Error In Derived Role

Hi,
We are implementing SRM5.0
We have prepared Derived Roles copyed with Standard Roles for testing and added the Objects and T.Codes.
Role created -->        ( B_D_SRM_PURCHASER_M51     )
Once we logged in with the user ID with this role the next screen show the following error.
Kindly help me make me understand where I need to do the correction for the same.
ERROR
Runtime Errors         ITS_ERRMSG_EXCEPTION
Short text
    Error message occurred.
The ITS service "bbpstart" had to be terminated because the Web AS has sent
the following error message:
Error message: " You are not authorized to use Transaction BBPGLOBAL"
Message type: "E"
Points would be awarded for help
BR,
Vijay Mittal

Hi,
What is your support package level of SRM_SERVER. If you are havining SRM_SERVER 550 and package level SAPKIBKT07 then you will get ITS_ERRMSG_EXCEPTION
Please upgrade ypur support pakage.
Reason for this dump: You use the browser to work with the Supplier Relationship Management (SRM) system. In some cases, "ITS_ERRMSG_EXCEPTION" error pages are displayed (if you are using the integrated SAP Internet Transaction Server ITS 6.40 or 7.00). For example, this occurs because the user has no authorization for this transaction. However, the user does not immediately see what the problem is.
And you can ignore this message as well if you are not getting any complain from customer side.
Please find SAP Note: Note 1129873 - SRM template for SAPMSYST_40 (2)
Regards,
Krushna Biswal
Edited by: Krushna Biswal on Aug 18, 2008 8:50 AM

Similar Messages

Error while uploading R/3 Derived Role into EP

Dear all,
When i was trying to upload the derived role from backend R/3 system. It's giving following error.
com.sap.portal.pcd.rolemigration.RoleMigrationException: Nested Exception. Failure to execute native function. Nested Exception. ROLE_IS_DERIVED - message at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(HQ1CLNT230,en_US,pradeep,TWPN_GET_ROLE,ROLE_TABLE,{ENABLE_LOGGING= , ROLENAME=ZR:GT_CUSTOMER_001, MENUTEXTS_ONLY_IN_MASTERLANG= }): Check parameters. Nested Exception. ROLE_IS_DERIVED at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:244) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:1699) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:769) at com.sap.portal.pcd.rolemigration.RoleMigrationThread.run(RoleMigrationThread.java:488) Original exception: com.sapportals.connector.ConnectorException: Nested Exception. ROLE_IS_DERIVED at com.sapportals.connectors.SAPCFConnector.SAPConnectorException.getNewConnectionException(SAPConnectorException.java:67) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:318) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:411) at com.sapportals.connectors.SAPCFConnector.execution.functions.SAPCFConnectorInteraction.execute(SAPCFConnectorInteraction.java:433) at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:403) at com.sap.portal.pcd.rolemigration.util.Connector.callFunction(Connector.java:148) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:1699) at com.sap.portal.pcd.rolemigration.RoleMigrationObject.migrate(RoleMigrationObject.java:769) at com.sap.portal.pcd.rolemigration.RoleMigrationThread.run(RoleMigrationThread.java:488)
Kindly Suggeset me
Rgds
PRadeep

Pradeep,
Kindly explain the process flow of your upload.
James

Missing Master and Derived Roles

Hello All,
I have got an odd scenario and I am hoping some of you might have run into the same issue or might point me to the right direction.
Back ground
We are on ECC 5.0 and have Master Derived Concept, and then Derived Roles are grouped in Composites
We recently( Last week ) created some ( say 34 ) Derived roles and some (10) composites using a combinition of the newly created derived and some Old derived roles.
Transported The derived seperatly and Composites seperately. Transports went successfully into QA and PRD.
This week we noticed that all of the 34 derived roles are missing in DEV ONLY along with 28 Master of the 34 Child Roles. All the Childs and master still exist in QA and PRD.
We have tried to look up the change Doc of the missing roles or the profiles or the authorizations of the missing roles and there is no change log under suim. Change Log shows when the role was created but nothing after that. According to Basis transports does not have any unusual log
Since its a DEV system so no delete transports have come into DEV, therefore delete transport could not be an option.
I have also uploaded one of the missing master roles from the PRD to DEV and it is succfully established the relation with the childs. I was hoping it might shake up the Change History regarding missing role but it did not, It now shows when the role was created earlier( 2006 ) and This week agian but no Delete History
Any Ideas on how to explain this behavior

