GRC AC 5.3 Documentation

Hello,
We are going to implement GRC Access Control 5.3 to our client, Can anyone provide me Business Blue print for the GRC Access Control 5.3? or is there any link where i can download it.
Thanx in Advance
Regards,
Rayudu

Hi
I can give you the link for GRC AC5.3 project plan,
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/b00a372f-ddb7-2b10-88aa-d6eaae69a756
Thanks,
Sudip

Similar Messages

What are the roles & responsibilities of GRC/SECURTIY CONSULTANT IN IMPLE

HELLO EXPERTS,
CAN U PLS TELL WHAT ARE THE ROLES & RESPONSIBILITIES OF GRC/SECURITY CONSULTANT IN IMPLEMENTATION OF GRC TOOL.
REGARDS,
SANJAY

Hi Sanjay,
The role of GRC & Securtiy Consultant is basicly the implementation of GRC Application in Customor envoriment. In most of cases he gives technical support for installation and configuration. What we are really do is following..
1. Preperation of System Landscape Concept --> Provide Hardware and Software spesifications to customer
2. Installation of Software Components --> This contains the installation of NW and GRC Components and also the installation of SAP Backend Components like Real Time Agents and the post-Installation configurations
3. Post-Installation and Basic Configuration --> Create Connectors and additional basic configurations
4. Hosting of Workshops for Risk Creation and Ruleset customizing
5. Implementation of Custom defined Rules in the Application
6. Test of Applications
7. Hostin of Workshops for Approval Methodology and Workflow Use Cases
8. Hostin of Workshops for Superuser Role Usage and Management of Superuser
9. Role Change and Creation Workshops in GRC ERM.
10 Documentation and Deliver of Custom Concepts for Compliant User & Role Administration
11. Handling of Error and Trobles.
this are my daily business...
Best Regards.

Problem with Edit option for a role created in GRC 10.0

Hello Experts,
I created a role in GRC 10.0 , I see my newly created role in the list of roles . If I want to Edit the role I select the row and click " OPEN" and edit the role.
But when I click the role directly and enter the role , the "EDIT" button is disabled and even maintain authorization button is disabled.
Did SAP defined in such a way that we should selct the role and click OPEN then only we can Edit or is this a Bug??
Please let me know if any one of you faced the same problem.
Regards,
Jagadish Bhandaru

Hi,
Sabita is correct.
Here is the link to the documentation
SAP Access Control 10.0
Simon

Processo NFE - Biztalk GRC

Bom dia a todos, estamos implementando NFE e gostaria de saber se alguem ja passou por algo parecido.
Iremos partir de um software em VB que ira enviar para o GRC via biztalk...alguem ja passou por essa situação? Gostaria de saber como o BIztalk irá startar, se possivel também, as RFC.
Obrigado,

Henrique,
Voce teria alguma documentação ou link referente a interface SOAP to RFC.
Como eu disse anteriormente, temos o seguinte cenario
Biztalk -> SAP GRC/PI -> Sefaz..
Preciso entender melhor a configuração necessária para a realização desse processo.
Obrigado mais uma vez.
Vinicius

New User Request cannot be submitted in GRC AC 10

Hello Gurus,
We have configured GRC AC 10 along with workflows and for all scenarios things are working fine , except for "New User".
When we select
Request Type : New Request
Request for: Others
User : XYZ (This user is not present in "HR system(ERP system)", which is our data source for User search, user details & authentication)
and we select certain roles to be assigned to the user.
Then when we click "Submit Button" , it gives us an error , XYZ is not a valid User
In SPRO under CUP --> Maintain Provisioning Settings
For Global Provisioning under
"Create User if does not exist"
i have selected both "check boxes" for
1) For Change User Action
2) For Assign Role Action
Also in System Provisioning, i have ticket the option "create User".
Note: Under Data Source Configuration i have selected "End User Verification" as Yes.
Will you please provide your inputs on what could be the reason for getting this error .
Regards,
Victor

