ERM - Workflow Approval Configuration in ERM and CUP

Hi Experts,
I'm in the midst of configuring the workflow approval for ERM and have some queries.
I followed the post-installation guide part 1 for ERM on the workflow configuration and have sucessfully done the following:
1. Verified that the "AE_init_append_data_RE.xml" has been uploaded in CUP with Append option
2. Verified that request type "RE_ROLE_APPROVAL" with workflow type "RE" exists
3. Verified that priority "RE_HIGH" with workflow type "RE" exists
4. Created a workflow initiator for ERM called "ROLE_APPROVAL" in CUP -> Configuration -> Workflow -> Initiator (with the said details as per the post-installation guide)
5. Created a CAD called "ERM_ROLE_APPROVER" for ERM in CUP -> Configuration -> Workflow -> Custom Approver Determinator (with the said details as per the post installation guide, filling in the necessary URI, uname/pw for admin with UME roles)
6. Created TWO stages , one stage for the role owner called "ERM_ROLE_APPROV", and one stage for the internal control owner called "ERM_ROLE_APPRO2", both with workflow type "RE" and Approver Determinator "ERM_ROLE_APPROVER" which was created in step 5 earlier.
7. Created a path for ERM Role Approval Workflow in CUP -> Configuration -> Workflow -> Path, with workflow type "RE", Number of Stages "2", Initiator "ROLE_APPROVER", Active "checked" and I put Stage 1 as "ERM_ROLE_APPROV" and stage 2 as "ERM_ROLE_APPRO2".
8. Configured the Exit Web Service (followed the details as per the post-installation guide for ERM)
As my role approval is pretty straight forward (i.e. based on business process attribute defined, with each role owner being responsible for their business process), I did the following:
1. Create approval criteria "Role Approver for Business Process FI"
2. For that criteria, I based it on attribute "Business Process"
3. I clicked on "Assign Approvers" to define who is the approver (i.e. the respective role owner responsible for Process FI)
4. I defined the condition for this criteria, Condition = AND, Attribute = Business Process, Value = FI
My queries:
1. Is the approval criteria which I created in ERM, referring to 1st stage or 2nd stage of the path in CUP?
2. I'm assuming that for query 1, the approval criteria which I created is for 1st stage (i.e. ERM_ROLE_APPROV), where can I configure the 2nd level approval for the internal control owner (i.e. ERM_ROLE_APPRO2, in the path which I defined in CUP)?
Thanks!

Hi Baldwin,
All workflow paths in CUP are triggered by an Initiator. Once the request from ERM meets "Initiator" ("ROLE_APPROVAL") requirements in CUP, the request will go to the first stage defined in the respective path. Approvers defined in each stage of the path can approve request. Once the request is approved in CUP, approval information will be sent to ERM and then the role in ERM will be moved to the next stage.
Best Regards,
Sirish Gullapalli.

Similar Messages

Workflow Approval Configuration

Hi all,
we are implementing ESS/MSS on ECC5.0,EP6 and I am having difficulty in implementing the PCR workflow with approval step of 1 and 2 approvers. please provide me some link or documentation about the configuration steps to be done.
Need help on this.
Thankyou,
Vijay

Hi Baldwin,
All workflow paths in CUP are triggered by an Initiator. Once the request from ERM meets "Initiator" ("ROLE_APPROVAL") requirements in CUP, the request will go to the first stage defined in the respective path. Approvers defined in each stage of the path can approve request. Once the request is approved in CUP, approval information will be sent to ERM and then the role in ERM will be moved to the next stage.
Best Regards,
Sirish Gullapalli.

SRM 7 - Live Auction Workflow Approval

Dear SRM gurus,
How is the auction workflow approval configured using BRF?
Thanks!

Hello,
SAP does not support approval for auction.
You have to control create auction authorisations, Hope this solves your query.
Thanks
Ashutosh

Configuring ERM workflow in CUP issue (GRC AC 5.3)