Another possible and imaginable human error worth looking into is that at some stage in the past a transport request was created for the master and child roles -- okay.
Then the child roles were "broken" by changing org. levels and other fields in the authorization maintenance, so the roles themselves were deleted with the intention of creating them again from one of the "template" child-roles --> okay, seems reasonable to have happened.
Then (here is the problem!) someone released the transport before the new child roles were created. This is interpreted by the system to be a deletion transport of roles.
Additionally the sequence of the transports might have added additional obscurity to the issue and now, much later on, someone imported the transport into production which deleted the roles.
<conspiracy_theory>
The person then deleted the transport request from the queues and archived the change documents in SU83.
</conspiracy_theory>
Cheers,
Julius

Mass Role Import of derived roles.

Hi All,
I am trying to mass import derived roles. I have created the files Bulk Download File, Role Expert Information File and Primary Org Level File.
All these files are tab delemited text files.
But when i am uploading, it gives me error on Primary Org Level file format is incorrect.
Please suggest me on file format of Primary Org Level. We are on Role Expert 5.2.
Format I am using is
ROLE NAME<TAB>DERIVED ORG LEVEL<TAB>FROM VALUE<TAB>TO VALUE
My To Value is blank.
Thanks in Advance.
Regards,
Pravin

Hi Alpesh,
I was able to upload all the derived roles. What i found was that, there is a limitation on number of rows for primary org value file. It could be limitation of RE 5.2 SP9.
Whenever, primary org value file use to exceed 500 rows, it gives format error.
So, then i restricted the primary org value file within 500 rows & upload went smoothly.
Now, there is one query.
Is it possible, that all the roles which are uploaded can be set to phase generated.
Please suggest.
Thanks in Advance.
Regards,
Pravin

'Protecting' your derived roles from being maintained on object level

I'm redesigning an authorization concept that has been polluted in the past by maintaining object level values in the derived roles instead of the master roles.
Now I would like to build in a kind of warning or authorization so that future role administrators can adjust master roles on object level, and derive the roles from the master, but are not allowed (or get a warning) to change object level values in the derived roles themselves.
I'm looking for a warning similar to the warning you get when you are trying to change an organizational level value within the object rather than change the orglevel table.
I have looked for entries in table PRGN_CUST, but found none.
Also, the authorization checks for deriving roles [seem to be similar|http://help.sap.com/saphelp_nw04/helpdata/en/2b/84653f1b76b11ae10000000a114084/frameset.htm] to actually maintaining a role, so no distinction can be made here.
Knowing al this, II think the answer is: 'no, this is not possible' but if you have dealt with the same problem successfully, please let me know.
Kind regards,
Lodewijk Borsboom

Hi Lodewijk,
There are exit paths in SU01 and PFCG which might (have) help(ed) but SAP removed the documentation on them because as (to my knowledge) as the code was integrated into BAPIs and org. management these exits (like many which have gone before them) caused no end to confusion over time.
I heard that they would at some ponit be replaced by BADI's but I guess the same problem exists there and I have to date not seem any of them released.
I have the documentation if you are interested but which release are you on? I suspect that SAP might even remove the exit coding anyway.
As the other's have stated, I would also go for a detective control. You can always wipe the mistake out again from the master and this will let you know that someone is not sticking to the rules or doesn't understand the concept.
This is also an advantage when compared to an error message or warning which only they see...
Cheers,
Julius

Check status for Derived role generation

Hello,
We are trying to place a check to validate and ensure that the child roles are generated using "generate derived role" (CtrlShiftF4) from the parent role. However, i'm not able to find an appropriate function module or table field via which this can be checked.
Are there any options to check this?
Thanks in advance
Vijaya