Hello Sabita!
Sabita Das wrote:
The system should validate in both cases whether User ID exists or not. It was working fine in AC 5.3 later patches.
If you want to validate against LDAP, SAP or other datasource, you should set this parameter to "YES", but in this case you have to make sure that the user exist there. If the parameter is set to "no", no validation takes place. If you want to create the user if the user doesn't exist in the "change account" request, you have another option to do it: Maintain Global Provisioning Settings --> Create User if does not exist
> In new account, we are able to create a request for a User ID which already exists.
This is not documented as a controlled in the parameter 2051. Is it a missing functionality??
Cheers,
Diego.
Edited by: Diego I. Yaryura on Feb 8, 2012 12:23 AM
Edited by: Diego I. Yaryura on Feb 8, 2012 12:26 AM

Problem with RFC for Risk Terminator - GRC 5.2 SP12

We are having a problem with the RFC connection for Risk Terminator in one of our SAP environments. It is working in our 'DV3' environment, but not in our 'RT3' environment. Everything is set up just the same in both environments and all SAP Adaptors show green.
This was working in RT3 when we first upgraded to GRC 5.2 last November, but it now gives me an error when I do an update with PFCG and it calls RT. The error message and our Basis support group both say the RFC needs to be 'registered', but our SAP Support contact during our upgrade said it does not, and I can't find any documentation that says this is required also. Plus it was working before even though it was unregistered.
What is causing this problem and how do I resolve it?
Also, if these RFCs do not have to be registered, is there some documentation that states this that I can show to our Basis group?
Thanks.

What about the question of the RFC needing to be registered? This is the solution our Basis group thinks is required, so it will be hard to get them to do anything else until this issue has been addressed.
Thanks.

Significance of BC Set Activation for GRC AC 5.3

Dear Members,
Request you to please help me understand the significance of the BC Set Activation in an HR implemented ABAP system,
w.r.t. AC 5.3
The AC 5.3 runs separately on the a java instance and connected to ABAP with the help of JCo's.
Kindly assist, if you have any clue regarding the documentation for the same.
I want to understand, the criticality of activating the VIRSANH and VIRSAHR BC Sets on ABAP side for the proper functioning of the GRC AC 5.3 and if their is any variation in the results of GRC , if the BC Sets are activated/ or if not activated.
Many Thanks !
Regards,
Edited by: Molwana Lokisang on Feb 2, 2010 11:02 AM

Molwana,
the BC Set needs to be activated as part of the post-installation process. It will also provide you with data that the RTA needs to work.
I have done this for many customers, there is no risk involved. All the "extra" data is in a separate namespace.
Frank.

Automatic Creation of Roles and Role Mappings in GRC

Hi,
we are planning to use SAP Identity Management and SAP GRC Access Management.
In SAP IDM we have defined several business roles that contain privilieges in SAP systems. When a user is requesting a role, the request will first be sent to SAP GRC for approval and risk checking.
In order to get this to work, we need to load the business roles of SAP IDM into SAP GRC and we also need to configure the role mapping between the business roles and the technical SAP privileges.
From what I understood, this could be implemented by loading the required information via Excel filles into SAP IDM.However, this is a quite cumbersome and error-rpone approach an we would like to automate this.
Is there a way to use e.g. web service calls to create/delete roles and role mappings in SAP GRC?
BTW: is a documentation of all available GRC web service calls and their parameters available?
Thanks for your help in advance!
Best regards
Tom

Hi Tom,
as stated before, the web service description is in the config guide.
Unfortunately there is no web service to create roles or even mappings in CUP - this is one of many I would also like to se created
I don't think in your context you will be able to directly send Business Roles to CUP. The role mapping only happens after you send the request, so I'm not sure if that's in time for risk analysis - you will need to try that.
Are you a customer or a consultant - anyway, feel free to contact me if you need further help integrating CUP and IdM. This is an evolving interface with many possible scenarios, so it's not easy to give you good advise without seeing the full picture.
Frank.

