CUA and allocation of systems

When we assign roles in SU01( we are using cua to assign roles for other system) and sometimes forgets to state allocation system (in CUA) system calls to complete the assignment, ie to specify the system allocation. However, you can not select the system and the program forces one to start from scratch. This is time consuming and undesirable if it involves multiple roles / lines. Is the system built this way or we can set up somehow to solve this problem?

Using the F4 search help also helps as it transfers the system field with the role.
If you are copying from Excel, then copy the logical system from a column as well.
(make sure you run text comparison first if the role is new
Cheers,
Julius

Similar Messages

How to create automatically users&roles in CUA and in chlid systems?

Hi,
i have a CUA on a 2 chlid R/3 systems (test and training) and 2 portal systems (test and training).
i need to create a web application to create automatically users test and users training in CUA and see them in the R/3 chlid systems and at the same time to create autmatically a roles in CUA and R/3 chlid systems for those users (we sppose that the role is already stored in a table).
are there any standard BAPI or Funcion modules that can do this job?
is the role created automatically in CUA can be seen automaticall in the portal child system?
any help?
Thanks&Best regards

You can use one of the various ways Java EE provides you, e.g. container managed authentication.
It's also all in the Java EE tutorial: [http://java.sun.com/javaee/5/docs/tutorial/doc/bncas.html].
You can configure it in the application server as well: [http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html].
Here is an example how to use it in JSF: [http://ocpsoft.com/java/acegi-spring-security-jsf-login-page/].

Synchronisation of CUA and satelite system

we have implemented CUA and 3 satelite systems (PROD, TEST, QAS). By accident the complete user-access information has been deleted in QAS. Is there any possibility to push the information from CUA again into QAS to synchronize CUA and satelite system?

HI Dagmor,
Find CAU cookbook:http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/fe4f76cc-0601-0010-55a3-c4a1ab8397b1?quicklink=index&overridelayout=true
But it would be good if more elaborate your problem "user-access information has been deleted" like what you did in system. So that we can check and support you with better solution.
Hope this helps..

Integrate GRC 10.1 with CUA and how to import roles from CUA & Child systems into GRC for provisioning

Hello,
I am trying to integrate CUA into our GRC 10.1 system through the below steps and so far I have completed the below steps following SAP Notes 1680108 and 1616121:
1. Connected CUABOX to GRCBOX like a plug-in system.
2. Updated CUA Global System and CUA Model Distribution in Maintain CUA settings under User Provisioning.
3. Next I am trying to import the roles from CUA(CUABOX) into GRC(GRCBOX) to be able to provision roles in CUA Child Systems(ECCBOX).
After reading few discussions in SCN, I have figured that we have to download a template in Role Import and populate it accordingly to upload the CUA child system roles into GRC system for provisioning in CUA Child Systems.
Unfortunately, this template has multiple fields and I am unable to determine the fields that should be populated as CUA Global System and CUA Child System to import into GRC. Also, when we upload CUA Child System Roles template what selections should be made in Role Import window.
Any help in this regard is very helpful.
Thank you,
Pawan

Hi Alessandro,
I have "Create user if does not exist" setting checked for both change action and assign role action and also have CUA enabled. Here is the list of steps that I am performing:
1. Create an access request for new account, T-CUA_CHILD and select a role from a child system ECC Z_ECC_ROLE_IN_CHILD_SYSTEM.
2. Approvals provided to assign the ECC role.
3. I see the following in GRFNMW_DBGMONITOR_WD.
           Auto provisioning activity at end of request at Path GRAC_DEFAULT_PATH and Stage              GRAC_SECURITY
               New User:T-CUA_CHILD created in System(s): ECC (created without role assignments)
               T-CUA_CHILD User does not exist in target system CUA
GRC created an account without role assignment in ECC but also throwed me an error that the user does not exist in CUA.
However, if I select roles from both CUA and ECC it creates the account in both systems with the selected role assignments.
So I am wondering if there is way to provide CUA access to users by default for new account requests types. I have tried setting up default roles for CUA but it does not assign the roles by default until I select the CUA system.
Thank you for your help!
Pawan

