GRC AC Connectors

Hello Experts,
Is the following process correct for creating connectors for GRC AC 5.3:
1. JCO connector (Meta & Model) is created for a system say P6E and client 100
2. