ERM To CUP Role Import

Hello all,
I am wondering, has anyone one out there had any issues when importing ERM roles into CUP. Currently I have found that if you add functional area to the role in ERM (and it's the exact same functional area in CUP) it will not upload into CUP.
We are on SP12
Any ideas why?
Kyle

Alpesh,
SP11 is only in our development system and you cannot look into certain functionality before you get in installed, except to look over current SAP Notes, SAP SP Release Notes and SAP SDN Forum posts for any current issues.
We are moving from SP8.1 to SP11 since it will solve 12 open SAP Msgs for our SAP GRC-AC system. It has solved 90% of those and has been performing well in tests so far.
We have sent this issue to SAP Support and it is a new issue that has not been reported before.
-john

Similar Messages

GRC-AC v5.3 SP11 CUP Role Import format issues

Hi All!
Version: GRC-SAC-SAE 5.3_11.0 ( Build ID:05020110 )
Has anyone installed SP11 and found that the CUP Role Export format and Import format no longer match....by a long shot. Also, even you conform your export file with changes to the restrictive import file format, it still does not make any changes.
Has anyone seen this issue? Has anyone resolved this issue?
Much thanks!
John Stephens

Alpesh,
SP11 is only in our development system and you cannot look into certain functionality before you get in installed, except to look over current SAP Notes, SAP SP Release Notes and SAP SDN Forum posts for any current issues.
We are moving from SP8.1 to SP11 since it will solve 12 open SAP Msgs for our SAP GRC-AC system. It has solved 90% of those and has been performing well in tests so far.
We have sent this issue to SAP Support and it is a new issue that has not been reported before.
-john

Import roles to the ERM without using the "Mass Role Import

Hello,
I want to know if there is another way to import roles to the ERM without using the "Mass Role Import.
Im'm using SAP GRC AC 5.3
Best Regards.
Pablo Mortera.

Hi.
There is NO other way to import roles..
We need to use only ERM for "Mass Role Import.
Regards
Gangadhar

Description issue: Role Import in CUP from ERM

Hi All
While importing roles from ERM in CUP, the description column shows some numeric values in some strange sequence (like 0,1,10,100,1000,1001,1002,1003, and so on). In ERM, roles were uploaded from backend using Mass role Import and Role description are properly available there. For the roles created in ERM itself, correct description is available, when imported in CUP.
Not able to understand this....Please suggest
Thanks
Abhijeet

Hi Abhijeet,
I have found out the cause of this issue.
This issue is coming for those roles which doesn't have detailed description in ERM.
In ERM you can see role name, Role description and also role detailed description.
If the role's detailed description is null in ERM then after importing that role into CUP the description of that particular role will become four digit numeric character. So, We can't say it is a bug because the program is witten like this.
You can see this detailed description in role in the backend ECC system using pfcg.
I hope you understand the point what I wanted to say.
Thanks,
Sudip

Role Import in CUP

Hi
There are two options of choosing the source system for role import in CUP
1. Back end system
2. ERM
I am facing problems in importing roles in CUP from ERM. The system shows a successful import but the number of roles imported are Zero. However if I choose the Backend system as source system, the roles get imported in CUP.
can someone help me with this issue. I want to import roles from ERM because roles imported from ERM will have all the role attributes like Business process, Sub business process, functional area etc which are not available if we import roles from backend.
Regards,
Nitin

Hi Sahad,
Did you look at CUP logs? Is ERM and CUP installed on same server? Have you configured Business process and sub process exactly same as in ERM?
There are 2 ways to upload roles into CUP using spreadsheet:
1) Cumbersome method, if you don't have roles maintained in Excel: You can get R/3 roles via SUIM or some other method and manipulate them to match the role import template of CUP
2) Easy method : Import all the necessary roles into CUP via Backend. Once you have all the roles in CUP, go to 'Search Roles'. Click on 'Search' button without providing any search criteria. This will return all the roles available in CUP. Now, click on Export button. CUP will export all the roles into Excel spreadsheet in the format which CUP understands. Now, delete all the roles from CUP and play with the spreadsheet to manipulate other parameters like role approvers, systems, business process etc and upload that spreadsheet into CUP.
Both these methods require some manual work.
Regards,
Alpesh