How to create automatically users&roles in CUA and child systems

Hi,
i have a CUA on a 2 chlid R/3 systems (test and training) and 2 portal systems (test and training).
i need to create a web application to create automatically users test and users training in CUA and see them in the R/3 chlid systems and at the same time to create autmatically a roles in CUA and R/3 chlid systems for those users (we sppose that the role is already stored in a table).
are there any standard BAPI or Funcion modules that can do this job?
is the role created automatically in CUA can be seen automaticall in the portal child system?
any help?
Thanks&Best regards

Thank you all. I got the solution.
Regards
Rajesh

CUA with AS Java systems

Hi "Team"
Some of you may have read my previous post on SSO and CUA (I don't know how to post the link to that here, sorry).
Following up on that discussion, I'm no longer dealing with the SSO part of my problem. I, however, need to get a good idea of how to get an AS Java system to get user and role assignments from my CUA master. I've seen this done before.
The problem I'm facing is that I have documentation (that I've only partially read) that suggests how to go about getting the AS Java system to use an AS ABAP system as a user store, and I get the part that the AS JAVA system will read the user list from the ABAP system, and stay up to date. But I'm not clear on how the role assignments between the CUA box and the JAVA box are setup.
The way I've seen it is that dummy roles are created in the AS ABAP box that is used as the user store (e.g. ECQ or something else) and then there is some correlation between those roles and the AS JAVA roles.
Any suggestions on where I'd start getting this information together?
Thanks a lot!
Santosh Krishnan

Julius,
I agree with you. But my client has made promises to their big guys and so they've made agreements (way prior to bringing me onboard to get this all going) that I have no influence upon. I actually suggested exactly what you wrote, but I got so much heat on it, I now have a healthy burnt look.
So I'm going to have to implement CUA, and get the AS JAVA boxes to use that method to provision users and handle role assignments.
However I didn't get your point about many many clients. Am I missing something regarding the setup? So far (with the information I have), I was thinking I'd designate one ABAP system as the user store for the Java systems. Do elaborate.
Thanks a lot.
Santosh Krishnan

CUA and role assignment

Hi forum,
I have a CUA configured where I want the profile and the role assignment to be distributed global from the central system. I can create new roles with PFCG assign, users there, but I dont see these new roles in the user details in SU01.
What am I doing wrong?
Thank you!

Hi Chris,
Seems pretty simple to me. Since it is a new role you need to do a text comparision.
In the central system of CUA execute the report SUSR_ZBV_GET_RECEIVER_PROFILES in SE38 transaction.
In receiving systems give all the systems that are part of CUA including the central system (in this particular case only central system can be input since the new role is present in central system) Now execute it and then do the role assignment wither through SU01 or PFCG once again. Check once more.
After every new role creation this report needs to be executed. This is what is known as Text comparison of roles which can also be done in SU01. Check for the pushbutton for text comparision under tabsrtip Roles within SU01.
Regards.
Ruchit.

What is "WITHDRAWAL:" and "ALLOCATED" in Forecast tab in RRP3

Hello Gurus,
The quantity and date in withdrawal and allocated in forecast tab of RRP3 does not match with MB51 of ECC,
also pls clarify exactly how it is determined.
Regards.

Hi there! Withdrawal and allocated quantities distinguish between two concepts - forecast consumption and forecast reduction. The withdrawal quantity represents the amount of forecast which has been "reduced" and the allocated quantity represents the amount of forecast which has been "consumed". Consumption becomes reduction when a sales order / delivery is PGI'd. Or, when an SO is canceled, the consumption is simply reversed and no reduction occurs.
Forecast reduction prevents "over-planning" for a given time period, meaning that the system "remembers" how much was shipped out to the customer so that the forecast shows in the system as "fulfilled".
For example, consider a day which has a forecast of 10. There are open sales orders of 5, and another 3 were ordered and shipped today. Assume also that there is no forward/backward consumption. SO's consume forecast for the same day only. In this case, the allocated quantity would be 5 - for the currently open orders. The withdrawal quantity would be 3. And the remaining unconsumed forecast for the day would be 2.
Not sure why there may be inconsistencies with ECC, however. If you give more specifics on the nature of the discrepancy, I will try to respond with some additional input.

