Error in Role creation in ERM

Hi Experts,
We are working in demo systems with GRC AC 5.3_10.1.
We are trying to create a single role in ERM. When trying to add Function ID PR01 or PR91, it is throwing error as "unknown error occurred while performing operation (Cannot assign a java.lang.string object of length 57 to host variable 2 which has JDBC type VARCHAR(50), in method insertorgLvlsForRole)". For your information for some functions, it is working fine and some others it is not working and showing the
Until Patch 7.0, it was working fine. unable to analyze the bug.
Can anyone please help.
Regards,
Gurugobinda

Hi Guru,
This seems to be a bug, if you are able to add other functions. You should open a CSS message with SAP so they can fix this in next SP.
In the meantime, you can truncate the function description in RAR to 50 characters and try to add these functions again. Basically, one of the field in function has 57 characters but ERM can only store 50 cahracters in the database. That is the reason you are receiving the error below.
Regards,
Alpesh

Similar Messages

Mass role Import in ERM "unable to determine matching org. level" Error

I am trying to upload the Derived Roles into the ERM. I have already uploaded all the Parents Roles. The volumes of the Derived Roles is huge in my SAP Backend system.
I am not able to understand what should be the content of Org File which we upload. Please correct if I am wrong
1>Example a role Z_TEST_D is derived from Z_TEST on the org levels EKGRP,KOART,GSBER,WERKS.
2>I have run Org Synchronization Job in the ERM
3>Downloaded Z_TEST (Parent Role) and uploaded it into ERM(It was easy because there was no org file)
4> Downloaded Z_TEST_D(Derived Role) through /VIRSA/RE_DNLDROLES Tcode in backend.
5>Downloaded the AGR_1252 information for this role which contained the Org levels and values
6>I put all those information into the Org File and then tried to upload it throws me the error Role Z_TEST_D : not imported; unable to determine matching org. level for WERKSin the system
So I again tried with the another method by changing the input sheet for the Org File
Z_TEST_D BUKRS 0* 9*
Z_TEST_D EKGRP *
Z_TEST_D KOART *
Z_TEST_D GSBER *
Z_TEST_D WERKS *
and tried to upload it again gave me the same error. I have checked the ERM all these Org Levels are fetched into the ERM. I am not sure if I am missing any basic things.
Current Support pack: SP10 Hot Fix 2.
Please share your experience and best practice to upload the roles,

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

ERM ERROR GENERATING ROLE

Hi
I am creating a role and go through all the steps of saving role defination, authorisation, run risk violations, approval and they all turn green but when I run the generate run to have the role created in the backend it ask me for the UME Password and accepts it but instead of generating the role in the backend system it replies with an error message unable to interpret * as a number. In my authorisation I do not have any Star value.
Please help

Hi Bheki ,
Check all these points....
1-Make sure UME userid and SAP Backed userid and Password should be same.
Login into RE with UME userid and password ,before clicking on the genrate button check that same userid and password should be exist in that SAP system in which you are going to provision a new role.
In SAP system this common userid having the role of role creation.
2-Make sure at role defination stage you should not define * (star) character in the Role Name and Profile description field
Please send the screen shots of full scenario to me if its possible at email :- jagat underscore singh @ syntelinc dot com.
Regards,
Jagat

Role creation: how to detect if is ERM or PFCG

Hello,
We are using the ERM module of SAP GRC AC 5.3 SP5. We ar going to create roles through the ERM to the R/3. But is there a way to detect what roles are created by the ERM, and witch ones where created in the PFCG?.
I have seen that the ERM uses de RFC user to create the role, is there an object that can be detected as an creation of the ERM?
Best regards.
Pablo Mortera.

Hi Pablo,
There is a field in PFCG screen which shows the creator of the role, i don't have SAP System with me right now (holidays here !!), but it should be in AGR_DEFINE or in some AGR* table. You can differentiate the roles based on the creator if you are using a separate RFC user ID for ERM connection...that's one of the approach to find out what are all the roles created by ERM..
Cheers !!
Zaheer

JmsQueueConnectionFactory error post user role creation

Hi All,
I installed OIM R2 Ps2 successfully. I tried to create a user , got the error javax.naming.NameNotFoundException:While trying to looup jms.QueueConnectionFactory. But the user got created when i rechecked.
Same error popped up during role creation. But the role too got created.
please help me to resolve this error. I dont know what kind of impact this error will create later.
pls find the below screenshot.
Thanks.

