GRC-AC 5.3sp14, ERM, Role Generation

We updated our GRC-AC 5.3 from sp12 to sp14 and now we cannot generate roles anymore. When we try to do it, we get the following error: "Failure : Field AGR_1252 not a member of TABLES".
Does any one know how can we solve it?
The backends were also updated with sp14 and the post installation procedures (import xml, run sync jobs) were done. Role generation was working well before sp14.
Thanks,
Marcelo

Hi Marcelo,
I managed to solve the problem.
Check SNOTE 1352498  and ensure that you have the right levels of SP. For GRC AC 5.3 SP14 you need VIRSANH SP15 and VIRSAHR SP13.
After the upgrade check in the Daemon Manager that the jobs and webservices are running.
You will now be able to generate the roles in ERM.
Regards,
Pedro.

Similar Messages

  • ERM Role generation gives error

    Hi,
    All the fields are checked and the configuration is meeting the document guidelines for ERM. I am getting error while trying to generate the role from ERM and the message is " Cannot generate role Z:TB_TS_TEST1234567890987_S001  provide valid & 1& 2 in table & 3".
    Please let me know if somebody has faced this problem and has been fixed.
    Thanks,
    Abhimanu

    Hi,
    Do you uploaded the static text and Authorization Objects in GRC from backend system?
    If not then download them from your ECC system using  program /VIRSA/ZCC_DOWNLOAD_DESC and /VIRSA/ZCC_DOWNLOAD_SAPOBJ by executing se38 tcode and upload it in RAR.
    Then try to generate the role.
    Thanks,
    Sudip.

  • ERM role generation

    Hi all,
    i have GRC 5.2 installed. Did the post installation steps. In ERM when i try to create a role without any conflicting tcodes the role is getting generated, but when i include any  2 tcodes risk is showing up, i have mitigated the risk, when generating the role it is giving the below error.  Please help me out as i am a beginner.
    2009-12-22 00:50:59,140 [SAPEngine_Application_Thread[impl:3]_29] ERROR No intenationalized value found for key : FrontPageDesc20
    2009-12-22 00:51:05,250 [SAPEngine_Application_Thread[impl:3]_33] ERROR No intenationalized value found for key : FrontPageDesc20
    2009-12-22 00:53:13,546 [Thread-139] ERROR java.lang.NullPointerException
    2009-12-22 00:54:48,640 [SAPEngine_Application_Thread[impl:3]_28] ERROR com.virsa.re.role.actions.GenerateRoleAction
    java.lang.Throwable:

    Hi Zaheer,
          i am not getting any abap dump in the backend. In ERM the sysltem logs is as follows:
    2009-12-22 18:14:01,875 [SAPEngine_Application_Thread[impl:3]_6] ERROR  User :   not found to get full name
    2009-12-22 18:14:14,656 [SAPEngine_Application_Thread[impl:3]_6] ERROR com.sap.security.api.NoSuchUserAccountException: USER_AUTH_FAILED: User account for logonid "?" not found!
    java.lang.Throwable: com.sap.security.api.NoSuchUserAccountException: USER_AUTH_FAILED: User account for logonid "?" not found!
         at com.virsa.service.umi.ume.UMESearchUser.getUserById(UMESearchUser.java:135)
         at com.virsa.re.bo.impl.SearchUserBO.getUserById(SearchUserBO.java:96)
         at com.virsa.re.cache.RECacheUtil.getUser(RECacheUtil.java:2237)
         at com.virsa.re.cache.RECacheUtil.getUserFullName(RECacheUtil.java:2209)
         at com.virsa.re.cache.RECacheUtil.getUserFullNameWithUserId(RECacheUtil.java:2261)
         at com.virsa.re.role.actions.RoleActionHelper.convertRoleApproverDtoToRoleApproverPo(RoleActionHelper.java:198)
         at com.virsa.re.role.actions.RoleAction.convertDTOToPO(RoleAction.java:1569)
         at com.virsa.re.role.actions.RoleAction.getRoleFromDB(RoleAction.java:1024)
         at com.virsa.re.role.actions.RoleAction.pageLoadForEdit(RoleAction.java:805)
         at com.virsa.re.role.actions.RoleAction.execute(RoleAction.java:107)
         at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:265)
         at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)
         at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)
         at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:373)
         at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:264)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:347)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:325)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:887)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:241)
         at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
         at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148)
         at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
         at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
         at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
         at java.security.AccessController.doPrivileged(Native Method)
         at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
         at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
    2009-12-22 18:14:14,671 [SAPEngine_Application_Thread[impl:3]_6] ERROR  User : ?  not found to get full name
    2009-12-22 18:16:34,125 [Thread-120] ERROR java.lang.NullPointerException
    2009-12-22 18:25:19,781 [SAPEngine_Application_Thread[impl:3]_36] ERROR com.virsa.re.role.actions.GenerateRoleAction
    java.lang.Throwable:
         at com.virsa.utils.VLogger.logError(VLogger.java:453)
         at com.virsa.re.bo.impl.GenerateRoleBO.generateRole(GenerateRoleBO.java:109)
         at com.virsa.re.role.actions.GenerateRoleAction.generateRole(GenerateRoleAction.java:224)
         at com.virsa.re.role.actions.GenerateRoleAction.execute(GenerateRoleAction.java:83)
         at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:265)
         at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
         at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
         at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
         at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:286)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
         at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
         at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
         at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:286)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)
         at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)
         at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)
         at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:373)
         at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:264)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:347)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:325)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:887)
         at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:241)
         at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
         at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148)
         at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
         at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
         at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
         at java.security.AccessController.doPrivileged(Native Method)
         at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
         at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)

  • Illegal Tcodes error while role generation in BRM GRC 10.0

    Hi Experts,
    I am working on SP11 GRC 10.0.
    In BRM, after following all necessry steps for role creation, when I enter last stage "Role Generation" and try to generate it, I am getting error "Illegal Tcodes (system name)" as shown in below screenshot.
    I am adding SAP standard t-codes only (e.g. SU53) which are existing in the backend system but still it throws error.
    Your suggestion is highly appreciated.

    Hi Swati,
    Thanks for your reply.
    I had already applied note: 1066687 but it didn't resolve my issue.
    Note: 1441463 is valid till release 720 and I am on release 731 and SP11.
    Thanks
    Jayesh

  • SAP GRC - ERM - Role update issue - Business Process and Subprocess

    Hello Friends:
    We are NOT currently maintaining Business processes or sub processes in GRC 5.3 for all roles. We don't want to maintain them in GRC 10 when we upload the roles. These 2 fields are Mandatory in GRC 10.0 - Can we make them NOT mandatory and leave them blank?? Currently we are facing some issues in uploading the roles
    Please advise.
    Regards
    Ashish

    Dear Ameet:
    I just dislike the idea where SAP has made options for Business Process and Subprocess columns mandatory in uploading the roles as well from backend.
    I am NOT using BRM, but still need to upload the roles for SAP to recognize them to be assigned to the users in GRC 10.0
    I was facing the issues in uploading the roles initially, but now i have made it simple - just assign all the roles without the information of being FI or SD or Mm - to IT00 business process and sub process. So, all the roles are now uploaded to the system. I was just curious to know if they can me made Non-mandatory field by any settings.
    But anyways, thanks for your input.
    Regards
    Ashish Desai

  • ERM Role con't be deleted Automatically after rejecting the request in CUP

    Hi Experts,
    I am involving the GRC implimentation project and ERM component is succefully configured with post-installation activites and also configure the workflow(1-stage) in CUP for role approval.
    After initiating request, the request was sent to appropriate approver for approval process and approved/ Rejected by the approver.For first case(Request approved) everything is looks fine.
    but whenever the request is rejected (second case) by the approver, the role is still present in ERM and ABAP backend as well as.
    please suggest me, if the role is deleted in ABAP/ERM system after rejecting the request by Role Approver in CUP. or still present the role in systems.
    Regards,
    Arjuna.