ERM - Mass Role Import Error

I just upgraded to SP11 and am trying to mass import a few roles. It doesn't give me an error on the mass input screen, but it doesn't import the role, so I put DEBUG on and looked at the system logs. I created the download file as both ANSI and UTF-8 and neither is working. Here is the system log output:
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG
-- Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG recordHistory:0::true#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG -- End Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Current Module: |CFG| Conversation: |cnvSysLog| Screen: |scrSysLog|
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#loadMassRoleImport#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Changing Conversation: FROM: cnvSysLog TO cnvMassRlImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearConversationRep :   : 0 entries cleared from conversation repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearScreenRep :   : 0 entries cleared from screen repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG forwarding to:/cfg_mass_role_import.jsp
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG
-- Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG -- End Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#importRoles#
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:09,332 [SAPEngine_Application_Thread[impl:3]_28] DEBUG dirName-->E:\usr\sap\WMS\GRC\ROLEIMPORT\1269358029332
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG returnStatus###success
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG forwarding to:/cfg_mass_role_import_status.jsp
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG
-- Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG -- End Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#generateRolesForeGround#
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) starts.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) ends.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG GET_BUS_PROC ===== SELECT BP.BPROCID, BP.BPROCNAM, BL.BPROCDES FROM VT_RE_BPROC BP LEFT OUTER JOIN VT_RE_BPROCLNG BL ON(BP.BPROCID = BL.BPROCID AND BL.LNGID=?), VT_RE_BPSPASSOC BSP WHERE BP.BPROCID = BSP.BPROCID AND BSP.SUBPROCID =?
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG bprocName ===== HR00
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG keys.size():- 42
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1 cache statusid = 1 value = DEVELOPMENT Desc = Kehitys
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2 cache statusid = 2 value = PRODUCTION Desc = Produksjon
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 3 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 4 cache statusid = 1 value = DEVELOPMENT Desc = Development
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 5 cache statusid = 2 value = PRODUCTION Desc = �retim
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 6 cache statusid = 1 value = DEVELOPMENT Desc = Projektowanie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 7 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 8 cache statusid = 2 value = PRODUCTION Desc = Produ��o
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 9 cache statusid = 1 value = DEVELOPMENT Desc = Desarrollo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 10 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 11 cache statusid = 2 value = PRODUCTION Desc = Produzione
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 12 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 13 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 14 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 15 cache statusid = 1 value = DEVELOPMENT Desc = Udvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 16 cache statusid = 2 value = PRODUCTION Desc = Produkt�v
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 17 cache statusid = 1 value = DEVELOPMENT Desc = ??????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 18 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 19 cache statusid = 2 value = PRODUCTION Desc = Productie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 20 cache statusid = 1 value = DEVELOPMENT Desc = Fejleszt�s