Hi once again fellow SAP Security Folk,
Using GRC AC CUP 5.3 SP 13 I am trying to configure ERM workflow for the following scenario :
Every role change made via ERM requires approval from relevant Business Process (BP) area. If the role change contains an SOD conflict of Medium or higher then approval is required from a 2nd central approver (basically regardless of the business process area).
I have not been able to configure ERM workflow within CUP to be able to do this u2013 I have only been able to configure it for dual approval, i.e. every change must have approval from both BP approver and Central approver before request can progress. I did this by assigning the Central approver to all Business Processes as an additional approver. This means that the conditions for the scenario above are met but the drawback is that all other requests also require approval from Central approver even though they donu2019t need to, generating additional workload.
Can anyone advise if this is possible and how to do it ?
Further info:-
I have setup in CUP an ERM Initiator, an ERM Custom Approver Determinator (CAD), an ERM Stage.
I have setup in ERM I have defined Business Process Approval Criteria for each Business Process approver.
I tried creating a 2nd ERM stage using a separate 2nd ERM CAD but this meant all changes required 2nd approval before request can continue.
I tried modifying the 1st Stage to Approval type All Approvers but this meant all changes required approval from all possible BP Approvers (instead of any one) before request can continue.
I tried creating a Detour/Fork but could only see within the Workflow Type selection criteria non ERM workflow types.
Thanks
Steve

You can either type in the configuration, like the what option you selected for approver (CAD or role or...etc), or other way is to capture the change log which shows what was the configuration for that stage....
(Configuration -< Change Log -> Search Change log)
Cheers !!
Zaheer

Understanding ERM and CUP integration in AC 10.0

Iu2019m reaching out in hopes to get a better understanding of how AC 10.0 is meant to handle the ERM and CUP integration (Iu2019m still stuck on the old names :). Any feedback would be greatly appreciated.
Currently, we have a requirement to setup the GRC Production box so it can provision user access in the Production ECC but create security roles in Development ECC. This is typically what we see since most clients want to follow their manual transport process to get the security roles from Dev --> QA --> Prod.
Something I noticed in CUP is when a user adds a role to the request form u2013 the role is associated to a system (i.e. Production ECC or Development ECC). If we create a role using ERM and it only gets generated in Development ECC u2013 will we be able to select this role in CUP for user assignment in Production ECC? (assuming itu2019s been transported outside of GRC)
Note: At this point the new role will only be associated to Development ECC from a GRC perspective? So if we assign it in CUP u2013 it will only be associated to Development ECC...?
Do we have to manually perform another u201Crole import / syncu201D from the Production ECC to sync the roles so theyu2019re available in CUP?
This is based on the understanding that CUP looks for available roles for assignment from ERM rather than the Production ECC. Is that correct? Can we have CUP look in the backend rather than ERM?
My question is around the manual u201Crole import / syncu201D that needs to get performed for CUP. Is this really mandatory based on the requirements? It would mean I need to perform a u201Crole import / syncu201D every time a new role is created/deleted/changedu2026 Maybe Iu2019m missing something with the new 10.0 integration / functionality? Are other companies doing something different?
Please let me know what you think. Your insight is greatly appreciated!

Frank,
Thanks for clarifying.
Can you clarify what you mean when you say "you just need to tell CUP that the roles are available in PRD"? What does this mean?
This goes back to the original question - do we need to perform another import of the roles from ECC PRD to ERM? My understanding is that the ERM role repository is looking at my original import of roles and then each role I create using ERM after that. How will it know which roles are in PRD if I don't do a routine synch?
Also, you mentioned "each role has attributes that define in which systems it should be available for requests", where does this get defined? I believe you are referring to the "Role Status" which is set to Development, Production or Testing. I only see the ability to set this during the Role Import, but what about roles which have been created using ERM. I don't see it in the Role details screen - where is the setting?

Business Process and sub Process IN ERM and CUP

Hi Friends,
We are in intial stage of GRC implimentation. Now I am uploading the roles into ERM and CUP. I have defined business processes and sub processes for the roles and upload the roles successfully in ERM. But when I am doing the same excercise in CUP especially during creation of sub process it is not allowing the charecter "-" in the name space.
E.g. Business process name is EHS-SM (Uploaded to CUP)
Sub process name is EHS-SM1.1 (not allowing to create in CUP wher as successfully created in ERM)
My question is
1. why it allows me to do the same thing in ERM but not in CUP.
2. Is there any way to maintain the name with chaecter "-".
For your information I am in the phase of defining the attributes for the roles.
Thanks & Regards,
Satyabrat
Edited by: Sunil Varghese on Oct 28, 2009 10:59 AM
Edited by: Sunil Varghese on Oct 28, 2009 11:01 AM

Hi all,
I will have a hard time ahead with BP and SBP. all are in the same format. I dont think my company will agree to change the name of there BP or SBP because they are thousands in count and also there is no other way around in GRC,
Let give me a try...
Thanks Guys for your support and time.

