ERM - composite role is requiring profile name

I am configuring ERM (AC 5.3 SP8) and have imported all single and composite roles. I have naming standards set up for all Single roles, composite roles, derived roles, and profile names. However, when I try to create or change a composite role, it thinks a profile needs to be there (I blank it out on the create). Composite roles don't require profile names.
If I delete the naming standard for profile, it doesn't require a profile for composite. But then when I create a single role, it isn't there either. I really want to maintain a naming standard for profiles for single and derived roles. How can I do this without needing it for my composite roles?
Thanks!

It is a bug with SAP.
You can have naming standards for profiles as long as you have ENFORCED=disabled. So, basically, as long as you don't enforce your (profile) naming standards you can delete the profile name when you are creating a composite role. It sort of defeats the purpose of enforcing naming standards but at least it's a work around. SAP has this in development right now and it is being looked at.
Regards,
Peggy

Similar Messages

ERM / composite role gener. / Function parameter "Authority_check" unknown

Dear All GRC AC Women and Men,
I have a problem to generate a composite role with sap grc ac erm. My GRC version is a 5.3 sp5
For single roles, it s ok.
For composite roles, I to a first generation in GRC AC ERM . The error message is: "Function parameter "AUTHORITY_CHECK" is unknown."
The role is generated in the back-end and the status in GRC AC ERM is "in progress" (Yellow colour).
I do a second generation in GRC AC ERM, and the status is "done" (green colour); the role is generated one more time in the back-end.
The message error in ERM logs is:
"2010-03-18 15:48:48,393 [Thread-140] ERROR com.sap.mw.jco.JCO$Exception: (104) RFC_ERROR_SYSTEM_FAILURE: Function parameter "AUTHORITY_CHECK" is unknown.
java.lang.Throwable: Function parameter "AUTHORITY_CHECK" is unknown.
     at com.sap.mw.jco.MiddlewareJRfc.generateJCoException(MiddlewareJRfc.java:516)
     at com.sap.mw.jco.MiddlewareJRfc$Client.execute(MiddlewareJRfc.java:1514)
     at com.sap.mw.jco.JCO$Client.execute(JCO.java:3980)
     at com.sap.mw.jco.JCO$Client.execute(JCO.java:3417)
     at com.virsa.re.service.sap.dao.GenerateRoleDAO.generateRole(GenerateRoleDAO.java:564)
     at com.virsa.re.bo.impl.GenerateRoleBO.generateRoleAsBackGroundOnMultipleSystems(GenerateRoleBO.java:484)
     at com.virsa.re.backgroundjobs.RiskAnalysisAndRoleGeneration.execute(RiskAnalysisAndRoleGeneration.java:238)
     at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
     at java.util.TimerThread.mainLoop(Timer.java:432)
     at java.util.TimerThread.run(Timer.java:382)"
Do you know the origine of this problem? I am "quite" sure that it is not a back-end problem like authorisations missing for the user rfc (used in Jco).
Best Regards,
Ronan.

Hi Ronan,
This is an issue identified and resolved in SP07.
Please refere to Note # 1290039 if you don't want to upgrade to SP07.
Best Regards,
Sirish Gullapalli.

ERM Unhandled error; Unable to create role (Please provide a profile name.)

All -
 
I am running into 'yet another' issue in ERM! This error really has me going in circles because I am able to execute the exact same process in our Sandbox environment with NO PROBLEM... If any of you Guru's can help to point me in the right direction on how to address this issue it would be greatly appreciated.
 
Here's the issue:
 
In our SANDBOX enviroment, the role creation process works as designed (Role Methodology: Definition --> Authorization --> Derivation --> Risk Analysis --> etc.). I'm able to define the role, add t-codes in the Authorization step and even Maintain them in PFCG.
 
However in our DEV environment when I take the same steps and I add t-codes to the role, I get an error when I try to Maintain in PFCG --> Unhandled error; Unable to create role (Please provide a profile name.)
 
