CUP Custom Role Attributes

All -
My question is about creating custom role attributes in CUP. I read in the "SAPu2122 GRC Access Control 5.3 Document Version 3.10 u2013 December 2009" on page 245 that "You can also define your own attributes to support your needs by adding custom fields." I have two questions:
1) Can I defined custom role attributes outside of the delivered ones (Company, Functional Area, Application Area, Business Process, Business Sub-Process, and Functional Area & Company)?
2) If "yes", where do I do this in CUP?
I'm running AC 5.3 SP10.
Any help would be appreciated.
Thanks,
Daniel

Hi Daniel,
Yes , you can define your own attributes as many as you want
Configuration --> Custom Fields --> Field Label
All these Field Labels will be shown as separate tab (Tab Name : Custom Attribute) , so in this tab you will get all the attributes which you have creates manually .( You can check this in configuration guide CUP)
Hope this will help you
Thanks
Uma Shankar Tekumudi

Similar Messages

Remove / Hide CUP Custom Field

GRC Experts,
I am wondering. Ho
w can I modify, hide, or delete a custom field that has been a part of our request workflow in production. We get the error: "Updating custom field to non-workflow field failed because it has been used as a workflow field".
I havenu2019t tested but if I close all requests in the workflow and archive does anyone know if it will work?
Thanks,
Kyle

Hi Kyle,
I faced a similar issue when I tried to change the "company ID" under CUP-> Configuration ->Roles->Attributes->Company.
In this case, this field is not modifiable, so I decided to delete it and create a new one. But when I tried to delete the old company, I couldn't do it because this value was used in requests. Then, I canceled the open requests, archive and delete all the corresponding request and after that I was able to delete the company and to create a new one.
Please, note this (config guide):
"Archiving Requests is a way to view only the current periodu2019s requests during normal viewing.
All requests for access are stored in the Compliant User Provisioning database. The system closes the requests after they are approved or rejected. The Archiving Requests functionality
helps you archive the closed requests. The archived requests remain in the database but are not visible when the users run searches or reports."
After I performed the archiving I tried to delete the company name again, but I couldn't until I deleted the request. Note that you have the option to download the request before delete them.
Here you'll also find a thread regarding another problem deleting fields: Re: CUP - Cannot delete since referred in request data header
Perhaps if you contact SAP Support they can give you a better option. The option to download and save the request before deleting them was OK in my case but maybe it isn't a nice option for your situation. If you open a support message to SAP, please let us know if they suggest you another option...I'm looking forward to know it
Cheers,
Diego.

Difference Between Attribute Tab and Role Attribute Option

Hi Experts,
What is the relation between option custom fields and sub-option attribute under option roles in CUP> config.
I am asking this because, i have created a workflow based on functional area and now i am getting two functional area options in CAD(select attribute) and in initiator.I know, from where they are coming from....
1.Custom field>functional area.
2.Roles>Attributes>functional area.
Under both options different values are maintained for functional areas,for e.g.AP and AR in first and Bank and Asset in the other one.
The strange thing to me is that i am able to view only values maintained in Custom field>functional area while creating a test request no value is coming from Roles>Attributes>functional area.
However, while selecting role(option selct role), initially creating request, i can see the values maintained under functional area(coming from Roles>Attributes>functional area)
Regards,
Mukesh

Mukesh,
In simple words, there is no relationship between custom fields and role attributes.
Function area under role attribute is referred as "Functional Area of Role" in CUP. The other functional area refers to the "functional area of the user". In a company, both these functional areas can be similar or different as an user from "AP" can have roles from "AP" as well as "FI".
When you are creating CAD, do not select functional area of role and you would not see the attribute values from role FA.
I hope this helps you.
Regards,
Alpesh