Here is the solution :
The issue was with metadata that has been imported as part of patch deployment (BP06).
/db/ldapMetadata/EventHandlers.xml has been imported with wrong name. Just deleted meta data it start working.
Regards,
Krishna

ERM error: Field ROLE not a member of INPUT

Hi Experts,
After upgrade to 11.2 I'm having this error.
It appears at the Define Authorization stage after I chose transactions and clicking continue.
The connectors and JCos are working.
Please assist.
Thx,
Vit V
edit: All XMLs reloaded and system restarted.
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Current Module: |RE| Conversation: |cnvRole| Screen: |scrSearchTransaction|
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Module#RE#Conversation#cnvRole#Screen#scrManageAuthorization#Action#continueTCodeSearch#
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Changing Screen: FROM: scrSearchTransaction TO scrManageAuthorization
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearScreenRep :   : 6 entries cleared from screen repositiory
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Handler found:class com.virsa.re.role.actions.AuthAuthorizationDataAction
2010-04-20 11:59:05,575 [SAPEngine_Application_Thread[impl:3]_39] DEBUG SAPConnectorDAO.java@365:com.virsa.comp.connectors.dao.jdbc.SAPConnectorDAO.findByConnectorName()connectorId: 5; lngId: 1
2010-04-20 11:59:05,590 [SAPEngine_Application_Thread[impl:3]_39] DEBUG SAPConnectorDAO.java@365:com.virsa.comp.connectors.dao.jdbc.SAPConnectorDAO.findByConnectorName()connectorId: 5; lngId: 1
2010-04-20 11:59:05,590 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.service.sap.SAPConnectorHelper : getClientFromSLD :   : INTO the method SapConnectorDTO :com.virsa.service.sap.dto.SapConnectorDTO@3e0a2020[conClass=,system=COD200,appId=COD200,host=consit-sap,systemNo=00,client=200,userId=codcom,SystemLang=EN,sysId=cod,messageServerGrp=default,messageServerHost=consit-sap,password=xxxxx,type=ECC600,userName=,description=COD200,isSLD=true,isActive=true,isHRSystem=false]
2010-04-20 11:59:05,590 [SAPEngine_Application_Thread[impl:3]_39] ERROR Field ROLE not a member of INPUT
java.lang.Throwable: Field ROLE not a member of INPUT
     at com.sap.mw.jco.JCO$MetaData.indexOf(JCO.java:9534)
     at com.sap.mw.jco.JCO$Record.setValue(JCO.java:14923)
Edited by: Vit Vesely on Apr 20, 2010 12:10 PM

Hi guys,
The problem is finally resolved.
1. Implement SNOTE 1441463
2. Implement SNOTE 1443612
3. Register key for object /VIRSA/RE_OBJ_INFO
4. In SE03 >> Administration >> Set System Change Option. Change /VIRSA/ to modifiable
5. In Se11 open data type /VIRSA/RE_OBJ_INFO in change mode with the key from p. 3
6. Edit structure according to Note 1452772. Save and activate.
7. Implement SNOTE 1452772
8. Restart grc~reear (or the server)
...or wait for VIRSANH patch 12
Hopefully it will work for you aswell.
Kind Regards,
Vit

Illegal Tcodes error while role generation in BRM GRC 10.0

Hi Experts,
I am working on SP11 GRC 10.0.
In BRM, after following all necessry steps for role creation, when I enter last stage "Role Generation" and try to generate it, I am getting error "Illegal Tcodes (system name)" as shown in below screenshot.
I am adding SAP standard t-codes only (e.g. SU53) which are existing in the backend system but still it throws error.
Your suggestion is highly appreciated.

Hi Swati,
Thanks for your reply.
I had already applied note: 1066687 but it didn't resolve my issue.
Note: 1441463 is valid till release 720 and I am on release 731 and SP11.
Thanks
Jayesh

Role Creation in CUP 5.3

Hello,
I'm trying to understand the concept of what is called "role creation" in Compliant User Provisioning.
My understanding is that the "create role" option in CUP (configuration>Roles>Create Role) means simply adding the "attributes" such as a business process, functional area, system, or company, to the SAP roles that you imported into CUP.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
Please tell me if I'm wrong.
HM