    Hi Jes,
    We so have a feature called Password Self Service which is used by users to reset their password using CUP. Also if the password is locked by multiple failed attempt, CUP even activate this user.
    However in your case administrator will be locking the user or deactivating the password, so CUP will not allow users to unlock their users as it has been locked by administrator.
    So CUP can only unlock those users which were locked due to failed attempts etc.
    Regards,
    Shweta

  • ERM5.3 - Role generation in SAP QA & SAP Prod

    Good day Chaps.
    My client requested wants to generate a role 1st in a QA system, test
    the role and then generate the same role in production.
    The challenge is that on ERM > Config Tab > System Landscape >
    Landscape Name > Associate Actions. There is only one default Role
    Generation connector.
    What is best practise to allow a Role to be generated in a QA system
    and the a Production system?
    Thank you.
    Michael Hannie

    Good day Alpesh.
    Thanks for the good and quick reply. I will inform my project manager of our options. Below is the reply from SAP AG for the same issue that I logged, for anybody that might come across the same issue -
    [https://service.sap.com/sap/support/message/E/012002523100001743122009]
    17.02.2009 - 08:42:55 CAT - Reply by SAP      ,
    Thanks for messaging us. At a time, you can generate the Role only in
    one System. Please a create a Landscape and assign the related
    Systems as Connectors to the Landscape.
    In the Associated Actions, you can assign as many Connecors(Systems)
    as you want in Risk Analysis & Role Generation.
    Please assign the QA System & Production in one Landscape and make the
    QA system as default for Role Generation and start creating the Role
    and generate it, and test it.
    Then change the default System of Role Generation to Production System,
    and generate the Role.
    Hope this will solve your issue and kindly confirm the Message, Once
    you are able to solve the issue.
    Thanks,
    Babu

  • Synchronisation problem of  ERM roles with SAP BACKEND

    Hi ,
    In GRC could anyone please let me know what is OPEN bug regarding Sync ERM roles from backend and is it still a issue .
    Anyone experiencing this, I am using GRC ac v5. 3 and sp13 ,
    Thank You

    Hi  Folkvar,
    There might be specific issues but as general there are very few. I recommend you to reply with the exact details on the current setup, i.e., the role setup in your landscape (parent roles, derived roles etc) and other information such as your current setup etc., Incase if you have started sync'ing the roles, post the exact error message so that some expert can guide you towards a resolution.
    Best Regards,
    Raghu

  • Error in stage of Role generation in Role Expert

    Hi,
    While generating the role in backend from RE, its throwing an error " Exception condition : " NOT_Authorised" raised. please suggest me any solution.
    Thanks

    Hello Hima,
    The user ID should be the same in frontend as well as in backend with enough authorizations for role generation in the backend too. For getting this authorization correct, you can first try to create and Generate a role in the backend itself, if you are not sure what authorizations this user should have to generate a role.
    Also, I would like to suggest you to maintain the same password for this user in both the frontend as well as backend.
    Regards,
    Hersh.

  • Issue to add t-codes & functions in ERM role request GRC 10.0 - SP 5

    Hi
    We are on SAP GRC 10.0 - SP5. We are facing a strange issue while creating a Role request.
    After Defining the role, we are unable to add actions and there is no option of add/delete.
    Similarly while adding Functions, we are getting an error of Function module doesnot exist.
    On SP5 we could able to add t-codes successfully. Is this an issue with SP5.
    Thanks and Best Regards,
    Srihari.K