Wlconfig with custom role mapper always fails FIRST time only

WLS 8.1 sp2.
I have a very strange problem, where I'm "coldstarting" a server and
configuring it, much like the ant build script for medrec. Only I have a
custom role mapper (medrec has a custom authentication provider). Anyway,
the first time I execute this task (after a clean), it consistently fails
like so:
[wlconfig] OK
[wlconfig] OK
BUILD FAILED
file:P:/dgs/build.xml:186: Unable to create mbean:
weblogic.management.MBeanCreationException: - with nested exception:
[java.lang.ClassNotFoundException:
weblogic.management.configuration.com.combinenet.security.CNRoleMapperProvid
erMBean]
(that class looks bogus to me, BTW, as my provider class is
com.combinenet.security.CNRoleMapperProvider)
Now, the SECOND time I execute "coldstart", which runs wlconfig, the server
starts up fine, and my custom role mapper is loaded successfully. So,
obviously I figured something was left around the first time which somehow
helped matters, but the strange thing is that I delete the entire domain
directory before "coldstarting" the server, and I also re-copy the role
mapper provider jar into the mbeantypes directory, so I'm very puzzled. I'm
copying the coldstart task below (and the clean).
Can anyone tell me what's wrong with this task that would make it fail the
first time through after a clean? Is this a bug? And why would it succeed on
all subsequent attempts (without a clean)? I just don't see anything wrong
with what I'm doing.
TIA,
Miles
<target name="coldstart"
description="Start a new DGS Server with an empty config"
depends="configServerEnv,startPointBase,configPointBase,dist" >
<delete dir="${dgs.root}" quiet="true"/>
<mkdir dir="${dgs.root}"/>
<wlserver
beahome="${bea.home}"
dir="${dgs.root}"
domainname="${dgs.domain}"
host="${dgs.host}"
port="${dgs.port}"
servername="${dgs.serverName}"
username="${wl.username}"
password="${wl.password}"
productionmodeenabled="false"
generateconfig="true"
action="start">
</wlserver>
<wlconfig url="t3://${dgs.host}:${dgs.port}"
username="${wl.username}"
password="${wl.password}">
<query domain="${dgs.domain}" type="Server"
name="${dgs.serverName}"
property="dgs.server"/>
<create type="JDBCConnectionPool"
name="DgsPool"
property="dgs.pool">
<set attribute="CapacityIncrement" value="1"/>
<set attribute="DriverName"
value="com.pointbase.jdbc.jdbcUniversalDriver"/>
<set attribute="InitialCapacity" value="1"/>
<set attribute="MaxCapacity" value="10"/>
<set attribute="Password" value="${pointbase.password}"/>
<set attribute="Properties" value="user=${pointbase.username}"/>
<set attribute="RefreshMinutes" value="0"/>
<set attribute="ShrinkPeriodMinutes" value="15"/>
<set attribute="ShrinkingEnabled" value="true"/>
<set attribute="TestConnectionsOnRelease" value="false"/>
<set attribute="TestConnectionsOnReserve" value="false"/>
<set attribute="URL" value="jdbc:pointbase:server://localhost/demo"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JDBCTxDataSource" name="DGS Tx DataSource">
<set attribute="JNDIName" value="DgsTxDataSource"/>
<set attribute="PoolName" value="DgsPool"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JMSConnectionFactory" name="Queue">
<set attribute="JNDIName" value="jms/QueueConnectionFactory"/>
<set attribute="XAServerEnabled" value="true"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="JMSJDBCStore" name="DgsJDBCStore"
property="dgs.jdbcstore">
<set attribute="ConnectionPool" value="${dgs.pool}"/>
<set attribute="PrefixName" value="Dgs"/>
</create>
<create type="JMSServer" name="DgsJMSServer">
<set attribute="Store" value="${dgs.jdbcstore}"/>
<set attribute="Targets" value="${dgs.server}"/>
<create type="JMSQueue" name="Registration Queue">
<set attribute="JNDIName" value="jms/REGISTRATION_MDB_QUEUE"/>
</create>
</create>
<create type="MailSession" name="Dgs Mail Session">
<set attribute="JNDIName" value="mail/DgsMailSession"/>
<set attribute="Properties"
value="mail.user=joe;mail.host=mail.mycompany.com"/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<create type="StartupClass" name="StartBrowser">
<set attribute="Arguments" value="port=${dgs.port}"/>
<set attribute="ClassName" value="com.combinenet.test.StartBrowser"/>
<set attribute="FailureIsFatal" value="false"/>
<set attribute="Notes" value="Automatically starts a browser on
server boot."/>
<set attribute="Targets" value="${dgs.server}"/>
</create>
<set mbean="Security:Name=myrealmDefaultAuthenticator"
attribute="ControlFlag" value="SUFFICIENT"/>
<set mbean="Security:Name=myrealmDefaultAuthenticator"
attribute="MinimumPasswordLength" value="10"/>
<set mbean="Security:Name=myrealm"
attribute="DeployPolicyIgnored" value="false"/>
<set mbean="Security:Name=myrealm" attribute="DeployRoleIgnored"
value="false"/>
<set mbean="Security:Name=myrealm"
attribute="FullyDelegateAuthorization" value="true"/>
<set mbean="Security:Name=myrealm"
attribute="AuthenticationProviders"
value="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaul
tIdentityAsserter"/>
<set mbean="Security:Name=myrealm" attribute="RoleMappers"
value="Security:Name=myrealmDefaultRoleMapper|Security:Name=myrealmCNRoleMap
perProvider"/>
<create type="com.combinenet.security.CNRoleMapperProvider"
domain="Security" name="myrealmCNRoleMapperProvider"/>
<set mbean="Security:Name=myrealmCNRoleMapperProvider"
attribute="Realm" value="Security:Name=myrealm"/>
<query domain="${dgs.domain}" type="Server" name="DgsServer">
<set attribute="StdoutEnabled" value="true"/>
<set attribute="StdoutSeverityLevel" value="64"/>
<set attribute="ListenAddress" value=""/>
<set attribute="ListenPort" value="${dgs.port}"/>
</query>
<query domain="${dgs.domain}" type="WebServer" name="DgsServer">
<set attribute="LogFileName" value="logs/access.log"/>
</query>
</wlconfig>
<copy file="${dist}/lib/dgs.ear" todir="${dgs.root}"/>
<wldeploy action="deploy"
source="${dgs.root}/dgs.ear"
name="dgsapp"
user="${wl.username}"
password="${wl.password}"
verbose="true"
adminurl="t3://localhost:7001"
debug="true"
targets="${dgs.serverName}"/>