The crazy thing is that when I remove the t-codes (to zero) I'm able to Maintain in PFCG!!! I am then able to save the Role 'Shell' in the backend (not adding any t-codes), come back into ERM and add t-codes there and Maintain in PFCG somehow works with the t-codes added now. So it seems as if that connection to the back through PFCG with no t-codes establishes the profile somehow and allows me to finish the process as intended. This is a pain because I will have to take this work around step for every role that I create in Development.
 
In Sandbox however this works as intended and generates a profile at this step after adding the T-codes, thereby allowing me to Maintain in PFCG with no error.
 
The configuration of these 2 boxes is exactly the same and the connections are both working successfully, I'm going crazy trying to figure this out! PLEASE HELP!
 
Here are the Error Logs:
 
2010-04-13 18:07:29,427 [SAPEngine_Application_Thread[impl:3]_19] ERROR com.virsa.re.exception.RoleGenerationException: Unable to create role (Please provide a profile name.) 
java.lang.Throwable: Unable to create role (Please provide a profile name.) 
 at com.virsa.re.service.sap.dao.GenerateRoleDAO.createRoleFromAuthorizations(GenerateRoleDAO.java:1502) 
 at com.virsa.re.bo.impl.GenerateRoleBO.createRoleFromAuthorizations(GenerateRoleBO.java:597) 
 at com.virsa.re.role.actions.AuthAuthorizationDataAction.loadPFCG(AuthAuthorizationDataAction.java:420) 
 at com.virsa.re.role.actions.AuthAuthorizationDataAction.execute(AuthAuthorizationDataAction.java:198) 
 at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:273) 
 at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230) 
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) 
 at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117) 
 at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62) 
 at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43) 
 at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58) 
 at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384) 
 at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266) 
 at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386) 
 at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364) 
 at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039) 
 at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265) 
 at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95) 
 at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175) 
 at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process 
 
(ApplicationSessionMessageListener.java:33) 
 at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41) 
 at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37) 
 at java.security.AccessController.doPrivileged(Native Method) 
 at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104) 
 at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176) 

Thanks Sirish,
I have run the configuration validator for both Sandbox & Dev Environments and received the same results in both. I would like to export the results, but am getting the following error when I select the 'Export' button for both:
./temp/webdynpro/web/sap.com/grc~accvwdcomp/Components/com.sap.grc.ac.cv.wdapp.CheckComp (Is a directory)
Initially I thought that the error was result of the "ERMApplicationRTACheck" failing, however it is failing for both environments with this Reason:
Devleopment:
ECD Client 150
VIRSANH version does not match (9)
VIRSAHR version does not match (7)
OCD Client 100
VIRSANH version does not match (9)
VIRSAHR version does not match (7)
Sandbox:
ECC Sandbox
VIRSANH version does not match (9)
VIRSAHR version does not match (7)
SAM Sandbox ECC
VIRSANH version does not match (9)
VIRSAHR version does not match (7)
So I'm still at a loss as to why its working in one environment and not the other...?

Profile for a composite role

Hello Experts,
We are having a problem dealing with a composite role.
Whenever we add the composite role to a user master; a profile appears for each of the single roles (which is normal) BUT we also get a profile for the composite role.
We verified in the table AGR_1016 and found that there is a profile asocited to the composite role.
We tried the clean-up option of the transaction PFUD which did not work in our case.
We were thinking that may be the role was firstly created as a single role with its profile; and then it mayhave been changed to a composite role without deleteing its profile. Is it possible ?
Any answer is most welcome!
Thanks & Reagards

> We were thinking that may be the role was firstly created as a single role with its profile; and then it mayhave been changed to a composite role without deleteing its profile. Is it possible ?
Sounds to me as if there has been an import of a composite role overwriting a single role with the same name. The pfcg import facility has very few checks in them so something unwantend could have happened. I think it is not possible to change a role from single to composite with the PFCG or other tools. What does table AGR_PROF say about this role?
I would suggest to copy the composite to a new name (without copying the singles) and see how that looks. If it is OK you can delete the corrupted role, check wether it is completely gone and copy the new role back to it's original name.