Integrate Password CUA and Active Directory (AD)

Hello Everybody,
We have integrated AD with our CUA system.
Is it possible integrated the same password CUA and AD?
How can I configure this?
Thank you,
Luciana

Luciana,
I am not sure if you are aware, but the Active Directory domain controller uses a protocol called Kerberos to authenticate a user when they logon to the domain. Therefore, to logon to SAP in the way you require it is best to use Kerberos so that the credentials for the user already available on the workstation, in the credentials cache can be used to securely authenticate the same user to the SAP system, e.g. CUA ABAP via SAP GUI. This means that no passwords need to be transmitted or stored anywhere, and the only authentication needed is that already done using Active Directory when the user logs onto their Workstation. Also, you can use this method to encrypt the communications - giving you added benefit, rather than just using the authentication provided.
This is achieved using an interface which SAP provided in SAP GUI and in SAP application servers called SNC (Secure Network Communications). For SNC to work, you need a GSS-API library installed on each workstation where SAP GUI is installed, and on the app servers you want to logon to using this secure authentication method. SAP provide SNC libraries, but they are only available if your SAP app server is on Windows. In your case where SAP is on HP/UX, you need to use an SNC library available from a SAP partner. This partner will provide you with all the software and support you need to make the solution work, and meet your needs.
I would like to recommend one such partner, but I am biased because I work for the vendor providing this product :-). The partner is called CyberSafe. You can make contact with me offline and I can arrange a free evaluation of the products, or you can visit the CyberSafe website at <a href="http://www.cybersafe.com/links/snc.htm">this site</a> to find out more. Or, you may decide to look for other partners who have solutions to help you, in which case you need to look on the SAP website for SAP SNC partners.
I hope this is useful ?
Thanks,
Tim

Used and allocated Shadow Copy Storage space is showing values in GB .

Hi All ,
This is an production issue and i need an urgent help on this case.
In my environment i am having exchange server 2013 in DAG extended with three sites.On that i am having two mailbox servers in the production site and one mailbox server in remaining two sites.
we have mounted all the mailbox databases in one production mailbox server.Those databases are present in LUN mapped to the production mailbox servers from SAN storage.
Issue :
Few of the mailbox databases are occupying too much of size on the LUN than it's original size.
Say for instance i have kept the mailbox database called "test" which is present on the LUN with the size of 190 GB.On that whole space the mailbox database is occupying only 100GB but on the diskmgmt and also on the explorer it is showing
only the free space as 17 GB.
Finally we have run the below mentioned command and found that the used and allocated shadow storage is occupying the size around 34 GB.
Attached snap for your reference :
Question : How to reclaim the space occupied by the shadow copy storage to the LUN ? If possible someone tell me why this issue is happening ?
Thanks & Regards S.Nithyanandham

Hi,
According to my research and technology, it’s caused by Volume Shadow Copy Service which is used to backup infrastructure for the Microsoft operation systems, as well as a mechanism for creating consistent point-in-time copies of data known as shadow copies.
We can use VssAdmin to create, delete, and list information about shadow copies. More details about Volume Shadow Copy Service, for your reference:
https://technet.microsoft.com/en-us/library/ee923636(v=ws.10).aspx
Besides, this issue may be related to Windows server. I recommend you to contact to Windows Server Team so that you can get more professional suggestions, please refer to:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=windowsserver
Thanks
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Allen Wang
TechNet Community Support

Delete the old CUA and build a new CUA on the Solution Manager

Hello together,
I'm about to delete the old CUA and build a new CUA on the Solution Manager.
The users are in multiple systems almost the same.
This raises the following questions:
If I export the printers from the old CUA in a file and import into the new CUA (Solution Manager, then the printer can be administered directly in Solman?
Furthermore, if I depended on the second or third child System and attached to the new CUA, the user description data are not overwritten, as bsp: with the description data of the last-connected system?
By delete the CUA child system in which users are blocked. Can you handle it?
I thank you in advance
Mirsad

