookSoft 4.2 version to BPC 7MS

A quick search on this topic did not yield any results. We're currently in the process of pilot testing our BPC 7MS installation. Our production system is OutlookSoft 4.2.
We would like to keep the BPC data in synch with our production 4.2 system. Has anyone done this before? What is the most optimal approach?
Is it as simple as dumping all the rows from the BPC FACT tables and repopulating the tables with the 4.2 FACT table rows? Or do I have to use the BPC/OutlookSoft data manager packages to export and import the data?

Hi Hitesh,
We have done migration activities. From the data perspective, it is not very difficult to manage. When you are doing the migration, you take the backup of the production, and then proceed with the migration activities. Keep testing your new BPC 7.0 environment. Once satisfied, and you want to finalize it, then you can take the final member list from the OS prod system and update in the BPC. So, no troubles, even if there are frequent changes in the metadata. You update that in BPC as a one time activity and then going forward, OS system will be scrapped.
As already indicated, BPC doesnt allow you to store data at parent nodes, which was feasible in OS. So, you need to be little cautious about that. The SQL script shared is incomplete, You need to use
Select * from tblfact<appname> where <dimensionID> not in (select <dimensionID> from mbr<dimensionname> where calc = 'N')
For example, Select * from tblfactEPS where TIMEID not in (select timeid from mbrTIME where calc = 'N')
The above statement needs to be used in all the fact, fac2, and factwb tables of all the applications, and all the dimensions. However, I would suggest that you first run the migration. During the step where you process the applications, you will get an error if you have any records in the parent node.
There is a very detailed document published by me on migration activities on SDN. You can search for it. It will give you all the details.
Hope this helps.

Windows 7 client - compatible with BPC 5.1?

We are running BPC 5.1, SP8. One of our users bought a new laptop which came with Windows 7 installed. We are having difficulty installing the BPC for Office client (getting a message that "you are not authorized to install BPC for Office" even when an administrator tries the install).
Can a Windows 7 client be used in a BPC 5.1 environment?
If so, how can we get the software installed on the client?
Barb

Hi Barb,
As you understand, there is no option currently. Nevertheless, I requested you for BPC 7.0, since it is under SAP support. The OS on a system can be changed without any hassles. The user can definitely go with Windows Vista and this will be very well supported by BPC 7.0. So, changing the OS in a system is not big a challenge. However, we should have the support from SAP for our versions of product, which is not available for 5.1 anymore. Thats the reason I requested you to go with 7.0. BPC 7.5 is scheduled to be released somewhere in June or July.
Hope this helps.

We have SAP CUA on Solution manager 4.0

Hi,
We have SAP CUA on solution manager 4.0,SAP BASIS component 700. Do you know what is the latest Support pack and version for solution manager and what is netweaver identity management.Which one is better for CUA environment
Thanks and Regards
Yakoob.

Hi,
Netweaver Identity Management (IdM) should replace SAP Central user administration (CUA) somewhere in the future. As far as I know SAP still supports CUA but doesn't develop further enhancements for it, because they see IDM as the new product. So when you still want to work with CUA then you can create a new one on your new SolMan and you have to move the administration to this one.
Regards, Basti

BPC in CUA environment

Similar Messages

Maybe you are looking for