Comparison Required for the large role with multiple profiles

Hello,
We are small SAP team of only several people. I have created a large functional role for our functional person. Everything was fine for a while, but now whenever I need to add/remove code from the role and push it over to production I get an unusable role (in red) and some type of "Comparison Required" message. I am not sure how to do this Comparison so I have to remove this role (and underlying profiles) from user than add it again to the user's profile. This fixes the issue of an unusable role, but raises auditing questions.
I tried to address the issue via transaction SUC but it seems I am not using it properly. Please, advise.
Thanks in advance
Galina

Yes you should schedule it at least once a day, in my systems it's running around midnight.
Use transaction PFUD or schedule a background job with one of this reports:
PFCG_TIME_DEPENDENCY (this is the old report)
RHAUTUPD_NEW (this is the new version of report) <- I'm using this in R/3 4.7 and Netweaver 7.0
Short text
User Master Data Reconciliation
Description
This report runs the user master comparison for roles you have selected. For single roles you can also start the user master comparison in transaction PFCG.
You can either execute it with the single processing types in dialog mode or schedule it as a complete reconciliation in the background.
To run only specific processing types in the background, schedule a variant of program RHAUTUPD_NEW.
You can choose the following processing types:
Profile Comparison
/>: Start the profile comparison directly after the profiles have been generated or imported. Provided you are using time-dependent role assignments, we recommend you schedule daily background jobs. The authorization profiles will then be reconciled with the user master data. Profiles no longer current will be deleted from the user master records and the current profiles will be entered.
Composite Role Comparison : Start the composite role comparison, if you want to make changes to a composite role definition (that is, add to or delete single roles from a composite role) or if you want to import a change. Single role assignments will then be reconciled with the composite role assignments for the user. If you want to include single roles in the composite role, the single roles are assigned to those users who are assigned to the composite role. Conversely, the single roles assigned to users are deleted, if the single role is removed from the composite role.
HR Comparison : Start the HR comparison, if you want to make changes to the HR Org Model, which affect the indirect role assignment. You can only select this processing type, if HR Org is active. The switch HR_ORG_ACTIVE in table PRGN_CUST must be set to YES.
Cleanups: Carry out a cleanup, if you want to generate or import profiles. Generated profiles that do not have any roles are deleted.
Further options:
Issuing error messages: In dialog mode all error mesasges are displayed on the screen.
Replicating local HR assignments centrally (You can only select this option, if this client is an active child system of a CUA group and HR org. Role assignments in the child system that have arisen from links in the local HR Org model are replicated for information in the central system
Thanks,
Adrian

Role Name and Profile Name

What are advantage and disadvantage of having same role name and profile name .

Alex Ayers wrote:>
> Advantages
>
> consistent naming when reporting (though this is not really a problem in ECCn systems)
I allways point out the disadvantage of that one which is (in my oppinion) that one typo may ruin the system.
Imagine selecting a large set of profiles from the database, based on a list of rolenames. If one of the profilenames is mistyped said profile is not in your selection and that may remain unnoticed in large batches but does influence the outcome of security investigations.....
I'd rather trust the one-to-one database link between roles and profiles (AGR_PROF) rather than a 'fake' link created by a human.
Also limiting yourself from 30 to 12 characters in the role name, as pointed out, is quite a price to pay for creating this visible relation where the technical one already exists. You can call this one of my pet peeves and I'm very unlikely to leave the standpoint that meddling with profile names (as far as PFCG profiles are concerned, not the structural stuff) is a waste of time to say the least.
Edited by: Jurjen Heeck on Feb 20, 2008 1:33 PM

ESS Composite Role Adjustment

Hi Experts,
I have been trying to modify the Composite role SAP_EMPLOYEE_ERP for some functionality on portal. In tx OOAC, P_PERNR switch is activated (changed to 1) before this. First of all, I do not know whether the switch should be activated for ESS. But activation worked for me, and was able to get rid of one error. I followed this document for activating <a href="http://help.sap.com/saphelp_erp2005/helpdata/en/94/b8b83b5b831f3be10000000a114084/frameset.htm">P-PERNR</a>.
I followed the guide lines in the help link, and made some changes in the
HR Master Data Personal number Check in the role Z_SAP_ESSUSER_ERP. I added the following profile:
Authorization Level: W (write access)
INFOTYPE: 167 (Health plans)
Interpretation of Assigned Authorization: E (excludes the right access)
Subtype: BMER
I feel that should do trick: the user should not edit the Health Plan BMER on portal. Is it the right approach? It should overwrite the standard profile
Authorization Level: *
INFOTYPE: 0002, 0005, .............., 0167, 0168, 0169, ......
Interpretation of Assigned Authorization: I
Subtype: *
Any suggestions will be greatly appreciated.
Thanks!