<sleep hours="10"/>
</target>
<target name="clean"
description="Clean the build tree(s)"
depends="init">
<delete dir="${build}" verbose="true"/>
<delete dir="${dist}" verbose="true"/> (dist is where the ear file is
created)
</target>

g_wolfman wrote:
Are you using Parallels?
Wolfman, thats a good hint!
Additional info at --> http://reviews.cnet.com/8301-13727_7-20106682-263/macbook-airs-double-booting-wi th-parallels-and-filevault-enabled/
Thanks for the input.
Lupunus

FNDLOAD Question -- How to FNDLOAD a set of custom ROLES, not entire UMX?

Calling all FNDLOADers,
Question:
Are there any other options in FNDLOAD that will allow us to pull only those roles that are custom, either based off of UMX_ROLE name, UMX security CODE or any other attribute?
Background:
We have created ~40 custom roles in our 11.5.10.2 EBIZ environment, and would like to migrate these roles with FNDLOAD between environments. We are executing the following:
FNDLOAD <username/pwd@sid> 0 Y DOWNLOAD $FND_TOP/patch/115/import/afrole.lct umx_roles.ldt WF_ROLE ORIG_SYSTEM=UMX%
This will get us ALL UMX roles in the entire EBIZ system!
Now, granted, we can go into the umx_roles.ldt file and edit the file, but the possibility for human error comes in..."FAT FINGERS" syndrome!
Thanks and best regards,
Gabe D