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 21 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 22 cache statusid = 1 value = DEVELOPMENT Desc = Desenvolvimento
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 23 cache statusid = 2 value = PRODUCTION Desc = ???
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 24 cache statusid = 1 value = DEVELOPMENT Desc = Ontwikkeling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 25 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 26 cache statusid = 2 value = PRODUCTION Desc = ????????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 27 cache statusid = 1 value = DEVELOPMENT Desc = Sviluppo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 28 cache statusid = 1 value = DEVELOPMENT Desc = Utveckling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 29 cache statusid = 2 value = PRODUCTION Desc = Tuotanto
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 30 cache statusid = 2 value = PRODUCTION Desc = Produkcja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 31 cache statusid = 1 value = DEVELOPMENT Desc = Utvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 32 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 33 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 34 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 35 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 36 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 37 cache statusid = 2 value = PRODUCTION Desc = Proizvodnja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 38 cache statusid = 1 value = DEVELOPMENT Desc = Entwicklung
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 39 cache statusid = 1 value = DEVELOPMENT Desc = Geli?tirme
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 40 cache statusid = 1 value = DEVELOPMENT Desc = Razvoj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 41 cache statusid = 2 value = PRODUCTION Desc = Producci�n
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 42 cache statusid = 1 value = DEVELOPMENT Desc = D�veloppement
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1RoleStatusName:- DEVELOPMENT
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2RoleStatusName:- PRODUCTION
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG MissingDescriptionHelperDAO.java@37:com.virsa.re.dao.MissingDescriptionHelperDAO.getMissingRoleDesc()missingLst.size(): 1
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG startIndex: 0; endIdex: 1
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG RoleImportBO.java@1393:com.virsa.re.bo.impl.RoleImportBO.createRole()Creating Role:ZM:HR_PY_DEPT_SUPP_COMP profile:'Z:DEPTSUPP'
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11)
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11) ResultSet and got an entry
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] ERROR Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
java.lang.Throwable: Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:85)
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:124)
     at com.sap.sql.types.GenericResultColumn.checkLength(GenericResultColumn.java:212)
     at com.sap.sql.types.VarcharResultColumn.setString(VarcharResultColumn.java:63)
     at com.sap.sql.jdbc.common.CommonPreparedStatement.setString(CommonPreparedStatement.java:511)
     at com.sap.engine.services.dbpool.wrappers.PreparedStatementWrapper.setString(PreparedStatementWrapper.java:355)
     at com.virsa.re.dao.jdbc.ChangeHistoryDAO.saveChangeHistory(ChangeHistoryDAO.java:318)
     at com.virsa.re.bo.impl.ChangeHistoryBO.saveChangeHistory(ChangeHistoryBO.java:77)
     at com.virsa.re.bo.impl.RoleBO.updateRoleWithChngeHist(RoleBO.java:469)
     at com.virsa.re.bo.impl.RoleImportBO.createRole(RoleImportBO.java:1437)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:639)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:333)
     at com.virsa.re.configuration.action.MassRoleImportAction.generateRole(MassRoleImportAction.java:597)
     at com.virsa.re.configuration.action.MassRoleImportAction.execute(MassRoleImportAction.java:78)
     at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:273)
     at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)
     at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)

Hi All,
Two weeks ago, I have trying to load roles in ERM. The result hasn´t been than expected. I use SAP GRC AC (5.3). I need to load 6375 single roles, but only I have loaded 914 single role. Next I described to you a general context of my situation:
1. I divided the file VIRSA_RE_DNLDROLES.txt into 16 files (UTF - 8) with single roles per module (AM, PO, PS, GL, SD...)
2. Each file contains segmented roles associated to a business process and multiples sub - business process.
3. When I checked roles in ERM, I notice that just load any roles. Not all roles in template was loaded.
4. Files size varies between 18 kb y 145 kb.
5. Files concerned "Mass Role Import" have the following extensions: Bulk Download File* (.txt), Enterprise Role Management Information File (.xls) and Primary Org. Level File (.xls).
5. A error generated was "Unknown error occurred while performing operation (No space left on device (errno:28))."
Honestly, I don´t know the reason for not loading all roles from template. Any suggestions? or ideas?
Thanks in advance

GRC AC 5.3 SP5 - ERM mass role import error

Dear Gurus
I am customising ERM 5.3 SP5 and encountering the following error.
I have tried to search and find the forum for an analogous message, but unsuccessfully.
Thanks in advance for your assistance / support
Best regards
RONAN
Role Import Failed for SAP_CO_OM_XXXXX_XXXXXX_X :
2010-01-15 09:07:47,065 [Thread-315] ERROR com.sap.engine.services.dbpool.exceptions.BaseSQLException: ResourceException in method ConnectionFactoryImpl.getConnection(): com.sap.engine.services.connector.exceptions.BaseResourceException: Cannot get connection for 120 seconds. Possible reasons: 1) Connections are cached within SystemThread(can be any server service or any code invoked within SystemThread in the SAP J2EE Engine), 2) The pool size of adapter "SAPxxxDB" is not enough according to the current load of the system or 3) The specified time to wait for connection is not enough according to the pool size and current load of the system. In case 1) the solution is to check for cached connections using the Connector Service list-conns command, in case 2) to increase the size of the pool and in case 3) to increase the time to wait for connection property. In case of application thread, there is an automatic mechanism which detects unclosed connections and unfinished transactions.

Hello Ronan,
This is a connection error and can be rectified by your basis team (as mentioned by Alpesh) which need to increase the wait time. If you are just dealing with the configuration part, then I would say it is not an error resulting from Functional Config but Basis Configuration.
regards,
hersh.
Edited by: HERSH GUPTA on Jan 17, 2010 3:28 PM

ERM mass role import - not importing all the roles

Dear All,
We are configuring GRC AC 5.3 SP11and are currently trying to import roles into the ERM. The system reads the three files (roles, information, and organization" and the job is run in a "successfull" way. However, not all the jobs are being uploaded. For example, out of a total of 300 roles, only 24 roles were uploaded. Afterwards, I tried again to import the roles using the exact same files I initially used, but this time, 35 roles were imported. Does anyone know why this happens and how to solve it? Thanks in advance for your answers.

Hello Arias, There could be a couple of reasons:
1. If you have derived roles, possibly the child role was attempted to be imported before the parent role. During the first import, the child role failed but the parent role imported. Then, on the second run the parent role was already there and the child role could be imported successfully. The way I get around this is to first create a parent role extract/import, then do a child extract/import.
2. Potentially the same problem as above but for composite and single role imports. You could load the single roles first, then the composite.
Best Regards, Dylan

Understanding ERM and CUP integration in AC 10.0

Iu2019m reaching out in hopes to get a better understanding of how AC 10.0 is meant to handle the ERM and CUP integration (Iu2019m still stuck on the old names :). Any feedback would be greatly appreciated.
Currently, we have a requirement to setup the GRC Production box so it can provision user access in the Production ECC but create security roles in Development ECC. This is typically what we see since most clients want to follow their manual transport process to get the security roles from Dev --> QA --> Prod.
Something I noticed in CUP is when a user adds a role to the request form u2013 the role is associated to a system (i.e. Production ECC or Development ECC). If we create a role using ERM and it only gets generated in Development ECC u2013 will we be able to select this role in CUP for user assignment in Production ECC? (assuming itu2019s been transported outside of GRC)
Note: At this point the new role will only be associated to Development ECC from a GRC perspective? So if we assign it in CUP u2013 it will only be associated to Development ECC...?
Do we have to manually perform another u201Crole import / syncu201D from the Production ECC to sync the roles so theyu2019re available in CUP?
This is based on the understanding that CUP looks for available roles for assignment from ERM rather than the Production ECC. Is that correct? Can we have CUP look in the backend rather than ERM?
My question is around the manual u201Crole import / syncu201D that needs to get performed for CUP. Is this really mandatory based on the requirements? It would mean I need to perform a u201Crole import / syncu201D every time a new role is created/deleted/changedu2026 Maybe Iu2019m missing something with the new 10.0 integration / functionality? Are other companies doing something different?
Please let me know what you think. Your insight is greatly appreciated!

Frank,
Thanks for clarifying.
Can you clarify what you mean when you say "you just need to tell CUP that the roles are available in PRD"? What does this mean?
This goes back to the original question - do we need to perform another import of the roles from ECC PRD to ERM? My understanding is that the ERM role repository is looking at my original import of roles and then each role I create using ERM after that. How will it know which roles are in PRD if I don't do a routine synch?
Also, you mentioned "each role has attributes that define in which systems it should be available for requests", where does this get defined? I believe you are referring to the "Role Status" which is set to Development, Production or Testing. I only see the ability to set this during the Role Import, but what about roles which have been created using ERM. I don't see it in the Role details screen - where is the setting?