Christopher,
Ok.
I managed to achieve the requirement. I am keeping the thread here as I do not know how to move threads.
This is what I did.
1. Authorization Level: W (write access)
INFOTYPE: 167 (Health plans)
Interpretation of Assigned Authorization: E (excludes the right access)
Subtype: BMER
2. Authorization Level: *
INFOTYPE: 0002, 0005, .............., 0167, 0168, 0169, ......
Interpretation of Assigned Authorization: I
Subtype: *
Profile 2 is overwriting the profile 1. What i did was in profile 2
I removed the 0167 under INFOTYPE. made the profile 1 as follows.
Final 
1. Authorization Level:R (read access)
INFOTYPE: 167 (Health plans)
Interpretation of Assigned Authorization: I (incldue )
Subtype: BMER

I did the trick. The user is able to view the benefit plan not edit. the system throws a message "you are not authorized to do this" if he tries to edit. However it is one way of restricting the user. might be not elegant. but quick.

PFCG composite role copy issue

'morning!
A colleague of mine is facing a strange problem at her customer site:
On copying composite roles with PFCG you should receive a dialog box with the question "Should the Single Roles Be Copied and Reentered?". This gives you the opportunity to just enter the original singles or to copy them and enter the copies.
Unfortunately this pop-up is missing on their ECC 6.0 system and the singles are always copied as well. This is not the required way.
Is there any system setting/parameter that steers this popup? We would really like it back....

Hmm... I am not logged on so I confess that this is guessing.
Next option is that the message is displayed using a popup function which is obsolete in ECC 6.0 but still using in the coding - which now simply defaults what the function module would have returned.
Activate the ABAP debugger immediately ahead of where the popup should have appeared and look at the call stack to see what the name of the function is?
Particularly keep an eye out
a) CALL FUNCTION 'POPUP_TO_CONFIRM_WITH_MESSAGE'
b) CALL FUNCTION 'POPUP_TO_CONFIRM_STEP'
c) CALL FUNCTION 'POPUP_TO_DECIDE'
d) CALL FUNCTION 'POPUP_TO_CONFIRM'

Not able to assign Composite Role to Position

Hello All,
I am facing following problems.
1) The user is Not able to see Create Report Links, when i checked the Composite Role in PFCG i found that the in USER Tab Organizational Tab was yellow, i did Indirect Reconcillatin in Organizational Tab and then it went GREEN, then i did User Comparision.
I got this Message
"You do not need to perform Prfile Comparision for role " Role Name".
and the Position was removed.
2) Now i am Trying to assing the Role to Position, i am not even able to assign it and the User id is not coming under User id list.
Please suggest.
Thanks,
CB

@Point#1: It could be that user master is already compared for your composite role and no further comparison is required. To double check you might just run the comparison again via tcode PFUD or report RHAUTUPD_NEW
@Point#2: For indirect assigment to position make sure organization management is active in your system (the switch HR_ORG_ACTIVE is set in the table PRGN_CUST to YES).
Thanks
Sandipan

Add a single role to different composite roles in one step

Hello everybody,
I am working on SAP authorizations, and we often have the situation that a new Tcode is developed and a new role for this Tcode needs to be created.
Than this new role needs to be added to many different composite roles (sometimes more than 100). At the moment I enter the single role to the composite role and regenerate the menu and this one by one. After that I add them with PFCG_MASS_TRANSPORT to my transport request.
I don't want to believe that there is no easier way. Any ideas?
Thank you
Flo