Hi,
You can find the status of the roles whether the profile is generated or not .. with PFCG only.
PFCG
-> Utilities (M)
-> Overview Status (CtrlShiftF11)
Give the role names (for which you need to know whether they are generated or not)
Tick/select - Only Display Roles with Errors and Warnings
-> Execute
It will display all the role names and profile name and their status green generated, yellow not generated. If you copy all data and paste it in the excel it would be like below...
ZS_ECC_NPR_AFM_TESTING_GL @IC\QSingle Role@ 11/20/2011 12:47:32 VKUMAR @5C\QNo menu exists@ @5D\QCurrent version not generated@ ZNPRAFMTES @5D\QUser master record not completely updated@
ZS_ECC_NPR_DATABASE_ADMIN_GL @IC\QSingle Role@ 08/02/11 18:02:26 MMAKUCH @5C\QNo menu exists@ @5B\QAuthorization profile is generated@ ZNPRDTBADM @5C\QNo users are assigned@
Hope this helps you.
Thanks,
Vinod

ERM: Importing Derived Roles Problem

Hello All,
It appears that if I download and mass import 1 derived role at a time, the ERM mass import works perfectly. But, if I download the same successful derived roles and import them together, the ERM mass import does not import all the role details. Instead, it drops the role description and long description.
This problem occurs if I upload 2 or more derived roles at a time.
Any ideas?
System Details: GRC AC SP12, VIRSANH 12, VIRSAHR 10.
-Dylan

Hi Dylan -
We have found a work around for this, but before I list the steps let me not be presumptuous in my explanation as you must have both the parent roles uploaded in ERM in addition to updating the "Primary Org. Level File" with the appropriate data prior to loading the derived roles.
Upon downloading the derived roles from the backend, 3 files are exported [Bulk File, Info File & Org File] and this is true for all roles that are exported. However, only when derived roles are exported will the Org File be populated with data (i.e. role name). This makes sense because the only time this Org File is needed is when you import derived roles, all other roles only require the Bulk & Info File.
Our guess was the way it was supposed to work is that the Org values were supposed to be exported into this file with the role names, however the Org Level & Value fields are blank. We tried multiple combination of populating this file, but continued to get the same import error. We eventually figured out a way to update this file to pull in all of the Org level data:
*NOTE we found the most success with Mass Import files with the following extension: Bulk - .txt, Info - .xls, Org - .xls
As stated before, the derived role Org file auto-populates the role names that were downloaded. In the 'Derived Orl Level' & 'From Value' fields you need only populate the first value from the 'AGR_1252' table listed in the Bulk file.
Example:
In the Bulk file we have a role: ZD:HR_AT_ANALYST and the first value listed for line AGR_1252 is the client number+role name then the Derived Orl Level and Value. So we populated our Org file to look like this.
Role Name                                         --->>>    Derived Org Level         --->>>    From Value
ZD:HR_AT_ANALYST                    --->>>   KORSS                           --->>>   NRPC
ZD:HR_BN_PAYROLL_DSPLY         --->>>    PERSA                         --->>>      *
ZD:HR_PY_AT_ANALYST                --->>>   BURKS                         --->>>      NRPC
If the file is populated this way, somehow it magically picks up the remaining Org Level Data for role when loaded. So the file does not have to actually have all of the values for each role. I can be tedious to sift through the bulk file for the values, but there are quick ways to do it in excel.
Hope this helps,

Error while deriving the currency from table

i am getting the below error while simulating the payroll for india.
Error while deriving the currency from table T001P & Error during Initialization of payroll.
i am SAP HCM Trainee.. practicing at home.

Pls check the currency in table T500C.
You can use TCode OE00 for table maintenance T500C.
Also check whether currency is there in table V_CURC and T510.
Hope this will help.
Regards
Ghouse

Error while deriving the currency from table T001P.