CUP-Role Status regarding to the System

Hello,
I have been doing some test and I wonder how to distinguish when the role is ready at the diferent phisical system as Prod, Q, Dev.
When searching a role already imported from ERM, you can select three diferent role status ( only the third one is authomatic set from ERM after the import):
-Enable
-Disable
-Enable and provisioning
What does this role status mean? would it be useful for diferring from one phisical system to another?
Thanks in advance!
Margarita.

Hello Margarita,
Here is the explanation of the staus of role:
Enable u2013 roles you want to maintain but do not allow auto provisioning.
Enable and Provision u2013 roles you want to maintain and allow auto provisioning when selected by a user.
Disable u2013 roles that are disabled and are not displayed when the end user uses the Search feature to query for roles.
In normal circumstances, when you import roles from ERM to CUP you would only import those roles which have been generated into production and thus are ready for assigning to users. That is why roles imported from ERM have the status as Enable & Provision.
Regards, Varun

Business Process and sub Process IN ERM and CUP

Hi Friends,
We are in intial stage of GRC implimentation. Now I am uploading the roles into ERM and CUP. I have defined business processes and sub processes for the roles and upload the roles successfully in ERM. But when I am doing the same excercise in CUP especially during creation of sub process it is not allowing the charecter "-" in the name space.
E.g. Business process name is EHS-SM (Uploaded to CUP)
Sub process name is EHS-SM1.1 (not allowing to create in CUP wher as successfully created in ERM)
My question is
1. why it allows me to do the same thing in ERM but not in CUP.
2. Is there any way to maintain the name with chaecter "-".
For your information I am in the phase of defining the attributes for the roles.
Thanks & Regards,
Satyabrat
Edited by: Sunil Varghese on Oct 28, 2009 10:59 AM
Edited by: Sunil Varghese on Oct 28, 2009 11:01 AM

Hi all,
I will have a hard time ahead with BP and SBP. all are in the same format. I dont think my company will agree to change the name of there BP or SBP because they are thousands in count and also there is no other way around in GRC,
Let give me a try...
Thanks Guys for your support and time.

ERM - Workflow Approval Configuration in ERM and CUP

Hi Experts,
I'm in the midst of configuring the workflow approval for ERM and have some queries.
I followed the post-installation guide part 1 for ERM on the workflow configuration and have sucessfully done the following:
1. Verified that the "AE_init_append_data_RE.xml" has been uploaded in CUP with Append option
2. Verified that request type "RE_ROLE_APPROVAL" with workflow type "RE" exists
3. Verified that priority "RE_HIGH" with workflow type "RE" exists
4. Created a workflow initiator for ERM called "ROLE_APPROVAL" in CUP -> Configuration -> Workflow -> Initiator (with the said details as per the post-installation guide)
5. Created a CAD called "ERM_ROLE_APPROVER" for ERM in CUP -> Configuration -> Workflow -> Custom Approver Determinator (with the said details as per the post installation guide, filling in the necessary URI, uname/pw for admin with UME roles)
6. Created TWO stages , one stage for the role owner called "ERM_ROLE_APPROV", and one stage for the internal control owner called "ERM_ROLE_APPRO2", both with workflow type "RE" and Approver Determinator "ERM_ROLE_APPROVER" which was created in step 5 earlier.
7. Created a path for ERM Role Approval Workflow in CUP -> Configuration -> Workflow -> Path, with workflow type "RE", Number of Stages "2", Initiator "ROLE_APPROVER", Active "checked" and I put Stage 1 as "ERM_ROLE_APPROV" and stage 2 as "ERM_ROLE_APPRO2".
8. Configured the Exit Web Service (followed the details as per the post-installation guide for ERM)
As my role approval is pretty straight forward (i.e. based on business process attribute defined, with each role owner being responsible for their business process), I did the following:
1. Create approval criteria "Role Approver for Business Process FI"
2. For that criteria, I based it on attribute "Business Process"
3. I clicked on "Assign Approvers" to define who is the approver (i.e. the respective role owner responsible for Process FI)
4. I defined the condition for this criteria, Condition = AND, Attribute = Business Process, Value = FI
My queries:
1. Is the approval criteria which I created in ERM, referring to 1st stage or 2nd stage of the path in CUP?
2. I'm assuming that for query 1, the approval criteria which I created is for 1st stage (i.e. ERM_ROLE_APPROV), where can I configure the 2nd level approval for the internal control owner (i.e. ERM_ROLE_APPRO2, in the path which I defined in CUP)?
Thanks!