Connect CUP (in GRC 10.0) with ABAP CUA

Hi ,
Has anyone a short guide how to connect the CUP in GRC 10.0 with an ABAP CUA?
We would like to use the CUP to trigger the CUA for the deployment of the CUP assigned authorisations.
Thank you in advance!
Br,
Frank

Hi Frank,
There is one for SAP GRC 5.3 that you can access with the below link:
http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/80ee8c81-7812-2a10-ce91-e1be55f43491
The GRC AC10 documentation is not available.
May be this can be an input for the BPX team to create one
Regards,
Raghu

Problem with Role import in GRC 10.0

Dear GRC Gurus,
I want to import roles from backend to GRC 10.0 system. for this I am using NWBC.
In NWBC --> Access Management --> Mass Role Maintenance --> Role Import --> in this age below OPtions are selected:
Role Selection --> Technical Role
Import Source: Role Attribute Source: User Input, Role Authorization Source: Backend System
Definition Criteria:Application Type: SAP, Landscape: nothing is shown in the dropdown, Source System: nothing is shown in the dropdown
Without Defining Landscape and Source system I cannot proceed further
Please advise why the system is not showing up the values in the dropdown.
I have maintained role status as production in SPRO.
I appreciate your help.
Thanks,
Swathi

Hi,
Sabita is correct.
Here is the link to the documentation
SAP Access Control 10.0
Simon

Best practice for the Update of SAP GRC CC Rule Set

Hi GRC experts,
We have in a CC production system a SoD matrix that we would like to modified extensively. Basically by activating many permissions.
Which is a best practice for accomplish our goal?
Many thanks in advance. Best regards,
Imanol

Hi Simon and Amir
My name is Connie and I work at Accenture GRC practice (and a colleague of Imanolu2019s). I have been reading this thread and I would like to ask you a question that is related to this topic. We have a case where a Global Rule Set u201CLogic Systemu201D and we may also require to create a Specific Rule Set. Is there a document (from SAP or from best practices) that indicate the potential impact (regarding risk analysis, system performance, process execution time, etc) caused by implementing both type of rule sets in a production environment? Are there any special considerations to be aware? Have you ever implemented this type of scenario?
I would really appreciate your help and if you could point me to specific documentation could be of great assistance. Thanks in advance and best regards,
Connie

GRC AC 5.3 Logging strategy in multi server nodes

Hello Experts,
We have GRC AC 5.3 SP6 and 5.2 10 landscapes and PRD system are running with multiple server nodes. SAP recomends to use SAP Logger instead of Java Logger in multi server environment, but i am not able to find out complete documentation on this.
Can someone please give pointers on configuring GRC logging in NWA - which all Categories needs to be defined,etc,etc.
And after this configuration, will we be able to see the logs of scheduled jobs with same details as shown in GRC --> Background Job -> View Logs.
Thanks
Davinder

Hello Harleen,
Thanks for your time. Here are my observations
1. When we have created categories and then deinfed Logging and Tracing (with Severity level ALL) in NWA - these entries have also been reflected in Visual Administrator -> Log Configuration.
2. We will have to restart SAP system after changing logging strategy from Java Logger to SAP Logger.
3. After this change and restart, only upcoming new jobs scheduled/run will be displayed in NWA, jobs ran in the past will never be displayed in NWA.
Severe Problems faced when checking logs through NWA:
1. Logs through NWA are not at all readble as one entry is displayed in one row, whereas checking logs in RAR - VIew Logs was very convenient (similar to reading a text file).
Is it possible to customize the display format of log files in NWA to something like text files,etc?
2. When we try to donwload the logs from NWA, server produces huge dumps files of size in GBs (hpfa files which are memory dumps) - and before this download is completed - server crashes after around 15 minutes of starting log downloads - no free space availbale as everything has been taken by these memroy dumps (around 7GB).
Any further pointers on handling GRC AC logs (multiple server nodes) in NWA would be highly appreciated.
Thanks
Davinder

GRC 10 Upgrade:unable to install the add-on

Hi all,
Here I am facing another problem. I am basically working on SAP NW 7.3 ABAP. I have downloaded the
*51039481 SAP Access Control/SAP Process Control/SAP Risk Mgmt 10.0 * zip file from SMP. My backend system is SAP NW 7.0. For that, I have successfully installed add-on GRCPINW_V1000_700_INST -> K-103AGINGRCPINW.SAR.
Now I have to install the GRCFND_A_V1000_INST component. In the same download, I found this:
GRCFND_A_V1000_INST -> DATA ->K-V10AGINGRCFNDA.SAR. I presume that this component is suitable for SAP NW 7.3
i sucessfully uncarred this and placed in EPS/in folder. When I execute the SAINT in my GRC 10 system (SAP NW 7.3), it does not show me the add-on in the queue, therefore, I am unable to install this add-on.
I have upgraded the BASIS,ABAP,PI_BASIS and BW components to SP05.
Has any one has come across with such problem? Please share/help me on this.
Regards,
Faisal

