CUP 5.3 - Role Reaffirmation for roles coming from ERM

Hi All,
our source system for roles in the CUP is the ERM.
can i do Role Reaffirmation for those roles ? because i saw that they don't come with validity dats
Thanks
Yudit

Hi,
My personal recommendation would be to either go with spreadsheet or backend system. Even when you bring roles from SAP system, it doesn't have any role reaffirm date as there is no such field in backend system. If you want to maintain roles properly then please configure them in spreadsheet so if you need to do mass changes it would be very easy to perform those updates.
Regards,
Alpesh

Similar Messages

ASA5500: TCP state bypass for traffic, coming from IPsec tunnel

Hello!
We have problems on central firewall with restricting traffic coming from remote office from IPsec. (The network sheme is attached)
All branch offices are connected to central asa though IPsec.
The main aim is to rule access from branch offices only on the central firewall, NOT on each IPsec tunnel
According to the sheme:
172.16.1.0/24 is on of the branch office LANs
10.1.1.0/24 and 10.2.2.0/24 are central office LAN
The crypto ACL looks like permit ip 172.16.1.0/24 10.0.0.0/8
The aim is to
restrict access from 172.16.1.0/24 to 10.1.1.0/24
When packets are generated from host 10.1.1.10 to 172.16.1.0/24 all is ok - they are dropped by acl2
When packets are generated from 172.16.1.0/24 to 10.1.1.10 they are not dropped by any ACL - the reason is stateful firewall - traffic bypasses all access lists on a back path
I thought that TCP State Bypass feature can solve this problem and disable stateful firewall inspection for traffic coming from 172.16.1.0/24 to 10.1.1.0/24, but it didn't help.
The central asa 5500 is configured according to cisco doc http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html
access-list tcp_bypass_acl extended permit tcp 172.16.1.0 255.255.255.0 10.1.1.0 255.255.255.0
class-map tcp_bypass_map
description "TCP traffic that bypasses stateful firewall"
match access-list tcp_bypass_acl
policy-map tcp_bypass_policy
class tcp_bypass_map
set connection advanced-options tcp-state-bypass
service-policy tcp_bypass_policy interface outside
service-policy tcp_bypass_policy interface inside
Does anyone know, how to make TCP State Bypass works properly?

I understand the pain of creating diffrent crypto for diffrent tunnels but i never come across better solution. However TCP state bypass is not going to help in regards to restrict access. TCP state bypass is a way to for FW to act like router which does not do statefull and I dont think that fits in your scenario.
You can still control access on center site by using vpn-filters.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml
Thanks
Ajay

COLLECT statement in start routine of update rules for data coming from R/3

Hi,
I have more than one record with the same key combination that comes from R/3. I have a condition wherein I write into an error log. Hence I want only ione entry to be written into a error log and not multiple instances.
I had written a similar one for ODS.
Loop at IT_ODS into WA_ODS.
Collect WA_ODS into IT_SUM.
How to collect data that is coming in from R/3. Any inputs?

Hi,
I think, by using ATEND you can acheive control break logic.
Regards,
-Vj

Need exit/badi to carry out new pricing(b) for SO coming from CRM...

Hello Experts,
We are transferring internet sales orders from CRM to R/3. Now, what I need to do is
to trigger the 'carry out new pricing' for all the line items. Just like when we click
the update button in the conditions tab and click on the 'carry new pricing' option even though
user only displays the sales order in R/3.
Hope you can help me guys. Thank you and take care!

No Answer...

Listening in main application for event coming from custom component

I have a custom component that im using for a login. i watch videos and tutorials on how to pass variables between custom components and application. the problem im having is that must tutorials or explanation have you put the event on the custom component and then it refers to some function within the main app.
Is there a way to just listen on the main app when that event kicks off? ive been trying for hours and i know there has to be something im missing it cant be that hard. any help i would really appreciate.
Thanks
Miguel

Sounds like you're asking about addEventListener():
     <fx:Script>
          <![CDATA[
               import mx.events.FlexEvent;
               protected function windowedapplication1_creationCompleteHandler(event:FlexEvent):void
                    comp.addEventListener("test", testHandler);
               private function testHandler(e:Event):void {
                    trace(e);
          ]]>
     </fx:Script>
     <local:TestComponent id="comp"/>
Add an event listener on your custom component (first string is the 'type' of the event).

Learning Curve for Rules - coming from HFM 9.3.3 to 11.1.2 Cal Mgr

We are currently are on 9.3.3 for HFM, Planning, and Essbase and contemplating an upgrade to 11.1.2.2. In the documents for 11.1.2.2, I read that we will have to migrate to calc manager for the rules. We are currently on the classic versions for each application rather than EPMA.
Whats the learning curve for moving to calc manager? Are people taking a class on it or picking up on their own?