Business Rules Framework (BRF) with Access Controll V10 (ERM and CUP)

Hi Experts,
where can I find some information about the usage of BRF with respect to Access Controll (especially ERM and CUP)?
Thanks in advance and best regards,
Marlen

Hi Marlen,
For ramp-up customers we have ramp-up knowledge transfer to be found here:
http://service.sap.com/rkt
If you are not participating in the AC 10.0 ramp-up you would need to wait until the product is general available.
For general information on BRF have look here:
http://help.sap.com/saphelp_nw70ehp2/helpdata/en/43/8b85c9db2f614fe10000000a1553f7/frameset.htm
Best,
Frank

ERM Methodology - Approval

Hi,
Can ERM allow having multiple approval steps in the methodology? We need 3 different approvals placed in different stages in the process.
For testing this, I created new request types of ERM in CUP. Created new steps of approval type in ERM and added them to the methodology. Used ERM request types as initiators for the workflows and attributes for CADs.
With this ERM has to send the request for approval to different approvers as per the CADs. But ERM is asking for role owner name in the role when submitting for approval.
Does only ERM CAD of type 'web service' works to send the request for approval?
Also ERM CAD type web service is working when a single approval step exists in the methodology. ERM 5.3 SP12.
Please help.
R M

Hello ,
To create multiple approval steps ,in CUP you need ot have atleast one ERM CAD type =attribute.
For eg:
Role Owner = X
ERM CAD1 Type=webservice
ERM CAD2 Type=attribute and approver =Y
Stage1 -> CAD1
Stage2-> CAD2
Path: Stage1 -> Stage2
In the above case , the workflow will first go to role owner X , then to CAD2 approver Y.
Regards
-Ranjiv

Error in ERMS Workflow

Hi,
I tried to configure ERMS. We can receive e-mails and the standart ERMS workflow is triggered but we got he following errors:
- Agent determination for step '0000000004' failed
- Workflow WS00200001 no. 000000002022 activity 0000000004 role 'AC00200136': No agent found
    - Resolution of rule AC00200136 for task TS00207914: no agent found
The first task is set as General Task.
The trace from SCOT contains the following lines:
SO28 entry found
Recepient BOR Object
Structure: SWOTOBJID
Technical Recipient: ferudun.atakan-at-ybpcrm.astron.grp
Internal Recipient Found: CRTCLNT304ERMSSUPRT2FERUDUN.ATAKAN-at-YBPCRM.ASTRON.G
Internal Recipient Found: RP                                      <OBJECT>
Address Type: OBJ
Start of Delivery to Internal Recipients
where is the problem?
- ferudun
End of Delivery to Internal Recipients
SUBMIT: TO ALL

Hi Pieter,
Thanks. But my rule policy is simple as stated below.
If
E-Mail orginal recipient contain "contactusatabc.com"
Then
Route EMail ( Organizational Object = Assistant Manager/Executvie ) and
Create Service Request ( Process type = ZR )
Service manager profile ZSRQMROUTING is created and assigned with below services.
1     SVC_PARAMS
5     FG_WEBFORM
7     FG_EMAIL
10     UT_WORKITEMTEXT
50     RE_RULE_EXEC
70     AH_DEF_ROUTING
800     UT_ERMS_REPLICAT
And RE_RULE_EXEC assigned with
DEF_ROUTING     O:50000008
LOG_LEVEL     0
POLICY     ZSTC
Whenever a mail sent from SBWP, recipient as contactusatabc.com" and receiver type is Business Object.
After mail has been sent and ERMS processing log shows sender id as blank ( even my user id maintianed email address in SU01) in tcode CRM_ERMS_LOGGING
compiled Rule: <or><not_contain case="" multivalue=""> <xpath provider="CL_CRM_E
RMS_ADD2FB_DOCUMENT" accessor=""><constant value="/parts/SENDER_ADDRESS/text()"/
</xpath> <constant value="abcatannon.com"/></not_contain></or>
path address:/parts/SENDER_ADDRESS/text()
Kindly advise me incase of any missing configuration.
Thanks
Shan

MSS Time Approval Configuration and Time Approval that breaks from OM Struc

Hi,
Can any one let me know how we configure the MSS for below requirement.
Time Approval Configuration
Custom Relationship Configuration for Time Approval that breaks from OM Structure
Thanks,
HCM

depends on your settings in workflow 'agent determination'.
in sap std workflow the agent for leave approval by default is the 'chief' position holder of an org unit.
so i guess you may want to copy the std workflow into your customer name space and have a workflow consultant customise it to enable the workflow to use the z-relationship object instead of the chief position holder.

