ERM: Identifiy / Search for roles in physical systems

Hi all,
Assuming we have a system landsce for ERP defined with a DEV, QA and PROD systems and role generation takes place in DEV and roles are transported in Backend R/3 from DEV to QA and afterwards, from QA to PROD.
Questions:
1) How can I track within ERM the roles I have in the different systems (DEV, QA and PROD) within the ERP System Landscape? 2) Is there any attribute that could help me to identify in which stage (DEV, QA or PROD) the roles are?
3) Which is the best practice to accomplish such requirement?
Many thanks in advance. Best regards,
Imanol

Nitin,
Many thanks in advance for your response.
A couple of further questions:
1) The update to the role status value to production when the role is transported to production, needs to be manually updated, correct? Is there anyway to automate this?
2) What if we would like to identify which roles do we have in QA environment? Can we include new value for attribute "Role Status"?
Many thanks in advance. Best regards,
Imanol

Similar Messages

Searching for roles by Groups

When creating a GRC Request you have the option to Search for a Role, Profile, or Group.
What kind of group would I be searching for? Is this a group that is created on the back end of SAP? The only groups I can currently find are User Groups; and I know these aren't them.
Any help is appreciated.
Thanks,
Ryan

I have been trying to find information on this for a while now...
Anyone here know this?
Thanks, regards
Patrick

OIM 11g R1 - Container for Roles

Hi,
is it possible to create container for roles?
For Example:
Container1: RoleA, RoleB, RoleC
Container2: RoleV, RoleY, RoleZ
The reason is, i want to create authorization policies, which allows the user to assign specials roles. The problem is, that a lot of roles will be added during the operation. This means, if a new role will be created, i have to edit the authorization policy
The best way is, i assign a Role-Container to the authorization policy. If i create a new role, i add the role to the special container.
Is this possible in OIM 11g R1?
Edited by: 960944 on Apr 3, 2013 5:18 AM

Yes, you can do that using authorization policy.
Try this:
Create a Role called 'X'
Create a Authorization Policy of Role Management Entity Type called 'X Role Authz Policy' and under the Permission tab:
Grant Modify Role Membership, Search for ROle, View Role Detail and View Role Membership
Under Data Constraints: Add all the roles that a user can self assign except SYS ADMIN role.
Under Assignemnt: Add Role 'X'
Save and apply to test it.
You can have a look at the default Role Management All Users Policy for reference.
Regards,
Sunny

Searching for Apps to help us manage employee hours and all mobile plant maintenance and hours any suggestions

We are currently looking for a way to get rid of paper in our business. We have machines all over the place as well as staff.
Does anyone have a app that can manage employee hours and would be able to record plant (machine) hours and jobs?

If you are using Quick books in your company you can search for apps through their system and there is one that integrates with QB15 that is great but i cant remember the name right this second .

GREP search for \$ Dollar sign doesn't find them all?

Hello,
OK-I was practicing my GREP yesterday and was working with escaping out characters. Since the $ could not be found, I assumed it needed to be escaped out \$. The odd thing is, when I say find next, it skips many of them in the document?
Anyone know why?
thanks!
babs

This has been reported before; it's an oddity of ID's implementation of GREP. Nobody knows why! (*)
It only works reliably when you do not use the escape code \$ (you were, in fact, correct to try that first!), but instead use the Unicode notation for a dollar sign: \x{0024}.
I've noticed some strange GREP-related behavior myself: at times, it seems "Find Next" can skip a *huge* quantity of text and finds something near the end of the file; but a next "Find Next" mysteriously jumps back to the previous find position, and continues from there as if nothing happened.
(*) I'm pretty sure it's the Adobe engineers that are responsible for this. According to Peter Kahrel, Adobe didn't write the GREP module by themselves but chose to use a free programming library called "boost". Now boost is an extremely thorough piece of work that has gone through literally years of development and dozens, if not hundreds of programmers (probably unpaid as well, since boost is open source), and I cannot imagine something like this to slip through unnoticed.
But ... for InDesign, the Adobe programmers had to add code to cater for InDesign's own special characters and codes -- stuff like the special characters and spaces, and text variables. It's not hard to imagine a programmer accidentally changing a line of code that did the, erm, "now search for \$" stuff.

CUA with HR-Org - How to assign systems for role

Dear all,
we are planning to use CUA with HR-Org assignment. Can please anyone explain to me how or where the system for the role comes from.
I mean, normaly in SU01 -> Role Assignment I have in the first colum the system and in the second colum the role. It the role assigment come from HR-ORG there is always the local logical system in the system colum. This is not what we want.
CUA is on Solution Manager, HR-ORG is replicated from R/3 HR Systeme and the user needs the roles in ECC production systeme.
So how can we manage the system/role combination assignment?
Thanks for any hints.
Best regards
Roman

Hi,
If I understand your problem you want to do role assignment from the HR-Org structure on a system that is using CUA.
I have only managed this successfully when the CUA master is also the system with the HR-Org structure on it. Otherwise you have lots of issues with replicating data between systems. I did this for a UK council's SAP solution where we allocated all the roles from the HR system, including roles on ECC, SRM(EBP), CRM and BI - so it does work.
PO13 on the system with the org. structure will only allow you to allocate a role that exists on that system, but if the roles that you are allocating are composite roles that include single roles on other systems, you can achieve this sort of business role allocation without having to go the IdM route.
Darren Hague (no relation) gave a presentation at SAP Tech Ed 07 on such a scenario, that explains how the composites would be set up far better than I can, but in essence you use the CUA connectivity and the rights of the CUA master system (which includes the org. structure) to allocate roles on other systems / clients in your CUA landscape.
Have a search through SAP Tech Ed 07 presentations and you should find what you are looking for.