    Hi Diego,
    We applied the SAP Note. Now we could able to add the function from RAR rule set to a role. But this is brining all the t-codes in the function.
    We could not able to add the Actions directly into the role while defining. There is no add button appearing in Action edit screen where we can add t-codes to the role manually.
    We are on GRC 10.0 - SP5. Does anybody has this issue and got it resolved?
    Thanks and Best Regards,
    Srihari.K

  • Error in GRC AC 5.3--ERM-mshost missing

    Dears,
    We are using SAP GRC 5.3 on AIX,Oracle 10g.
    In Enterprise Role Management,We are facing one issue:
    We created a role,Now we try to change it and try to add new tcode by option searching tcodes in Available system it shows error:
    "mshost missing"
    Please suggest,Where I need to maintain this setting.
    Regards,
    Shivam
    Edited by: Shivam Mittal on Nov 17, 2009 4:38 PM

    Hi Shivam,
    In the ERM>>COnfiguration>>system....have you maintained the MS server name???
    If NOt please maintain....
    Check for the test connection..
    Regards
    Gangadhar

  • ERM Role Export with multiple languages

    Hi All,
    I have an issues where role download program /VIRSA/RE_DNLDROLES exports the roles with all text languages included (if the role was maintained in multiple languages).
    Then when I mass import the roles into ERM (AC 5.3 SP10), the upload program gives an "unknown error." After several hours of testing I figured out that that eliminating all but one of the multiple role language texts in main role file will allow the roles to be uploaded sucessfully.
    It seems that the function module /VIRSA/RE_BAPI_DOWNLOAD_ROLES should be changed to include a language parameter.
    Anybody ever have this problem?
    Thanks, Dylan

    Hi All,
    I found a workaround for this issue, I'm posting it for posterity then will close this post within a couple of days. I would appreciate to know if anyone has run into this issue too, it can't just be me?!
    First, the download of the main role text file from /VIRSA/RE_DNLDROLES stores the file as ANSI text type. At least that is how my Windows PC opens it. IF the role was maintained in mulitple languages with special language characters like ü, ô, ê, é, è, à, ò, ä, ö, then GRC AC 5.3 SP10 ERM gives me an "unknown error" when trying to do the mass import. To fix this issue, simply save the file as text type "UTF-8" or anything but ANSI. The ANSI seems to work fine for plain english.
    Second, roles with multiple language versions get all the languages squished together in the long description. I had one role with a Japanese, English, German, French and Italian long description BUT each maintained in it's own language. During the upload, all were imported into ERM and grouped together in one ugly text.
    I fixed this (although not ideally) by modifying Function Module /VIRSA/RE_BAPI_DOWNLOAD_ROLES used during the download:
    The code change is as follows:
        SELECT * FROM AGR_TEXTS APPENDING TABLE i_agR_TEXTS WHERE AGR_NAME
                                                            "#EC CI_GENBUFF
    *{   REPLACE        SIDKxxx
          in r_agr_name.
           in r_agr_name
           and spras eq 'E'.   "download only English
    *}   REPLACE
    Then, the 1000+ roles uploaded successfully without issues.
    I realized after that OSS Note 1260773 covers explains this similarly.
    -Dylan

  • Derived Role generation in BRM

    Hi,
    In BRM while creating a parent role, corresponding derived roles are created and sent for approval.
    Post approval, the roles are generated, in the foreground confirmation message states that Parent + derived roles all are successfully generated.
    In the backend system the derived role's "Authorization" tab is with a status yellow and profile is not generated. However, the derived role has all the relevant values in it and the last changed by / date is appropriate to reflect the changes done.
    Can some one please point to a solution to this? We have raised an OSS for this about a month back and applied suggestions from SAP without any result.
    Version - GRC 10.0 SP10
    Thanks,
    Sammukh