I have a workflow transaction which got timeout and escalated to the next level. The comments in the approver's notes are just changed by the system in doing so. For eg: "Moving John under Michael" gets changed into "Moving+John+under+Michael" during the

I have a workflow transaction which got timeout and escalated to the next level. The comments in the approver's notes are just changed by the system in doing so.
For eg: "Moving John under Michael" gets changed into "Moving+John+under+Michael" during the timeout/reminder notification. Any idea ?
-Thanks,
Arun

I have recently started having this problem in PSE8. The Adobe workaround
did work, but I don't fancy having to re register each time I use it.
What I have discovered is that it's nothing to do with the image metadata as it occurs before any image is opened.
It SEEMS to only occur if you use file/open with to open an image in the editor - IE start PSE with that command.
If you close elements down, and start it using programs/PSE/Elements (or your desktop shortcut) - the panorama feature magically works.
Each time I've opened the editor 'automatically' using image/open with, it seems to create the problem.
Hope this helps

Configuration to setup approval for vendor changes and creation

Can anyone help to know where to switch on the approval for vendor changes and creation?

Just a quick thanks that it worked, aesiris.
Also on the that page: https://wiki.archlinux.org/index.php/Po … Management
i2c device power management can be managed with very much the same rule structure:
ACTION=="add", SUBSYSTEM=="i2c", TEST=="power/control", ATTR{power/control}="auto"
Can't for sure say the same for spi devices, since I apparently have none. I'd edit that page, but I can't.

How to Configure E-mail and Chat functionalities

Dear all,
How to configure E-mail and Chat functionalities for IC Webclient.
through IC Webclient ICI interface how can we configure E-mail functionality, As per my understanding, E-mails can be handled in a similar way of receiving phones.
Where these E-mails can be stored?, Where we define agent E-mail id?
being ICI is a multi channel support does it need SMPT server support? If No, would there be any difference in the functionality?
How does CHAT functionality works?
Please educate in above scenarios to get a better understanding.
Your help will be highly appreciated.
Best wishes
Raghu ram

Do you make any effort to search for your answers before you post your questions? ERMS is the email response system
The 2nd post on this board - Documentation for Interaction Center (IC) WebClient
There is tons of stuff here to answer your questions as well as show you the configuration. You need a 3rd party CTI solution to do chat that you will read about in the blog.
SAP Notes
759923 Frequently Asked Questions about IC WebClient
940882 Frequently Asked Questions about ERMS
882653 Frequently Asked Questions about Agent Inbox
1114557 SAP CRM 2007 Internet Browser Releases
1118231 Supported user interfaces for SAP CRM
981710 Support for Microsoft Internet Explorer 7.0
1144511 Blank screen when starting CRM WebClient or IC WebClient
1115493 CRM Web UI: Mandatory SICF services for CRM framework
992848 Mandatory ICF nodes for CRM WebClient UI Framework
IC WebClient Consultant Cookbook for CRM 2005
Online Documentation
Online Knowledge Products
Blog: How to Configure Contact Center Simulator User Interface (CCSUI)
Blog: What is Computer Telephony Integration (CTI)

Problem with workflow to control mitigating RAR to CUP

We have configured in RAR, the workflow to send request for approval of Mitigation Owner using CUP Workflow. For Mitigation Control Using RAR work fine, but unfortunately when we mitigated the Risks through the CUP request, the workflow of Mitigation Control was not started.
Workflow: USER > MANAGER > ROLE OWNER.
Workflow with risk: USER>MANAGER> MITIGATION OWNER> ROLE OWNER (We have problem to send the request for Mitigation Owner).
In the attached file has the details of this problem.
Let me know if you need any other information.
Best Regards,
William Pantaleao

Yes, it is configured correctly misc.
Thanks
William Pantaleã

Self Registration without Company or Workflow approval

Hello,
We have NW2004s SP 10. Is it possible to allow a very simple self registration without using Companies or Workflow approval? The online help seems to imply that this is possible, but I've tried to configure our Portal as such but nothing shows up on our welcome page.
What I've done is the following:
User Admin UI settings:
Enable Self-Registration of Guest Users=true
Display Contact Information Form During Self-Registration = true
All the rest are set to false/blank or default
Visual Admin settings:
Server ->Service -> UME Provider -> ume.logon.selfreg = true
Thanks,
T

You also need to assign the UME Action UME.Selfregister_User to the Everyone group. Use /useradmin to create a UME role called something useful and add the UME action specified.
Now grant that role to the Everyone group.
Cheers

ERM - Workflow Approval Configuration in ERM and CUP

Similar Messages

Maybe you are looking for