ERM -- unable to determine matching org. level for BRGRU in the system

Hello,
I have a problem.
When I trY to import in the ERM (SAP GRC AC 5.3 SP5) a mass import of roles (derived roles) using the template Organizational Template.
Some of the roles gives me this error:
"Role not imported; unable to determine matching org. level for BRGRU in the system".
In the file I put for example
ZAPVAPINTE BUKRS 0083
Am I doing it right? or do I have to put $BURKS?
Best regards.
Pablo Mortera.

I have found that when you run the background job "syncronization of the organizational values" it pulls the org value name and all "values" assigned to it. If you don't have values specified (on the table level) for the org name, you get this error. We have many fields that we use values for these fields but they aren't specified in the table.
For example: We have the org value "PLVAR" with the values "AL", "01", "02", "03", and "GB" assigned to it. You can actually see these values in the backend system using SE11. We do not get this error on this org value. However, we have another org value "SACHZ" that we use, but we do not have any values assigned to it on the table level, so it is giving us this error. We are trying to find out how to populate the "values" field since this was not done through configuration.
Here are the steps: (1) Go to SE11 in your backend system. (2) Put your org value (example: PLVAR) in the "DATA TYPE" field and click display. (3) Double click on the Domain name. (4) Go to the Value Range Tab and click on the "Value Table" name if there is one. This is the table that has the org values assigned in it - normally done through configuration. (5) go to Utilities --> table contents --> display. (6) execute the table contents. These are the values that the sync job pulls over. If there are no values there or if there is no "values table" name, you get the error. If there are values there, you don't get it.
We are working with our technical team to get the values in these fields to see if that works. Another quick way to see if there are values assigned to the org field is to use "Org Value Mapping" in ERM. Select the "derived org level field" you want to see and click on the "org value from" magnifying glass. If no values are there, a "values table" hasn't been populated in SE11.
It doesn't make much sense to me though because we can still use values for these fields for our derived roles....we just don't populate the table with them.
I'll update this message if we find a solution.
Thanks,
Peggy

CUP 5.3 - Role Reaffirmation for roles coming from ERM

Hi All,
our source system for roles in the CUP is the ERM.
can i do Role Reaffirmation for those roles ? because i saw that they don't come with validity dats
Thanks
Yudit

Hi,
My personal recommendation would be to either go with spreadsheet or backend system. Even when you bring roles from SAP system, it doesn't have any role reaffirm date as there is no such field in backend system. If you want to maintain roles properly then please configure them in spreadsheet so if you need to do mass changes it would be very easy to perform those updates.
Regards,
Alpesh

Search for records by Remote Key or Remote System in Data Manager

Hi all,
We have a requirement to search for records by Remote key and/or Remote System at the main table level. Is it possible to do this using the Data Manager? If so, how?
Thanks in advance!
Lavanya.

Hi,
I crosschecked with MDM 5.5 and Don't think it is possible through Data Manager. How ever using APIs you can search records using remote key/ remote system.
Regards,
Shiv

BP search for General and Company Code roles

Hi
On the modify Money Market Transactions (TM_52) (and some similar to it for other products TS02, TM32, TO02), if i go to the Partner Assignment Tab and I try to assign a bp for the General or the Company Code roles, the bp search program give me no results.
If i try to do the search for the Counterparty role it gives me the results I expect.
Is there any reason for do not give any result when these roles are the primary roles that, of course, the bp I choose has? Is it a program problem (this program has returned me some dumps and I implemented some Notes on it before)? If so, is there any solution?
I want to assign these roles because I hope that these assignments with these roles modify the payment data or the master data of the transaction.
Thanks

Hi
This is a very common topic.
look at this thread:
Authorization in reports
Here's a starting point ...
http://help.sap.com/saphelp_bw33/helpdata/en/72/eeb23b94c6e54be10000000a11402f/frameset.htm
Outline steps...
In RSSM:
Create authorization object
Make authorization object applicable to relevant InfoProviders
In PFCG:
Add authorization object to new or existing Roles with appropriate field assignments
Make User/Role assignments
Reg's
Edan

Search for user role but help poppup display

Anyone ever trying to search for user role from search action bar or user admin page?
Whenever select role and clicked on the magnifying glass icon, help content displays instead of role selection.
At first I think this is a bug. But when I asked Customer Care they said its an expected behaviour which means that this is how the engineers designed it.
Dont you feel weird? because other field like status, correctly displays status info after clicking the icon.
Hope u can try it this out and give your opinion here.

Can you provide a little more detail on what you were trying to do.