HM,
The create role option in CUP is mainly for legacy/non-cup supported systems. This way you can follow the standard workflow process for LDAP/Windows/legacy system. In this user provisioning and role assignment will not be done through CUP and will be manual. This is very important for some companies as they want user to go through same process if they want to get access to any system and not only ERP system.
The below statement is wrong.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
If you don't have ERM then you will have to use PFCG. Once you have CUP, you don't have to use SU01.
Regards,
Alpesh

Idm-Vaau Rbac role creations and mapping

Hi All,
I'm working on the integration between Idm and Vaau's Rbacx (role based access control) tool for role creation and provisioning...I've imported the spml.xml and SPMLGetObjectsform.xml into Idm for the SPML calls between Rbacx and Idm.
The challenge I'm facing is mapping the attributes of Rbacx roles to enable the attributes to be populated in Idm...I'm able to export roles into Idm, but they are not populating with any attributes eg. resource type, resource attribute etc. I'm uncertain as to where I have to map these properties and do any customization for this to work. I would appreciate if anyone who has worked on this or know how to do this, to pls give me some pointers/share your experience. I don't have any documentation to refer to and am doing everything on trial and error basis.
Any help is greatly appreciated!
Thank you.

Hi newbie,
Were you able to solve this issue? I am facing the same problem while assigning resource attributes for a created role using a custom workflow.
This is where I set the resource attributes in my workflow:
<Action id='1'>
<expression>
     <block trace='true'>
     <set><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].valueType</s><ref>ADGroupsValueType</ref></set>
     <set><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].requirement</s><ref>ADGroupsRequirement</ref></set>
     <append><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].value</s><ref>ADGroupsValue</ref></append>
     </block>
</expression>
</Action>
where <ref>ADGroupsValue</ref> contains the attribute value.
thanks,
Lokesh

Approval of role creation

Hi All
I need to create a WET for role creation, this is simple But I need to incorporate approval of the creation of the new MX_ROLE entry. I can only find documentation/guides on how to implement approval of role and privilege assignment. Does anyone know if it is possible to setup approval on creation on a new entry?
Kind regards,
Heidi

I have tried to implement the MX_INACTIVE solution. Now it is not possible to see the role on the "Adminstrate"-tab, and there is an approval task on the "To do"-tab. When I click this task, details on the role are displayed properly, but when I try to process the request by clicking the "Show request"-button (button name translated from Danish, it might be translated differently...) I get an error: "Access denied".
I have set correct approver on the approval task, and I was able to process approval requests, before I set the role to inactive.
On the approval task, I have checked the "Use inactive entries" checkbox.
Does anyone have an idea what could be wrong?
Kind regards,
Heidi Kronvold

Role Import to ERM

Hellow Eperts,
I imported roles to the ERM from SAP ECC, SRM, CRM, BW systems.
When I searched for the roles in the ERM system, all the roles where at the "Derive roles" level instead of "approval" level (or being comleted).
Do you know why did it happen?
Thank you,
Shira Tzur

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

RC-00118: Error occurred during creation of database

adcrdb.sh started at Mon Nov 14 16:16:13 EAT 2011
The environment settings are as follows ...
ORACLE_HOME : /u04/d01/tech_st/11.2.0
ORACLE_SID : JCLONE
TWO_TASK :
PATH : /usr/bin:/u04/d01/tech_st/11.2.0/bin:/usr/bin:/usr/sbin:/u0 4/d01/tech_st/11.2.0/jdk/bin:/usr/ccs/bin:/bin:/usr/bin/X11:/usr/local/bin:/u04/ d01/tech_st/11.2.0/appsutil/clone/bin/../jre/jre/bin:/usr/lib/qt-3.3/bin:/usr/ke rberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbi n:/usr/bin:/usr/X11R6/bin:/root/bin:.
LD_LIBRARY_PATH : /u04/d01/tech_st/11.2.0/lib:/usr/X11R6/lib:/usr/openwin/lib :/u04/d01/tech_st/11.2.0/ctx/lib
Executable : /u04/d01/tech_st/11.2.0/bin/sqlplus
The log information will be written to
/u04/d01/tech_st/11.2.0/appsutil/log/JCLONE_oracle/adcrdb_JCLONE.txt
Creating the control file for JCLONE_oracle database ...
SQL*Plus: Release 11.2.0.2.0 Production on Mon Nov 14 16:16:13 2011
Copyright (c) 1982, 2010, Oracle. All rights reserved.
Connected to an idle instance.
ORACLE instance shut down.
Connected to an idle instance.
ORACLE instance started.
Total System Global Area 1071333376 bytes
Fixed Size 1348968 bytes
Variable Size 427821720 bytes
Database Buffers 629145600 bytes
Redo Buffers 13017088 bytes
CREATE CONTROLFILE REUSE SET DATABASE "JCLONE"
ERROR at line 1:
ORA-01503: CREATE CONTROLFILE failed
ORA-01159: file is not from same database as previous files - wrong database id
ORA-01110: data file 1: '/u04/d01/apps_st/data/system01.dbf'
alter database open resetlogs
ERROR at line 1:
ORA-01507: database not mounted
alter tablespace TEMP add tempfile '/u04/d01/apps_st/data/temp01.dbf' REUSE
ERROR at line 1:
ORA-01109: database not open
ALTER DATABASE RENAME GLOBAL_NAME TO "JCLONE.jtl.co.ke"
ERROR at line 1:
ORA-01109: database not open
ORA-01507: database not mounted
ORACLE instance shut down.
Connected to an idle instance.
ORACLE instance started.
Total System Global Area 1071333376 bytes
Fixed Size 1348968 bytes
Variable Size 427821720 bytes
Database Buffers 629145600 bytes
Redo Buffers 13017088 bytes
Database mounted.
BEGIN dbms_backup_restore.zeroDbid(0); END;
ERROR at line 1:
ORA-01119: error in creating database file
'/u04/d01/tech_st/11.2.0/dbs/MISSING00015'
ORA-27037: unable to obtain file status
Linux Error: 2: No such file or directory
Additional information: 3
ORA-06512: at "SYS.X$DBMS_BACKUP_RESTORE", line 4754
ORA-06512: at line 1
ORACLE instance shut down.
Connected to an idle instance.
ORACLE instance started.
Total System Global Area 1071333376 bytes
Fixed Size 1348968 bytes
Variable Size 427821720 bytes
Database Buffers 629145600 bytes
Redo Buffers 13017088 bytes
CREATE CONTROLFILE REUSE SET DATABASE "JCLONE"
ERROR at line 1:
ORA-01503: CREATE CONTROLFILE failed
ORA-01159: file is not from same database as previous files - wrong database id
ORA-01110: data file 1: '/u04/d01/apps_st/data/system01.dbf'
alter database open resetlogs
ERROR at line 1:
ORA-01507: database not mounted
alter tablespace TEMP add tempfile '/u04/d01/apps_st/data/temp01.dbf' REUSE
ERROR at line 1:
ORA-01109: database not open
ALTER DATABASE RENAME GLOBAL_NAME TO "JCLONE.jtl.co.ke"
ERROR at line 1:
ORA-01109: database not open
Error Running create/replace library with adupdlib.sql
ORA-01109: database not open
PL/SQL procedure successfully completed.
File created.
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - Pr oduction
With the Partitioning, OLAP, Data Mining and Real Application Testing options
exit_code=0
Checking for errors ...
The database has not been successfully created. Shutting down the instance ...
SQL*Plus: Release 11.2.0.2.0 Production on Mon Nov 14 16:16:32 2011
Copyright (c) 1982, 2010, Oracle. All rights reserved.
Connected.
ORACLE instance shut down.
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - Pr oduction
With the Partitioning, OLAP, Data Mining and Real Application Testing options
.end std out.
.end err out.
ADX Database Utility
getConnectionUsingAppsJDBCConnector() -->
APPS_JDBC_URL='null'
Trying to get connection using SID based connect descriptor
getConnection() -->
sDbHost : oracle
sDbDomain : jtl.co.ke
sDbPort : 1524
sDbSid : JCLONE
sDbUser : apps
Trying to connect using SID...
getConnectionUsingSID() -->
JDBC URL: jdbc:oracle:thin:@oracle.jtl.co.ke:1524:JCLONE
Exception occurred: java.sql.SQLException: IO Error: The Network Adapter cou ld not establish the connection
Trying to connect using SID as ServiceName
getConnectionUsingServiceName() -->
JDBC URL: jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracle .jtl.co.ke)(PORT=1524))(CONNECT_DATA=(SERVICE_NAME=JCLONE)))
Exception occurred: java.sql.SQLException: IO Error: The Network Adapter cou ld not establish the connection
Trying to connect using SID as ServiceName.DomainName
getConnectionUsingServiceName() -->
JDBC URL: jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracle .jtl.co.ke)(PORT=1524))(CONNECT_DATA=(SERVICE_NAME=JCLONE.jtl.co.ke)))
Exception occurred: java.sql.SQLException: IO Error: The Network Adapter cou ld not establish the connection
Connection could not be obtained; returning null
-------------------ADX Database Utility Finished---------------
RC-00118: Error occurred during creation of database
Raised by oracle.apps.ad.clone.ApplyDatabase
StackTrace:
java.lang.Exception: Control file creation failed
at oracle.apps.ad.clone.ApplyDatabase.<init>(ApplyDatabase.java:661)
at oracle.apps.ad.clone.ApplyDatabase.<init>(ApplyDatabase.java:328)
at oracle.apps.ad.clone.ApplyDatabase.<init>(ApplyDatabase.java:304)
at oracle.apps.ad.clone.ApplyDBTier.<init>(ApplyDBTier.java:154)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstruct orAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingC onstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:501)
at oracle.apps.ad.clone.util.CloneProcessor.run(CloneProcessor.java:68)
at java.lang.Thread.run(Thread.java:595)
Current database Version is 11.2.0.2
Apps Version is 11.5.10.2
RUP version is 6
Forms Patchset version is 19
Please advise how to resolve this error ?
Regards
Mohammed.

Please refer to these docs/links.
Troubleshooting RapidClone issues with Oracle Applications 11i [ID 364565.1]
Adcfgclone.pl DBTier is failing with error for dbms_backup_restore.zeroDbid(0) [ID 361157.1]
https://forums.oracle.com/forums/search.jspa?threadID=&q=ORA-01503+AND+ORA-01159+AND+ORA-01110&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
Thanks,
Hussein

Error occured during creation of oracle snapshot

Dear All,
I am getting error messange in my SAP Inbox in t.code SBWP.
In SBWP, the nessage text is as follow.
=============================
Error occured during creation of oracle snapshot (Creation aborted)
(Log see also transaction SLG1, Object ORASNAP, Subobject ORASNAPCR)
Oracle snapshot creation program aborted
Error while copying from oracle view to SAP table
Oracle view SAP$KCBFWAIT
SAP table ORA_SAPKCBFWAIT
Return code (ORA-....) 942
You tried to work with the name of a table or view that does not exist in the database
The table does not exist on the database. A table name or view name was used that does not exist on the database.
===============================
I also check in T.Code SLG1, but i am not getting the reason for this error.
Regards,
Nisit

Hi,
Check each of the following :
the spelling of the table or view name.
that a view is not specified where a table is required.
that an existing table or view name exists.
Contact the database administrator if the table needs to be created or if user or application privileges are required to access the table.
Also, if attempting to access a table or view in another schema, make certain the correct schema is referenced and that access to the object is granted.
Regards
Krishna

Error during PO creation "Total BED % rate exceeds 100 % "

Hi.
Its concerned to Indian Excice.
Error during the creation of PO is " Total BED % rate exceeds 100 % " ,
( Message no. 8I453).
And you pls note in J1ID its 16% maintained for that perticular chapter id and its 100% for BED in tax code.
Can you pls tell me the reason for this error.
Regds

Hi Santosh,
362 is not maintained for BASB,but its maintained for condition type JMO1(IN:A/P BED Deductable) & JMO2(IN: A/P BED non deduct )in <b>AltCTy</b> field.
And For BASB 605 is maintained in the field AltCBV.
Can you Pls explain the significance of this alternative calculation type.
Regds

Error in Jcos creation

Hi all,
I am getting an error in Jcos creation.This is tyhe error I am facing.I checked evrything.Evrything seems ok.But i am getting the belwo error.
com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION: Connect to message server host failed Connect_PM TYPE=B MSHOST=zimssap GROUP=PUBLIC R3NAME=PRD MSSERV=sapmsPRD PCS=1 ERROR timeout while pending for route completion TIME Tue Jan 06 20:21:50 2009 RELEASE 700 COMPONENT NI (network interface) VERSION 38 RC -12 DETAIL NiErrSet COUNTER 1
I configured sld so many times but never faced this issue.Some starnge error .Timeout oending for route completion.Please let me know what could be the problem?
Thanks and reagrds,
Rajesh

Hi
com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION:
RFC_ERROR_COMMUNICATION | Unknown host
RFC_ERROR_COMMUNICATION - time out
Thanks,
Tulasi

Error in Role creation in ERM

Similar Messages

Maybe you are looking for