Hi all,
I just completed an installation of 11.1.2.2 and I am testing various applications in order to assess the situation and propose to my clients.
Calculation manager is not the only way to maintain your rule file. As I have seen Oracle has discuntinued the Rule Editor but you can use any notepad to edit your rules (Notepad ++ for example) and load the rule file Workspace.
I am not really impressed from calculation manager yet. Definately in one of the following versions we will have to migrate all the rule files but I do not believe that we can do that in this version. For example in my files there is a huge issue of displaying the variables....
Regards,
Athanasios

Best desktop publisher for MBP coming from Microsoft publisher

Hey gang,
My wife has a small business. She now has two MPB. She runs one with Parallels and windows XP because she is in love with Microsoft publisher for making newsletters and similar. I am going to buy her a new MBP and want to go to Yosemite and get her off Windows. We have Pages, Numbers, Excel, Powerpoint, keynote etc. What software would you recommend that she can use and make the easy transition of Publisher to whatever? Can .pub files be opened in other applications? Any advice would be great.
Thanks,
Michael

Here's a link to an article describing some of the options for converting Publisher files:
http://desktoppub.about.com/cs/publisher/f/share_pubfiles.htm
If she is actually making do with Publisher, Pages might be sufficient, but there are plenty of options: Swift Publisher, Scribus, Printworks, eventually Affinity Publisher (not yet available for the Mac OS but in the works).
http://teratalks.com/2012/08/forget-adobe-inexpensive-desktop-publishing-is-aliv e-and-well-on-the-mac/
http://www.belightsoft.com/products/printworks/overview.php

What is security central - is it a virus (it pops up saying needed for firefox-coming from you)...google said it is a dangerous virus -- any protection?

Received 3 popups today - indicating that Firefox wanted to install Security Central 137 and Security Central 577 because my computer is unprotected (then a number of trojans and viruses were listed). I didn't buy it, so googled "security central" -- search revealed that security central is a virus.
Is security central OK or not...was that popup from Firefox or Mozilla? If not, is there a fix?

My Avira detect that installer as a virus, beware of it!!!
[http://www.ebookreviewdownload.com/ Book Lover]

Initiater for Role removal.

Hi,
I need some update/input w.r.t Role removal Initiator. While configuring the role removal is it possible to use the role status in the initiator? If not how to identify this role is only for the role removal.
Normally we use to put only one stage for Role removal. In the config, no where we are having automatic check for the request is only for the Role removal. So we have to trust that particular stage owners. As per the CUP automation check is it possible to validate this?
Thanks in advance.
Regards,
Vasantha Kumar.

Hi Justin
I'm assuming you are involved in or victim of a security access review. I'm usually one of those security guys asking for role or transaction removal and you are the main contact in the business coordinating the changes.
The process of remediation will possibly consist of checking which transactions are causing segregation of duties conflict, if they are used or not and removing one side of the conflict by removing an unused transaction.
It shouldn't require the entire contents of a role to be removed - rather swapping role A for role B without a transaction or two.
Removing transactions that aren't used can have more subtle implications which hopefully are found during UAT but is usually missed until used in anger. This what support is for after go live.
Saying all that and depending on your time and skills, you could ask for access to the security person's test user in dev or qas where they are working to run transaction SUIM on transaction for user following the proposed changes and compare that to the actual access of the real affected user in prod. If you can get access to the informer tab in virsa you can use the standard simulation reports to also check the resulting conflicts which will help you talk to the business and advise on actions available. There should be role owners involved in all this as they have to owner the result: expect a request for these for CUP later on
If you can retain control and approval of the (controlled) changes being made to users you will have a better understanding of what is happening, catch potential errors and mediate between security and the business - you have an important task!
Ask for some basic training in standard SAP reports - the security team should be more than grateful for your input
Crikey that was hard typing on an iPhone!
Cheers
Edited by: David Berry on Jan 11, 2011 8:17 PM

UAR Approvals for roles with multiple owners

Hi All, We have in many cases, two role owners for roles defined in CUP. When running the UAR, both owners are notified.
However, when one of the owners submits the approved/removals UAR request, the request closes out and the other owner does not have the opportunity to validate the request also.
Any suggestions how to be able to accomodate both owners?
The UAR CAD option is out of scope since it makes no sense to upload and maintain 4000 roles in the CAD.
Thanks! -Dylan

FYI, We were not able to find an acceptable workflow solution but decided to restrict access via authorization. We will allow the role primary Role Owner to make the UAR line item updates but not allow the Role Owner to submit the UAR.
The Secondary Role Owner will be allowed to Submit final version of the UAR.
Role makeup:
ZAE_UAR_ROLE_OWNER (UAR Role Owner Approver)
AE.ViewAccessEnforcer
AE.ViewRemoveAccess
AE.ViewApprove
AE.ViewSaveRequest
ZAE_UAR_QUARTERLY_OWNER (UAR Quarterly Owner Approver)
AE.ViewAccessEnforcer
AE.ViewSubmitRequest
Hopefully, more workflow flexibility is will be built-in to the UAR just like with normal CUP requests.
Best Regards, Dylan