Error searching for from role provider Microsoft.Office.Server.Security.LdapProviderException: Unexpected exception occurred, please contact administrator to resolve this issue.

Hi,
I am trying to configure FBA with ADLDS on SharePoint 2013 Enterprise.
I have edited, web.config files for Central Admin, Security Token Application and Claim aware WebApplication.
<PeoplePickerWildcards>
<clear />
<add key="XXPROVIDERMP" value="%" />
<add key="XXPROVIDERRM" value="%" />
<add key="AspNetSqlMembershipProvider" value="%" />
</PeoplePickerWildcards>
<membership defaultProvider="i">
<providers>
<add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
<add name="XXPROVIDERMP" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" server="CSERVER" port="389" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="userPrincipalName" userContainer="CN=Clients,CN=Extranet,DC=XXDCNAME,DC=dmz" userObjectClass="person" userFilter="(|(ObjectCategory=group)(ObjectClass=person))" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />
</providers>
</membership>
<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
<providers>
<add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
<add name="XXPROVIDERRM" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" server="CSERVER" port="389" useSSL="false" groupContainer="CN=Clients,CN=Extranet,DC=XXDCNAME,DC=dmz" groupNameAttribute="cn" groupMemberAttribute="member" userNameAttribute="userPrincipalName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" scope="Subtree" />
</providers>
</roleManager>
When I am trying to find user in People Picker, getting error
Error searching for "XXUSER"from role provider "XXPROVIDERNAME" Microsoft.Office.Server.Security.LdapProviderException: Unexpected exception occurred, please contact administrator to resolve this issue.
Has someone else faced this issue?

Figured it !
Account which was accessing FBA didn't had permission on it.

Systems not appearing/Cannot search for systems

Greetings,
I have defined two systems that call BAPI's (via RFC) on an instance of SAP that we utilize for testing. Using Visual Composer 7.0, we were able to use the "Find Data" option to search our portal instance for systems, but this feature does not seem to be present in the CE 7.1 version of VC.
We were initially trying to migrate the Visual Composer iViews that we created from our 7.0 portal to our CE 7.1 portal. We defined these two systems in the portal and assigned the correct permissions and connection strings before performing the migration. The migration wizard in VC asked us to define the new system names, but the dropdown box that is supposed to contain the defined systems was empty.
My questions are...
1. Even though we've defined the systems in CE 7.1, why are they not appearing during the migration process as options?
2. In VC 7.1, the search function does lot list systems as an option. I have tried searching all of Portal Content, but no systems appear in the results. How do I search for systems defined in the portal so that I can define a data source?
Thanks and I appreciate your help.
-= Michael

Hi Michael,
first of all the connection to an ABAP system via portal system object as you have used it in VC7.0 should also work in VC7.1. Maybe there is an issue with your configuration. There is also another option to setup the connection via RFC connection in the SAP NetWeaver Administrator. Anyway I suggest that you try to establish a connection via RFC, which is described in the [Wiki|https://www.sdn.sap.com/irj/scn/wiki?path=/display/vc71/rfc+destination]. If this connection will work then you should investigate why the connection via system portal system object is not working.
Please let me know if you have success with the RFC connection.
Best Regards,
Marcel

Where to search for R3A* queues in status SYSFAIL in my system.

Hi Experts,
Can anyone tell me in which Tcode or table I can search for the below entries. I am trying to find out these entries as one of CRM team member had mentioned the below one.
R3A* queues in status SYSFAIL were detected in your system. As a result, changes in the R/3 system have not been updated in the CRM system.
Regards
Srujan K

Hi Muthu,
Can you please tell me what are these Queues belong to, meaning which is repsonsible for what in SRM?
R3AD_ATTRIBUTE
R3AD_CLASS
R3AD_CUSTOME0000000043
Do we as an SRM consultant have to monitor the SMQR queues also?
please clarify me on the above 2 points.
Thanks in Advance!!!
Regards,
Srujank

Search for System FIles

I have eight student servers running 10.5.4, and I would like to search the home directories for specific files to delete. For instance, in Tiger I could do a simple search for "com.apple.desktop.plist", get a nice list from all student homes where I could delete them en mass. In Leopard it seems not to search Library files. If in the finder search box I select "Other" I expect a list of attributes like System files, but unlike the desktop I sit at now the list is blank. Any ideas?
Thanks in advance.

Hi Ikern, you could try something like sudo find /path/to/users/networkhomedirectory/ -name "com.apple.desktop.plist" -exec rm '{}' \; in terminal changing the /path/to/users/networkhomedirectory/ to suit your set up and the "com.apple.desktop.plist" for the file you want to find.
This command will find all the files with that name in the location you point it to and delete them.
We used to use a similar command to delete the ._ files on our Windows Shares before the advent of dot_clean.
If you want a list of found files rather than delete them try find /path/to/users/networkhomedirectory/ -name "com.apple.desktop.plist" >> foundfiles.txt
this will create a txt file of the found files.
This may allow you to do what you want until the search function is fixed.
Cheers

ERM: Identifiy / Search for roles in physical systems

Similar Messages

Maybe you are looking for