> If I export the printers from the old CUA in a file and import into the new CUA (Solution Manager, then the printer can be administered directly in Solman?
-->the assignment of printers, not the printers themselves of course....
> Furthermore, if I depended on the second or third child System and attached to the new CUA, the user description data are not overwritten, as bsp: with the description data of the last-connected system?
If you mean adress data, already existing adresses are not overwritten. Such users will show up in scug as 'identical' or different' and can be handled accordingly.
> By delete the CUA child system in which users are blocked. Can you handle it?
Users without assignement to the central system get a global lock if the cua is removed in the central system. They still exist in usr02 in the central system, but with the global lock flag as indication, that they existed only for adminstrative means. The local lock flags in the child systems stay untouched. So if you take over these users into the new CUA they get the correct lock flag form the child system.
b.rgds, Bernhard

Difference between using new Date() and new Date(System.currentTimeMillis()

Hi All,
I have seen many open source api's where they are updating dates with the following code
new Date(System.currentTimeMillis())
when i print the new Date() it prints the same
what is the difference between using new Date() and new Date(System.currentTimeMillis()) ??
Thanks,
J.Kathir

when i print the new Date() it prints the same
It does because of backward compatability. This constructor exists in version 1.3.1 but not in newer versions.Really ? Please point me to where you read that.
API doc 1.5 : new Date() (still there, not even deprecated)
A quick look at the code for this constructor:    /**
     * Allocates a <code>Date</code> object and initializes it so that
     * it represents the time at which it was allocated, measured to the
     * nearest millisecond.
     * @see     java.lang.System#currentTimeMillis()
    public Date() {
        this(System.currentTimeMillis());
    }

Difference between Withdrawal Qty and Allocated

Hi!
Can anyone tell me the difference between Withdrawal Qty and Allocated in tcode RRP3 in tab Forecast?
In tab detail I have the Plan Qty (Forecast) and the Withdrawal Qty that most of days is the same quantity as Plan Qty and no value in Allocated. The category text is Forecast is this cases.
In other days, I have Withdrawal Qty different from Plan Qty and values in Allocated. I see that the allocated values are from orders or deliveries because the category text is SalesOrder or Deliv. and I see the ECC document number, but what means Withdrawal Qty in this and other case?
EX:
date                  material    location     category text Plan Qty Withdrawal Qty Allocated
12.03.2009     1270999     UN02     FC req.            726         726                       0
17.03.2009     1270333     UN02     FC req.          1.478         410                     60
17.03.2009     1270999     UN76        SalesOrder     0     0                             40
17.03.2009     1270999     UN769     SalesOrder     0     0                             20
Regards,
Teresa Lopes

Hi Teresa,
The forecast tab shows the consumption scenario.
It has Planned Qty. , Allocated Qty., Withdrawal and remaining.
Planned Qty. is the qty in forecast keyfigure
Allocated is the qty. allocated to the sales order by the system.
Withdrawal is the qty. totally deduced from the forecast once the order is PGIed.
Remaining is the qty. left in forecast
Example:
If the strategy is 10 ( sales orders do not consume forecast)
You have a forecast of 100 PCs
Planned qty: 100
Allocated Qty: 0
Withdrawal: 0
Remaining: 100
You create a sales order of 50 PCs
Planned qty: 100
Allocated Qty: 50
Withdrawal: 0
Remaining: 100
You create a delivery for this sales order of 50 PCs
Planned qty: 100
Allocated Qty: 50
Withdrawal: 0
Remaining: 100
You PGI the delivery for this sales order of 50 PCs
Planned qty: 100
Allocated Qty:0
Withdrawal: 50
Remaining: 50
The same above thing when the strategy is anything else except 10 like 20, 30 or 40 ( sales orders consume forecast)
You have a forecast of 100 PCs
Planned qty: 100
Allocated Qty: 0
Withdrawal: 0
Remaining: 100
You create a sales order of 50 PCs
Planned qty: 100
Allocated Qty: 50
Withdrawal: 0
Remaining: 50
You create a delivery for this sales order of 50 PCs
Planned qty: 100
Allocated Qty: 50
Withdrawal: 0
Remaining: 50
You PGI the delivery for this sales order of 50 PCs
Planned qty: 100
Allocated Qty:0
Withdrawal: 50
Remaining: 50
Hope this helps.