Hello Gabe,
Did a lot with FNDLOAD, iSetup and ACMP in the previous month. I am assuming that you are using naming conventions for your roles, right?
In this case, the role code shall always start with XX, to specify that this role is a custom role.
Then, in FNDLOAD you use the parameter ROLE_NAME:
FNDLOAD <username/pwd@sid> 0 Y DOWNLOAD $FND_TOP/patch/115/import/afrole.lct umx_roles.ldt WF_ROLE ROLE_NAME=UMX|XX%
I just tested this and it works perfectly, exactly the 15 roles I created are extracted.
Any follow up question is welcome!
kr, Volker

Extended role attributes in IDM 8

I managed to add extended attributes to standard role types(Role, ITRole). But when I'm trying to add extended attribute to my role type Role1, it doesn't work.
Is it my problem or IDM 8 doesn't support extended attributes for custom role extensions?

From the release notes :
Identity Manager 8.0 consolidates the locations where an administrator specifies extended,
queryable, and summary attributes for user objects into the new
IDM Schema Configuration object. (ID-17784) In prior versions of Identity Manager, an administrator
edited the User Extended Attributes configuration object to add extended attributes for
user objects and the UserUIConfig configuration object to specify additional queryable or
summary attributes for user objects. An administrator now edits the IDM Schema Configuration
object for these purposes.

OIM 11g add custom role on user creation

Hi,
I when i create a user in OIM11g by default it gets added to "ALL USERS" role.
I have created a new role and want to add user to this custom role while creating users. How can i do this in OIM11g
Regards,
Ab
Edited by: 824473 on Jan 18, 2011 2:33 AM

set Auto submit true. you can't set the value for ValueChangedListener property in current release of R2. This is bug and you can raise SR for same. But, this won't cause saving data into USR table. ValueChandedListener property for Modify User page only.
As you said, data is not being saved in the USR table then verify your steps again:
create sandbox->users->create user/edit user/view user details page->click customize->leftTopcorner->View->Source->select area->edit->Click Add Content (on left top)->Data Component catalog->scroll down and select User VO->Refresh dialogue box->select the field and click 'Add'->on dropdown select 'ADF Input test w/label/for view user page it should be output test w/label->close that window->Check if it added to create user form->save and close customization
for user detail page select "Managed User->UserVo1 " as datacomponent
Re: UDF creation on User form in 11gR2
for valuechangedlistener the fixes all ready available. you have to do some workaround as other poster has given in above link:
1.Create a sandbox and activate it. Open the page that contains the UDF, and click Customize.
2.Select View, Source.
3.Note the value of the valueChangeListener property of a predefined field. To do so:
a.Click the predefined field, and then click Edit to open the Component Properties dialog box.
b.Copy the value of the valueChangeListener property.
4.Export the sandbox as a ZIP file.
5.Extract the ZIP file and edit the jsff.xml file for the specific screen.
6.Add the following attributes to the ADF tag, for example af:inputText, for the UDF:
◦valueChangeListener=VALUE_COPIED_IN_STEP3
◦autoSubmit="true"
7.Create the ZIP file for the sandbox.
8.Import the sandbox.
9.Publish the sandbox.
Edited by: Nishith Nayan on Sep 21, 2012 1:04 PM

Error while assigning portal custom role

Hi All,
We have a custom role which we use to assign to the users. till now we are able to assign it without any problem. But now as i need to assign it to someone, i got an error stating that "An error occured while adding user assignments; to see the correct status, perform a new assigned user search".
Can anybody help us in finding out the reason of the error and in rectifying the error.
Thanks & Regards,
Ravi

Hi Raghu,
Thanks for your reply..
This role is existing in the PCD, and this error is coming, while assinging this role any users... it is working fine with the existing users, who are having this role before. This is happening only when we are assigning this role to some new user.
I dont think this has some relation with the backend, as the role assignment is part of the Portal itself.
And also here we dont have seperate UME, and we are using r3 users only with single sign on.....
Hi Jithendar,
Thanks fo your reply.....I will do that backend roles check also for those users and see whether any backend role variations happened for these users.
Thanks & Regards,
Ravi