Hi Soma,
great to find a place to be welcome..Thanks
What you wrote definitely makes sense, but we agreed that every user only gets one composite role assigned and this composite role contains all single roles needed for his job. We do not assign single roles to users.
The requirement is that every finance guy should get access to it (by the way, it is a report) unfortunately we have many different sites and may different composite roles for the different positions in the finance area.
And I did not identify a role which is part of every composite role in the finance area, so I would either have to add it to the most common role present in these composite roles and additionally create a new role which gets assigned to the composite roles where I add the T-Code to is not present.
-> In this example I would add one T-Code to two roles. Which our security manager disallowed me...
or make this role available in all finance composite roles, which will give these employees access to other T-Codes which are part of the role but which they should not receive.
-> Which again... our security manager disallowed me...
So the only solution I imagined was to create a new role which contains this T-Code and to add this role one by one to every composite role.
And at the end, your concept is also taken into account because the design of this role is open and if we get a new reporting T-Codes which again need to be added to all Finance guys, I definitely add it to this role
Comments?
Cheers
Florian

ERM - Mass Role Import Error

I just upgraded to SP11 and am trying to mass import a few roles. It doesn't give me an error on the mass input screen, but it doesn't import the role, so I put DEBUG on and looked at the system logs. I created the download file as both ANSI and UTF-8 and neither is working. Here is the system log output:
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG
-- Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG recordHistory:0::true#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG -- End Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Current Module: |CFG| Conversation: |cnvSysLog| Screen: |scrSysLog|
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#loadMassRoleImport#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Changing Conversation: FROM: cnvSysLog TO cnvMassRlImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearConversationRep :   : 0 entries cleared from conversation repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearScreenRep :   : 0 entries cleared from screen repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG forwarding to:/cfg_mass_role_import.jsp
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG
-- Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG -- End Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#importRoles#
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:09,332 [SAPEngine_Application_Thread[impl:3]_28] DEBUG dirName-->E:\usr\sap\WMS\GRC\ROLEIMPORT\1269358029332
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG returnStatus###success
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG forwarding to:/cfg_mass_role_import_status.jsp
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG
-- Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG -- End Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#generateRolesForeGround#
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) starts.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) ends.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG GET_BUS_PROC ===== SELECT BP.BPROCID, BP.BPROCNAM, BL.BPROCDES FROM VT_RE_BPROC BP LEFT OUTER JOIN VT_RE_BPROCLNG BL ON(BP.BPROCID = BL.BPROCID AND BL.LNGID=?), VT_RE_BPSPASSOC BSP WHERE BP.BPROCID = BSP.BPROCID AND BSP.SUBPROCID =?
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG bprocName ===== HR00
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG keys.size():- 42
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1 cache statusid = 1 value = DEVELOPMENT Desc = Kehitys
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2 cache statusid = 2 value = PRODUCTION Desc = Produksjon
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 3 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 4 cache statusid = 1 value = DEVELOPMENT Desc = Development
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 5 cache statusid = 2 value = PRODUCTION Desc = �retim
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 6 cache statusid = 1 value = DEVELOPMENT Desc = Projektowanie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 7 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 8 cache statusid = 2 value = PRODUCTION Desc = Produ��o
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 9 cache statusid = 1 value = DEVELOPMENT Desc = Desarrollo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 10 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 11 cache statusid = 2 value = PRODUCTION Desc = Produzione
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 12 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 13 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 14 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 15 cache statusid = 1 value = DEVELOPMENT Desc = Udvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 16 cache statusid = 2 value = PRODUCTION Desc = Produkt�v
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 17 cache statusid = 1 value = DEVELOPMENT Desc = ??????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 18 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 19 cache statusid = 2 value = PRODUCTION Desc = Productie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 20 cache statusid = 1 value = DEVELOPMENT Desc = Fejleszt�s
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 21 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 22 cache statusid = 1 value = DEVELOPMENT Desc = Desenvolvimento
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 23 cache statusid = 2 value = PRODUCTION Desc = ???
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 24 cache statusid = 1 value = DEVELOPMENT Desc = Ontwikkeling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 25 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 26 cache statusid = 2 value = PRODUCTION Desc = ????????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 27 cache statusid = 1 value = DEVELOPMENT Desc = Sviluppo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 28 cache statusid = 1 value = DEVELOPMENT Desc = Utveckling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 29 cache statusid = 2 value = PRODUCTION Desc = Tuotanto
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 30 cache statusid = 2 value = PRODUCTION Desc = Produkcja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 31 cache statusid = 1 value = DEVELOPMENT Desc = Utvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 32 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 33 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 34 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 35 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 36 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 37 cache statusid = 2 value = PRODUCTION Desc = Proizvodnja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 38 cache statusid = 1 value = DEVELOPMENT Desc = Entwicklung
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 39 cache statusid = 1 value = DEVELOPMENT Desc = Geli?tirme
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 40 cache statusid = 1 value = DEVELOPMENT Desc = Razvoj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 41 cache statusid = 2 value = PRODUCTION Desc = Producci�n
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 42 cache statusid = 1 value = DEVELOPMENT Desc = D�veloppement
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1RoleStatusName:- DEVELOPMENT
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2RoleStatusName:- PRODUCTION
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG MissingDescriptionHelperDAO.java@37:com.virsa.re.dao.MissingDescriptionHelperDAO.getMissingRoleDesc()missingLst.size(): 1
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG startIndex: 0; endIdex: 1
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG RoleImportBO.java@1393:com.virsa.re.bo.impl.RoleImportBO.createRole()Creating Role:ZM:HR_PY_DEPT_SUPP_COMP profile:'Z:DEPTSUPP'
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11)
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11) ResultSet and got an entry
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] ERROR Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
java.lang.Throwable: Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:85)
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:124)
     at com.sap.sql.types.GenericResultColumn.checkLength(GenericResultColumn.java:212)
     at com.sap.sql.types.VarcharResultColumn.setString(VarcharResultColumn.java:63)
     at com.sap.sql.jdbc.common.CommonPreparedStatement.setString(CommonPreparedStatement.java:511)
     at com.sap.engine.services.dbpool.wrappers.PreparedStatementWrapper.setString(PreparedStatementWrapper.java:355)
     at com.virsa.re.dao.jdbc.ChangeHistoryDAO.saveChangeHistory(ChangeHistoryDAO.java:318)
     at com.virsa.re.bo.impl.ChangeHistoryBO.saveChangeHistory(ChangeHistoryBO.java:77)
     at com.virsa.re.bo.impl.RoleBO.updateRoleWithChngeHist(RoleBO.java:469)
     at com.virsa.re.bo.impl.RoleImportBO.createRole(RoleImportBO.java:1437)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:639)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:333)
     at com.virsa.re.configuration.action.MassRoleImportAction.generateRole(MassRoleImportAction.java:597)
     at com.virsa.re.configuration.action.MassRoleImportAction.execute(MassRoleImportAction.java:78)
     at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:273)
     at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)
     at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)