    Hello Andrzej
    Yes, the derived roles are in status complete. After generation of all the roles (parent+derived) the derived roles move to the maintain test cases phase. Here we maintain the test cases and close the methodology. Post this the derived roles' status become complete.
    Yes, we did try re-generating them manually from mass generation from GRC. The result is same. In fact the surprising thing is following:
    1. Derived role is complete and in not generated state.
    2. Mass generated from GRC - still not generated.
    3. Manually generated in backend system - roles are now generated.
    4. Mass generated from GRC again - status that was generated from point 3 before changed to not generated again.
    Looks like the generation from GRC itself is the problem, but we are unable to pin-point the issue.
    Thanks
    Sammukh

  • ERM Role Methodology Process - Steps

    Hello Gurus,
    I am on SP17 and have uploaded relevant init files. Have also performed background job sync.
    When I create a role in Role Definition stage and save it, the role does not pass or promote to next step i.e. Role Authorization Stage. GRC saves the role properly.
    I have not defined any condition groups or custom fields. It is just plain role definition.
    Request your help on this.
    Thanks,
    SA

    Hi,
    Please, can you give more details for your configuration?
    I´m thinking that you don´t have ERM Workflow in CUP for workflow approval criteria. Do you have workflow configuration for ERM in CUP?
    Good luck!

  • AC ERM : role creation and how to delete ungenerated roles

    Hi,
    When you work on a role from ERM, the role is created in the back end. It will be generated only at the generation phase. But what if finaly it is decided not to generate the role, is there a way to delete the role in the BE from ERM?
    It seems the only way is to go in PFCG and delete the role manualy?
    Regards

    Hello Vincent,
    There are different tables in which the roles for RE (in frontend RE, frontend tables) and where the roles in R/3 are stored. That is, it might be that even if you are generating all the roles from RE, at a particular time the list of roles in RE is greater than number of roles in R/3 Backend. This is because:
    RE roles = Generated roles (which exist at backend as well)+Ungenerated roles (which are in RE only till that particular time).
    Here ungenerated roles would mean the roles which you have not yet generated in RE.
    Thus, __deleting roles from R/3 and RE are two separate things__.
    1. To achieve the deletion the role from Backend (R/3) you should create a request in RE to remove this role from all the users currently attached to it as there is no way possible to delete the role from R/3 by creating a request from RE. Doing this would still have the role in R/3 but with no user assigned.
    2. To delete the role from RE tables, so that you do not see it again, you can Search for the role, select it and then click on the "Delete" TAB. This will delete the role from the RE tables.
    Now, for the clenliness of your R/3 system, in case you do not want to see these roles in R/3 too, you can schedule a BG job to delete this or do a mass delete of all these roles say every fortnight or at whatever frequency as desired by your management.
    Regards,
    Hersh.

Maybe you are looking for

  • Unable to run bapis for project status update and date update together

    Hi Experts, I have a requirement to update the dates and status of a project WBS at level 4. I am trying to do update the CJ02 Transaction using standard BAPI available. I need to do both Date update and status update in the same LOOP PASS   i am usi

  • Pre Database Insert / Update Validation

    Hi, I have a maintenance view that allow user to insert / update. Let's say, z_my_table is my table key1 key2 field1 field2 field3 I want to validate whether field1, field2, field3 whether exist in my table before insert / update. However, due to som

  • For some reason my itunes will not open because it says that I need Quicktime 7.5.5 or later which I have installed. Any suggestions?

    I recently had my computer cleared out and for some reason I am getting an error when I try to open my iTunes. It says that I need to install Quicktime 7.5.5 or later which I have installed and I keep getting this error mesage. Any suggestions? Also

  • File size in pdf export

    Hi community, I have a question about reduction of file size when exporting to interactive pdf. I am working with an InDesign (CS6, Win) document with about 70 pages and about 100 links included. The links consist of Illustrator files with up to 15 l

  • Officejet 4500 skips pages or parts of pages.

    My Officejet 4500 worked great for about 6 months, but in the last few days it has started to only print the first few lines or at random portions of pages. Fiddling with the default printer setting helps sometimes for a while, but then it acts up ag