Hi Faisal,
All of the pre-requisites and documentation points to the requirement for NW7.2 for the GRCFND_A component. I am not aware that it is compatible as yet with 7.3.
Sorry, not particularly helpful in resolving the issue but hopefully it clarifies what I suspect you already worked out.
Simon

SAP GRC 10.0 Configuration

Hi Experts,
I had attended your last session on GRC 10.0 and it has really helped us a lot in understanding the new features of GRC 10.0, and thanks for answering all my questions. We being a Ramp Up partner (Capgemini India) successfully installed GRC 10.0 and in process of doing the post installation configuration, below are the steps we followed in the phase of installation and configuration:
1.     Installed ABAP stack.
2.     GRC 10.0 Add on Installation.
3.     BC set Activation.
4.     Activated services.
5.     Assigned all necessary roles to the User.
6.     Launched NWBC client and we are able to see all the functionalities of GRC 10.0.
Now next is to create the connectors to the backend system and do the analysis and other activities, and this is the phase were we are stuck and not able to move further as we didnu2019t find any specific documentation or notes for the same, it would be really helpful if you can help us on the next steps to be followed:
Have created backend (ECC 6) connectors through SPRO u2013 GRC - Common Component Settings u2013 Create Connectors.
Further on is a question mark, please help us on this.

Luis Bustamante wrote:
Sandeep,
>
> Most documentation (including new notes) is not publicly available as the solution is in Ramp-Up, please contact your Ramp-Up coach for more detailed assistance on the process. Nevertheless, there are a few things you need to do to get the risk analysis working:
>
> 1. The connectors must be assigned to the AUTH integration scenario (under Common Component Settings -> Integration Framework -> Maintain Connector Settings).
> 2. Assign the connector to the respective connector group containing the rule sets depending on the BC sets you enabled, in most cases it would be SAP_R3_LG. (under Common Component Settings -> Integration Framework -> Maintain Connectors and Connection Types).
> 3. Generate the rules with program GRAC_GENERATE_RULES
> 4. Run the sync jobs: GRAC_ROLEREP_ROLE_SYNC, GRAC_ROLEREP_PROFILE_SYNC, GRAC_ROLEREP_USER_SYNC, GRAC_PFCG_AUTHORIZATION_SYNC.
>
> Regards,
> Luis
Did this work ?
@Luis:I am on the same page (without the steps you have listed) but GRC system does not show backend system as a dropdown, when I click on any related link (e.g. create request under Access Request). Any clue on why is it required to add the connectors to the AUTH integration group ? Is that necessary for the GRC system to recognize the backend.
Thanks,

GRC 10.0 Landscape and installation

Currently we use Virsa 400_700 on ERP6.0 and planning to implement to GRC 10.0
We know GRC10.0 can be installed on NW7.02 with SP 06 and EHP2.
We have below landscape question for GRC10.0
Can GRC10.0(components - AC/PC/RM) and Plugins(RTAs) be installed on same host ?
In other words,
As per SAP documentation, GRC10.0 is installed on central host and
backend hosts communicate to this central host thru RFC (plugins are installed on backend hosts).
I want to have both GRC 10.0 and Plugins installed on each backend host so that there is no need of RFC's.
We also know each backend host should have latest SAP version for GRC10.0 to be installed.
Will the above landscape work? have any one tried it?
Any suggestions of your experience will be rewarded with full points......
thanks & best regards,
Kannappan.S

Hi,
I don't think so it is possible because an ERP system cannot be GRC server and GRC server client as well. Because you need to install plug-in's on remote system and GRC patches on the grc server. Also, you need to activate a lot of BC sets in GRC 10 which you cannot activate on GRC client system. So, what you are saying is technically not possible.
Thanks
Sunny

GRC AC 5.3 Documentation

Similar Messages

Maybe you are looking for