Hi All,
Two weeks ago, I have trying to load roles in ERM. The result hasn´t been than expected. I use SAP GRC AC (5.3). I need to load 6375 single roles, but only I have loaded 914 single role. Next I described to you a general context of my situation:
1. I divided the file VIRSA_RE_DNLDROLES.txt into 16 files (UTF - 8) with single roles per module (AM, PO, PS, GL, SD...)
2. Each file contains segmented roles associated to a business process and multiples sub - business process.
3. When I checked roles in ERM, I notice that just load any roles. Not all roles in template was loaded.
4. Files size varies between 18 kb y 145 kb.
5. Files concerned "Mass Role Import" have the following extensions: Bulk Download File* (.txt), Enterprise Role Management Information File (.xls) and Primary Org. Level File (.xls).
5. A error generated was "Unknown error occurred while performing operation (No space left on device (errno:28))."
Honestly, I don´t know the reason for not loading all roles from template. Any suggestions? or ideas?
Thanks in advance

Post EhP4 Upgrade - SUIM does not show Composite Role report

Hi
I'm having trouble in SUIM after we upgraded to EhP4. Specifically in the Roles by complex criteria selection.
When a list of single roles is displayed, I select a role and click on Contained in Composite roles (3-arrow button)
Instead of showing me the list of comp role that selected single role is found in, I get a collective list of all the single roles that are located in the same composite roles as the selected single role is found in.
Any help out there?
Regards,
Yergat

Hi,
Refer the below SAP Notes:
SAP Note 1393940 - SUIM| Incorrect results when searching for profile and roles.
SAP Note 1543140 - SUIM|RSUSR070 long text, USER_COMMAND_AGR
Regards,
Raghu
Added a new SAP note, which is also relevant

What roles are required to use Guided Procedures?