Hi Friends,
I am trying to run payroll for NZ using schema NZ00 but i am getting an error stating "Error while deriving the currency from table T001P. Error during initialization of Payroll"
I have checked V_T001P, V_T001 and have deleted the personnel area and subarea and again created it but still i am unable to solve this problem.
Could you please help me as to where this error can be corrected.
Thanks,
Manj

About the incidence, the problem might be related to the links between
personnel area, company code and currency set up (table T001P, T500P and
T001).
Please check the following points:
1- Have you assigned the Personnel area to the Company code under SPRO -
IMG -> Enterprise Structure -> Assignment -> Human Resource Management
-> Assignment of Personnel Area to Company Code.
2- SPRO -> Personnel Management -> Personnel Admin -> Basic Settings ->
Determine Currencies (Public Sector Currency Need to be maintained along
with the other node).
3- SPRO- Personnel Management -> Personnel Admin -> Payroll Data ->
Basic Pay -> Define Hourly Rates for several decimal places. (Please
maintain all the nodes).
4- Maintaining the table t500c through transaction code OE00.
Regards
Ramana

Error while deriving the currencyfrom table T001P for International payrol

Dear Experts,
when i run the payroll in simulation mode. im geting an error msg as ' error while deriving the currency from table T001P'
I have checked all PA assignement with compnay code and country grouping (molga =99), which is correct and also i have checked all bellow tables.
V_T510F_B
T500W
T500C
Transaction code OE00
In Trasaction code OE00, system not allowing me to give the currency (LKR - Srilankan Rupees). its giving an error msg as ' maximum of 2entries are allowed for each country in table T500c'(Its not alowing me to save it)
I dont knw how to over come from this issue.
I have chnaged the company code and tried but still im getting the same error while running the payroll.
Any idea from Anyone....?
Regards
Dinesh.

HI Mohan,
Thz for your reply.i have checked all tables which u have mentioned. but currency (LKR- Srilankan Rupees) has been assigned.
In V_CURC.. there are no 2 entires. but when i try to assign the currency in T-Code OE00. its giving an error msg " A maximum 2 entries are allowed for each country in Table T500C"
I have tried to make one more intry in the same table and the same currency then its giving an error msg as " An entry already exist with the same key"
V_TCURR is currency exchnage rate... Is it necesory?
Thz,
Dinesh.

Error while deriving currency from table T001P

Hi All,
Error while deriving currency from table T001P
I am getting this error while payroll run by using country GRP=99 in SU2 for Non-SAP supported country.
I assigned country grouping as 99 in V_T500P table while assigning comp code to personnel area.
The company code is assigned with BD as country key in configuration and currency as BDT.
Referring previous links for the same error I checked all concerned tables and maintained correctly.
What will be the probable reason of this error?

Hi,
I had the exact same problem a while back. The problem was that in V_T001 I had a different comp code which was either assigned to the same country that had a blank currency or assigned to the same currency but was missing the country. It was a different comp code than the one I was running payroll for so it took a long time to find the cause - I'll bet this is what's causing your error.
Rgds,
Kristopher

Error in Derivation and Profitability Segment

Hello Gurus,
I am two issues, which isnt allowing me to create a sales order in IDES.
I am referencing a quotation when i want to create the sales order. But i got a warning message 'error in derivation rule' and the log text has
                                                                                Error occurred in derivation rule. See long text
Message no. K/ 111
CO-PA Characteristic Derivation
Diagnosis
Step 0006 Country Ship-to   > Intern.Reg
No entry in a derivation rule was found for the specified source field
                                                                                The derivation rule was set up so that an error message appears when
     this happens.
The required derivation rule entry would need the following source
     fields:
Country Ship-to
I proceeded and the sales order couldnt save. An incompletion log pointing towards the profitability segment was generated. I have put the profit center, yet i have this issue.
Kindly help resolve it.
Thanks

Hi Luqman,
This issue is realted to the COPA Issue.
Please Try by giving the Profit Center at sales order Header by giving the Derivation rule and most important thing here is we have to mention the country of ship to here.
Please Reward IF Really Helpful,
Thanks and Regards,
Sateesh.Kandula

Little Challenge --How to give or restrict TRX in derive roles !

Want to give 10 trx in 2 derive roles and 15 in another 2 derive roles from same Parent role-Any method to do so?One I know is to give additional 5 Trx access through manually Adding TCD in remaning 2 derive roleANY other way to give or restrict so that tabs should not be in manually or changed mode?