Error Importing a Transport in portal - Using custom role

Hello Everyone,
I have a custom role XYZ which has a few worksets copied (as delta links) from the standard System Administration Role. These worksets include Transport, Portal Display and Monitoring.
Now, I have assigned a user ABC the following roles:
1.Role XYZ
2.Content Admin Role
When the User ABC with the above mentioned roles, tries to import a transport package into the system he gets and authorization error. (This error does not occur if I assign the user Super Admin Role).
Error Details :
com.sapportals.portal.transport.RepositoryAccessControlException
Import data Access denied. (Object(s): pcd:..
Object ID:
Transport File: ..
Original Exception:
com.sapportals.portal.pcd.gl.PermissionControlException: Import data Access denied. (Object(s): pcd:..
at com.sapportals.portal.pcd.gl.transport.PcdGlTransportAdapter.checkPermission
at com.sapportals.portal.pcd.gl.transport.PcdGlTransportAdapter.startElement
at   com.sapportals.portal.pcd.gl.xml.ContentHandlerManager.startElement
<b>Questions:
1.     Is it really possible to have this functionality (ability to Import and Export without Assigning System admin or super admin roles) achieved?
(I went through a thread Portal role for transporting objects on SDN which discusses this scenario)
2.     How should I check for additional authorizations required for Importing / Exporting Transport packages into portal. (without having assigned the super admin role or system admin role).</b>Thanks To all of you
Joan Thomas

Thanks for the inputs.
I have fixed the problem.
To assign content objects to a package, you need at least read permission for the objects to be assigned.
You can only import objects into the Portal Content Directory if you have read/write permission for each folder in the Portal Catalog where the imported objects will be stored.
To create a transport package in a certain folder of the Portal Catalog, you need read/write permission for this folder.
These 3 points helped me do the required.
Raj

Problem in assigning custom role to a user

Hi everyone,
Can anyone tell me how to assign a custom role to a user?
I have created a set of IViews which are assigned to a workset and the workset is assigned to a new role.
I assign this new role to my user account.
But, I am not getting the role which I have assigned to my user account.
What am I missing???

Hi Daya,
Check the below links:
[Setting up Portal Roles|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/e0ba66fd-3c4e-2a10-1090-e1217a92c147?QuickLink=index&overridelayout=true]
Step by step guide to create roles and worksets. [Wiki blog|http://wiki.sdn.sap.com/wiki/display/EP/Makeiview,workset,pageandassignrole]
Check the [help.sap|http://help.sap.com/saphelp_nw70/helpdata/en/1e/89570091620b428807f5bce4b45e7f/frameset.htm] document to get idea about Portal Content Objects.
Regards,
Anand G

Rich Text Editor with Custom Text Attribute

Hello All,
We are using the latest version of Oracle Portal 10G. I have a need to create custom Attributes of the type text to let people enter a lot of text. But when User are in edit mode of an item where this custom attribute is used, the Rich Text Editor is not shown for entering the Text for the Custom Text Attribute. It shows a normal html text area. Has anyone ever used RTE with Custom Attribute?
I request you guys for help.
Thanks.

The Problem with the Custom Attribute is not solved, but I have now compromised with the Situation and now I am not using a Custom attribute.
Rather, Now I am creating a Custom Item Type using Base Text Type (earlier i wanted to create custom item type at my own without any base item type). In this case now I will not be able to change the Lable of the RTE (that is "Text", when the Custom Item is in Edit Mode), but I hope that my users can understand that much.
I have created a template for portal pages. In the Template I can edit the Region Properties. When I edit the Region property of the region where I want to display my Custom Items. I get two Tabs on the top, Main and Attributes/Style. ON the main tab I can tell what type of region it should be, width etc, in my case it is item type region. And on the Attributes/Style tab, I can select from the availabe Attributes as which all Attributes I want to display. Here if i select only "Associated Functions" Attribute then normally portal should not render anything by default on the Page. It should rather make a call to the procedure which is associated with the Custom Item and as when I was creating the custom item type, I had clicked on "Display Procedure Results With Item", so portal should now display the result of my Procedure. So far it works without problem.
But the problem is that the Portal displays the text at its own also. As i have written that Portal should not display anything at its own, this doesn't work in this version of Portal for a Custom Item Type that is made using Base Text Item Type. For all others it has worked till now (I have create 50s of Custom item types).
You can better understand by going to the following URL. Just have a look between the two dotted lines (Dotted line is also a seperate Custom Item Type). Between the two Dotted Lines is a custom item, in general it would be a Custom News Item having title, image and so on.
http://sunnode1.edvz.sbg.ac.at:7778/portal/page?_pageid=79,56047&_dad=portal&_schema=PORTAL
I have really programmed a lot with portal but now at this stage where I am near to end, I am getting problems which are coming from Product. I request you for help.