Hi ,
What roles are required to use Guided Procedures?
Thanks
Srinivas.K

Hi,
Refer this block https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/3603. [original link is broken] [original link is broken] [original link is broken]
This blog is very useful to u and in this blog she is explained what roles to needed for Guided Procedure.The Composite Application Framework role is used for the Guided Procedure in the Portal.First create the user and then assign the CAF role for that user.This is way to obtain the Guided Procedure for that user.
Thanks,
satheshkumar.R

Stopping user compare when saving composite roles in 4.6c basis pack 25?

One of the environments I look after is a 4.6c system with basis pack 25 they cant upgrade as it breaks a great deal of very heavy customisation in that system.
We have encountered an issue with the saving of composite roles in that system - when a role is saved we must sit through a very long period of user distribution in role XXX while the system performs a user compare of every singular role in that composite role. This is very painful as it can take nearly half an hour simply to save the composite role we then need to rebuild the menu and compress it (we use the composite roles menu structure). The odd thing is that this behaviour wasnt apparent for many years it suddenly started happening about 2-3 years ago to a previous administrator but he wasnt aware of any changes going through, it just began to force these lengthy compares on him when saving composites.
Ive tried in vain to disable this forced compare on every save Ive tried the PRGN_CUST modifications including adding the lines AUTO_USERCOMPARE with a value of NO and USRCOMPARE_PFUD with a value of YES to try and stop the profile generator from doing this but to no avail. Unless these settings need a restart of the system to take effect (do they?) Im at a loss to find any other options.
The menu setting in the profile generator of automatic user master adjustment when saving role is switched off though setting auto_usercompare seems to have broken the ability to bring up the settings: role maintenance dialogue box anyway.
We have a very large number of roles to modify and would be grateful if anyone could offer any advice here.
Thanks
DT

the problem with your issue is that none of use can reproduce that phenomenon, since none of use has that combination of primal release/support package level at hand any longer (at least i think so). so there's only two options left to you:
first: update this special application until the problem goes away - do so by adding note after note on the very subject, like the one i mentioned plus [905924|https://websmp130.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=905924&nlang=EN&smpsrv=https%3a%2f%2fwebsmp107%2esap-ag%2ede] plus [662484|https://websmp130.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=662484&nlang=EN&smpsrv=https%3a%2f%2fwebsmp107%2esap-ag%2ede] and stop only when you hit one that is not implementable using SNOTE but only by implementing a support-package -> this will obviously be the point where you're stuck then.
(and yes - for the sake of rob burbank: there are several other ways to implement corrections aside from SNOTE).
second: open a call with SAP. mind you, this might become a lenghty one since they will also give you note after note ...
as i said, i'm pretty sure no one in here can help you doing a proper analysis anymore (but maybe i'm wrong).
anyone - any other (better) suggestions?

CUA problem with composite role

Hello experts, I have a problem with a composite role in my CUA parent system. If you look at the roles tab you will see one of the child roles has a name of child CUA system in the 'target sys' column. the rest all have 'user system'. Can anyone explain how this 'target sys' column is defined?
Thanks
Dave Wood

I do not know if you have solved this issue, but the target system is defined within your single role on you menu tab.
No what happens is that in transaction SM30 table SSM_RFC you define system variable linked to your logical system.
This variable determines that when you import roles from another system by means of transaction PFCG > Read from other system from RFC and you select your variable the system will automatically default in the target system field the system it is suppose to go back to.
So this way when you distibute the roles it will only go back to that particular target system, and you do not need to specify and guess where the role came from.
Try removing that table entry in SM30 SSM_RFC and see if that way you will be able to remove the target system from the role.
However it is not a bad thing to have activated. If you are working with position base authorizations and you have more than 1 system, you define 1 composite role for all the roles, for all the systems and you will be able to see where the composite resides by means of the target value.
Hope this makes sense.
Regards
Sonja

ERM - composite role is requiring profile name

Similar Messages

Maybe you are looking for