Difference between Assesment,Distribution and allocation

HI,
What is the difference between Assesment, Distribution and allocation.
Thanks in Advance,
Regards,
Chandu

Hi,
1) Allocations: Allocations enable you to periodically allocate amounts and quantities from sender objects to receiver objects. The two main types of allocations are assessment and distribution. You can allocate both plan and actual data. You perform the allocation using the allocation cycle function. You use allocation rules to determine how amounts and quantities should be allocated from sender object to receiver object.
To effect the allocation, you have to make various settings in Customizing. You make the settings in Customizing under Financial Accounting (New) -> General Ledger Accounting (New) -> Periodic Processing -> Allocation.
2) Assessment: A business activity used to allocate quantities and amounts (actual and plan values) from one sender object to one or more receiver objects.
The assessment process posts the sender amounts to an assessment account. The SAP system then allocates the amounts from the assessment account to the receiver(s) - not directly from the original sender account.
The assessment works in the same way as the distribution. However, with the assessment, the debit and credit postings do not occur under the original account or the original cost element but under an assessment account or an assessment cost element. The information of the original account/original cost element are lost.
3) Distribution: A business activity used to allocate quantities and amounts (actual and plan values) from one sender object to one or more receiver objects.
The distribution process distributes the balance(s) from the original sender(s) to the receivers. The original sender account is credited and the original receiver account is debited by the distribution. The debit and credit postings for the distribution occur under the original account/original cost element with which the amounts and quantities are posted at the sender. The information of the original account/original cost element remains intact.
I hope it will help.
If helpful, please assign points.
Regards,
Manju

Product Hiererchy and Allocation

Hi Guys,
What exactly is the use of Product Hiererchy and Allocation.
Why do we use these transactions OV1Z, OV2Z, OV3Z, OV4Z and V/76.
Pls explain me on this concept.
Points will be definitely given.
Thanks & Regards
Srikkanth