Hi Baldwin,
All workflow paths in CUP are triggered by an Initiator. Once the request from ERM meets "Initiator" ("ROLE_APPROVAL") requirements in CUP, the request will go to the first stage defined in the respective path. Approvers defined in each stage of the path can approve request. Once the request is approved in CUP, approval information will be sent to ERM and then the role in ERM will be moved to the next stage.
Best Regards,
Sirish Gullapalli.

Mass Role Import -- 9000 derived roles with 9 org Levels, how to get TXT

Hello,
I hava a problem.
I want to use the (Mass Role Import) Bulk Role Import element in the ERM (SAP GRC AC 5.3 )for importing SAP roles (I only found that way to import roles from SAP).
I have 100 primary roles and more or less 9000 derived roles with 9 org Levels.
Is there a way to get this 9000 derived roles with their 9 org Levels in a TXT file?. Or do I have to do it manually this part to insert it in the "Bulk Role Import ".
Can someone help me?
Thank you in advance.
Pablo Mortera.

Hi Mike,
what kind of TA´s are in your role. Is it possible to integrate a "dummy" TA (without conflicting
your SOD)?
In my example I have CO TA´s bundled in a role:
Role: ZXXXX_O:CO_ORDERMANAGER_CRE - CO Order Manager Pflege
with
KO01 Create Internal Order ...
KO02 Change Order ...
KO04 Order Manager ...
KOK2 Collective Proc. Internal Orders ...
KOK4 Aut. Collect. Proc. Internal Orders
update this role with TA KO01 and KOKRS will be available for derivation.
Done this manually without import in ERM.
Reg,
Ulrich

Error in Mass role import

Hi All,
I am trying to do a mass role import in ERM. We are using version 5.3 SP10. When trying to mass import the roles I get an error Enter a valid Enterprise Role Management Information File format. I am using the dumps form executing the program /VIRSA/RE_DNLDROLES. I am using the output in .txt format.
Is there any way to get around this issue.
Thanks,
Chinmaya

Hello Chinmaya,
You need to have the information file and the org file in .xls format. Kindly download this file from backend and then change the extension to .xls, modify it to check that data is arranged in proper columns and then save it as .xls format. Once you do that and try to upload this error will not come.
Regards, Varun

Error when updating through "Role import"

Hi all
I get this error when I update through Home > Authentication > SAP > Role Import:
"An error occurred while communicating with the CMS.
The following error message was returned:
Error occurred in CSAPSecHttpRolePage::OnCommitRoles. Return value = -2147213817 (0x80041e07)j Failed to commit objects to server : Duplicate object name in the same folder."
Does this mean that I have duplicate users or groups? If this is the case, how come I get the error even if I remove all roles, update, and then add a role and update again? Then everything should have been cleared?
And the funny part is that the import of users seems to work, because I can log on to the InfoView using SAP authentication... But I don't like this error, and would like to get rid of it.
Best regards,
Martin Søgaard

Hi Sogaard,
when you remove all roles can you verify that all the user groups and users are being removed from the system ?
after removing the roles could you also delete the entitlement system and re-create it ?
Ingo

ERM To CUP Role Import

Similar Messages

Maybe you are looking for