Custom Dynamic Attributes

Hello Experts:
Does anyone knows if it is possible to create a Custom Dynamic Attribute for Bid Comparison where this custom Attribute can be automatically filled through a function module or program with some calculated value?
My requirement is to provide an automatic supplier qualification which can be used as a comparison attribute, the qualification could be calculated using supplier information from previous POs, Confirmations, etc.
Hope you can help me out
Hugo

Hi,
Dynamic Attributes for Bid Invitation can be created using customization.
SPRO-> SRM Server->Bid Invidation - > Dynamic Attributes.
Generally the response to the dynamic attributes are given by Bidder when submitting the Bid.
For automaic population of response to the bidder do you want to do through report ?
you can implement "BBP_DOC_CHANGE" BADI metod "BBP_QUOT_CHANGE" for pupulating the response of dynamic attribute while submitting BId.
Regards
Kalandi
PS : Reward points if it helps you.

How to use 'roles' attribute in action-mapping ?

Hi,
Can anybody tell me what are the steps needed to use 'roles' attribute in <action> tag of struts-config.xml file?
I want to provide Action level security.
Also pls post an example if u r having.
Regards
Veeru

Hi,
The RfcAdapter trys to find a Sender Agreement for this RFC call but the lookup failes. The values used for this lookup are:
Sender Party/Sender Service: The values from Party and Service belonging to the sender channel.
Sender Interface: The name of the RFC function module.
Sender Namespace: The fix RFC namespace urn:sap-com:document:sap:rfc:functions
Receiver Party/Receiver Service: These fields are empty. This will match the wildcard
Regards,
Suryanarayana

How to use the custom role which is created by user

Hi,
Can any one suggest how to use custom role created by developer in webcenter portal.
Thanks in Advance
Regards,
Ankur Bhatia

Hi Daniel,
Thanks for ur Reply,
But i am not able to understand where to write the above code.
Also Suppose if a role "GeneralAdmin" is activated for a user then how it behaves like a "GeneralAdmin".
Means where is the code was written so that it behave like GeneralAdmin after activation.
Thanks & Regards,
Ankur Bhatia
Edited by: 986921 on Mar 5, 2013 3:49 AM
Edited by: 986921 on Mar 5, 2013 3:49 AM

Custom tag attribute calculated by scriptlet expression

Hi,
          If I set the rtexprvalue subelement of the attribute element in my tld to
          "true", should I be able to dynamically determine the value of my custom tag
          attribute using a scriptlet expression?
          When I include the custom tag reference:
          <prod:getCategory id="category"
          categoryID="<%=request.getParameter("catID")%>" scope="page"/>
          it actually gets written to the html as:
          <prod:getCategory id="category" categoryID="2133" scope="page"/>
          and is not recognized as a jsp tag.
          I am using weblogic 6.0 sp1.
          Thanks in advance!
          daniel


I had the same problem in a design a couple of months ago and could not get around it so I switched the functionality into code and out of the tag lib.
I take it you are trying to do something like this?
<%
String value="hiworld";
%>
<mytaglib:saysomething value="<%=value%>"/>

CUP Custom Role Attributes

Similar Messages

Maybe you are looking for