Check this [LINK|http://help.sap.com/saphelp_46c/helpdata/en/77/1a39516e36d1118b3f0060b03ca329/content.htm]
Define Product Hierarchies
In this step, you define product hierarchies which you can use for statistical analysis or pricing, for example, or you can change their structure. The product hierarchy groups materials by combining different characteristics. Each characteristic is represented by a specific product hierarchy level.
Example
A product hierarchy can be structured as follows:
Level Example Description
1 00001 Electrical appliances
2 00002 Household appliances
3 00000003 Wet appliances
In this example, a dishwasher belongs to product hierarchy 000010000200000003.
Standard settings
In the standard system, the product hierarchy consists of up to 3 levels. The first and second levels have 5 digits and the third level has 8. The maximum number of digits is 18 and the maximum number of levels is 9.
You can define hierarchy nodes at the individual levels of the product hierarchy.
From the initial screen you can branch to the following steps:
Product hierarchy structure
In the Data Dictionary, you can change the structure of the product hierarchy (e.g. the number of levels).
Data entry/display
Here you define the display of the product hierarchy and the format of the accompanying text.
Product hierarchy
Here you define your product hierarchies.
Field catalog for pricing
Here you make fields of the product hierarchy structure available for use in pricing.
Field catalog for the Logistics Information System
Here you make fields of the product hierarchy structure available for use in the Logistics Information System.
Actions concerning the product hierarchy structure
Structuring the product hierarchy
The product hierarchy can be structured via DDIC structure PRODHS. In the standard system, a product hierarchy can be created with up to three levels. The individual levels can contain the following number of digits:
Level number of allowed digits
1 5
2 5
3 8
This can be changed as of Release 3.0, where it is possible to extend the maximum number of levels to 9.
If you want to change the standard setting of PRODHS, e.g. you want to change the number of levels, proceed as follows:
1. Create an appropriate domain in the Data Dictionary (type CHAR with the required length).
2. Assign these domains to the standard data elements PRODH1, PRODH2, ..., PRODH9.
Please note that you should use these standard data elements.
3. Change the structure PRODHS by creating or deleting fields with reference to the data elements.
Choose ZZPRODHN as field name, where n is the position of the field in the structure PRODHS.
Example
You want to change the structure of the product hierarchy from 5/5/8 digits to 5/5/5/3. Proceed as follows:
Create the following domains:
ZPRODH3 with length 5, category CHAR,
ZPRODH4 with length 3, category CHAR,
Change structure PRODHS:
Strucutre PRODHS in the standard system:
Structure Fields Data element Category Length
PRODHS ->
PRODH1 PRODH1 CHAR 5
PRODH2 PRODH2 CHAR 5
PRODH3 PRODH3 CHAR 8
Changes according to example:
Structure Fields Data element Category Length
PRODHS ->
PRODH1 PRODH1 CHAR 5
PRODH2 PRODH2 CHAR 5
PRODH3 PRODH3 CHAR 5
ZZPRODH4 PRODH4 CHAR 3
Note
The structure PRODHS and the data elements PRODH1, ..., PRODH9 are only provided by SAP with Release 3.0 and can be changed by the customer from this point onwards.
Conversion routines for INPUT/OUTPUT
The product hierarchy can be assigned to a conversion routine. The name of the conversion routine is PRODH. The output template can be defined in Customizing (see below).
The separators used in the template are not allowed for maintaining the product hierarchy nodes.
Example:
If the template is _____/_____/__________
The symbol "/" cannot be used when maintaining the product hierarchy nodes. In this case, the following entry would not be allowed: 123456/79012345678
Text concatenation
The description of a product hierarchy can be determined via concatenation, if required.
Proceed as follows:
1. Determine the node preceding the current node
2. Concatenate the description of the subsequent node with the description from the preceding node.
The text concatenation is valid for the entire product hierarchy, the concatenated text has a length of 20. Text concatenation can be activated/deactivated in Customizing (see below).
Note
Make sure during text concatenation that the text of the product hierarchy does not come from table T179T. In this case function module RV_PRODUKTHIERARCHIE_TEXT_GET is available.
Allowed symbols for product hierarchy nodes
If you have stored a template for the conversion routine, the separators in the template are not allowed.
Actions concerning data entry/display
You can make two settings regarding the layout of the product hierarchy and the format of the product hierarchy text:
1. Enter a template for displaying the product hierarchy. This template defines the length of the individual levels and the separators.
Note that the character used to separate the levels in the template cannot be used in the product hierarchy nodes.
2. The description of a product hierarchy node can be determined by concatenation if required.
If you activate text concatenation, the text for one level is added to the description of the higher level and then output. The text of the first level appears at the beginning followed by the text of the second and third levels. Text concatenation applies to the complete product hierarchy. The concatenated text can have a maximum of 20 characters.
Do not activate text concatenation if you only want to issue the description of the hierarchy levels created for these levels when the product hierarchy was defined.
Actions concerning the product hierarchy
The product hierarchy can be freely defined and include up to three levels. The SAP System checks the entry in the field product hierarchy during master data maintenance and copies it to the SD document. The separators used in the template cannot be used in the product hierarchy.
Note
Via a matchcode you can search specifically for material master records with a product hierarchy.
Analyze the product hierarchies in your organization and define their representation in the SAP System.
1. Assign a characteristic value to the individual levels of your product hierarchy: a 5-character value to levels 1 and 2, and an 8-character value to level 3. The level number is determined automatically.
A product hierarchy node encompasses a characteristic value of a maximum of 18 characters.
2. Enter a description for the product hierarchy.
Actions concerning the field catalog for pricing
The product hierarchy can be used for functions in pricing. Then the fields of the product hierarchy structure must be entered into the field catalog for pricing.
Enter the fields of the product hierarchy in the field catalog.
Actions concerning the field catalog for Logistics Controlling
The product hierarchy can be used for statistical analyses in the Logistics Information System. The fields of the product hierarchy structure must then be entered in a field catalog for the Logistics Information System.
Enter the product hierarchy in a field catalog. You can refer to field catalog 'VPHI', which displays the standard settings.
IMG->Logistic General->MM->Setting for Key fields->Define Relevant to SD->Define Product Hierarchy->Maintain product hierarchy
Regards

CUA and allocation of systems

Similar Messages

Maybe you are looking for