CUP - Initiator for roles not requiring approval (i.e. auto provisioned)

We recently upgraded to GRC 5.3, SP10 and started noticing that using CUP, for roles that should be automatically provisioned (i.e. no approval required), it is taking between 3 minutes 45 seconds to 5 minutes for the request to be successfully submitted and automatically approved with provisioning. I was wondering if anyone is experiencing simlar system performance
Our set-up for auto provisioned role requests is as follows:
1. Created initiator INI_NO_APPROVE using role for attribute
2. Created stage STG_NO_STAGE with Approver Determinator = No Stage
3. Created path definition PATH_NO_APPROVE with number of stages =2 and initiator = INI_NO_APPROVE
Thanks!

F.Y.I.
As per SAP's recommendation - we applied note:1423983 in all target provisioningn systems and this resolved the issue.

CUP 5.3 SP11.1 - Role Reaffirm - Java Overflow error

Hi!
We are currently using the CUP Role Reaffirm. An user is trying to access the role reaffirm screen, he received an error message:
Java.lang.StackOverflowError:Null   Exception: (00145EC6363A0065000005F100174014000490DB915AF7A1).
The application log shows: 3]_20##0#0#Error#1#/Applications/AccessEnforcer#Plain### Ignoring Exception - U
ser : 10102021 not found to get full name #.
Does anyone know what this error message is?
Thank you.
Lynn

Hi Alpesh,
Yes, 10102021 is a valid user id.
Here is the CUP system log:
2010-09-22 12:51:04,289 [SAPEngine_Application_Thread[impl:3]_8] ERROR Requested navigation control not found
com.virsa.ae.commons.utils.framework.ControlNotFoundException: Action not found - loadRequestorLoginPage
     at com.virsa.ae.commons.utils.framework.ScreenDefn.getActionDefn(ScreenDefn.java:141)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:157)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
2010-09-22 13:05:57,833 [SAPEngine_Application_Thread[impl:3]_7] ERROR java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
     at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
     at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
2010-09-22 13:05:57,835 [SAPEngine_Application_Thread[impl:3]_7] ERROR Exception during EJB call, Ignoring and trying Webservice Call
com.virsa.ae.service.ServiceException: Exception in getting the results from the EJB service : com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:295)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
     at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
     at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
     at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
     at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
     ... 28 more
Thank you.
Lynn

CUP 5.3: Mass approver update for roles

Hello all,
Is there any way to do mass approvers update for roles in CUP? For instance mass change ApproverA to ApproverB for all roles. Or add ApproberC to all roles in process "Basis"?
Thanks, Anton.

That's actually quite easy to do:
- go to roles / serach
- do an empty search
- export
- open the excel file and do a search/replace on the approver
- save the excel file
- upload the excel file with overwrite option turned on
Done.
Frank.

GRC Access Control 5.3 - Role Reaffirm Notification Email

Hi Experts,
We have GRC 5.3 system and we want to change the content of Role Reaffirm notification email.
Is there any way to change the default email text?
We want to add few additional lines and CUP link in the email notification.
Thanks,
Rajendra

Hi Alpesh,
I found the entry in table VIRSA_AE_MESSAGE which is the same message as in the email notification.
I changed the value for field MSGDESC in our test system but the new text is not reflecting in email.
The email subject is coming as- Here are the roles that need to be reaffirmed
The body of the email is as below-
Here are the roles that need to be reaffirmed
Z_FI_MANAGER
Z_ALL_HR_DISPLAY_ALL
I updated the table at database level.
Is there anything else needs to be done?
Also we are using UAR as well as Role Reaffirm (don't know why), is there any oss note which says that UAR can be used instead of Role Reaffirm?
Thanks,
Rajendra

Description issue: Role Import in CUP from ERM

Hi All
While importing roles from ERM in CUP, the description column shows some numeric values in some strange sequence (like 0,1,10,100,1000,1001,1002,1003, and so on). In ERM, roles were uploaded from backend using Mass role Import and Role description are properly available there. For the roles created in ERM itself, correct description is available, when imported in CUP.
Not able to understand this....Please suggest
Thanks
Abhijeet

Hi Abhijeet,
I have found out the cause of this issue.
This issue is coming for those roles which doesn't have detailed description in ERM.
In ERM you can see role name, Role description and also role detailed description.
If the role's detailed description is null in ERM then after importing that role into CUP the description of that particular role will become four digit numeric character. So, We can't say it is a bug because the program is witten like this.
You can see this detailed description in role in the backend ECC system using pfcg.
I hope you understand the point what I wanted to say.
Thanks,
Sudip

CUP 5.3 - Role Reaffirmation for roles coming from ERM

Similar Messages

Maybe you are looking for