>
ARYENDRA DALAL wrote:
> so that tabs should not be in manually or changed mode?
Hi,
Excellent answer from Juluis. Also the way you want to do this is conflicting with the Ref-Derive role concept.
I can add/modify some thing to the previous two answers.
One point I want to make clear that you mentioned as quoted above. Do you mean to say that the S_TCode will not be in changed mode (_or_ need not to add S_TCode manually) in Profile generator?
If Yes, then please check the following approach:
1. Create your first parent role and pair of derived roles with 10 Tcodes.
2. Create one role as per the concept of Transaction role - value role. That means, the role will contain those 5 TCodes in the menu but will not contain any authorization (except S_TCODE, all objects should be deactivated).
3. Then create one composite role with these two (one derive role of the pair and the other single role).
if No, then follow this approach:
1. Follow step one of above.
2. Create one generic role without any menue entry. Add TCode manually in authorization tab and then 5 TCodes there.
3. Create another role (value role) [let me know if you need details concept on this] and maintain the authorization of those 5 TCodes here together with org. values.
4. Create composite role by using these three roles (one derive role from the pair, one generic transaction role and one value role).
But please note that the menue entry should not be maintained in the derive role in any circumstances and if you do then you are no longer maintaining SAP Ref-Derive role concept.
Please let me know if these help you to some extent.
Regards,
Dipanjan

Risk Analysis of derived role is not able to fetch organisational values.

Dear All,
We have run the Permission level analysis in GRC 5.2 for the ROLES at permission level and
found that the tool is not reading the ORGANIZATION VALUES maintained
in the derived roles.
We had explored in the GRC tool & found that the field BUKRS,KOART,etc
are ENABLED in the RULES.While the CC tool is fetching value of other authorzation object.
Please Advice if there is any configuration settings required.
For your reference I am pasting the part of report.
Medium     F_BKPF_KOA : Accounting Document: Authorization for Account Types     ACTVT : Activity     Create or generate
Medium     F_BKPF_KOA : Accounting Document: Authorization for Account Types     KOART : Account Type     $KOART
Medium     F_BKPF_BUK : Accounting Document: Authorization for Company Codes     ACTVT : Activity     Create or generate
Medium     F_BKPF_BUK : Accounting Document: Authorization for Company Codes     BUKRS : Company Code     $BUKRS
Thanks,
Sandeep Bhatia

Hello Sandeep,
Doing Org Lvl Analysis is not so simple in RAR.
Firstly this is only user based.
For using it you will have to schedule one job in configuration which will update Org Values for users in the database table. I don't remember name of this Utility however it will be something Orguser, just search in Configuration tab.
As mentioned by you, org lvl are already enabled and make sure there values is $.......,
Reason being Org Rules will be generated at runtime and then anlysis will be done.
It will be better you take help of SAP on this. As they have document which will be very helpful to you.
Regards,
Surpreet

Master role and derived role concept

Guys,
1) How to assign the organizational levels for the derived role?
Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
Greatly appreciate for some body's help.

> 1) How to assign the organizational levels for the derived role?
> Say for example, I have to create the derived roles with respect to the plant code.And after inheriting the tcodes ,authorizations from the master role , I noticed a pop up page with organizational level tabulation and I assigned the respective plant code there and in the same way for all the following derived roles.But the rest of the rows like company code,sales organization,distribution channel etc which are seen in the tabulation are left empty.I noticed that all the fields which are left empty in the org.levels of the derived roles are been filled up with the vaules of the corresponding master role org.level values when the derived button icon , which is seen under the authorization tab of master role is pressed.So pls let me know the correct procedure to assign.*Do we really need to maintain org.values for master roles?*
Only if you assign the master roles to users. (and maybe for testing, see 3)
>
> 2) If a master role is transported to QA or PRD, will the derived role along with it move automatically?
Nope, but if one of it's derived roles is transported the master is automatically included in the transport. You'll have to make sure all derived roles are transported yourself.
>
> 3) Is master and derived role tested parallely in the QA system or first master role is tested ,followed by the derived role?
Best order is to do all unit testing wit the master, with all org levels at * and create the derived roles only when the master is tested and corrected to satisfaction. In that way the derived roles only have to be tested for organizational shielding.
>
> 4) According to my understanding we dont assign any user to the master roles, but why do we move it to PRD?
See 2, it goes there automatically. No choice.
Jurjen

Error In Derived Role

Similar Messages

Maybe you are looking for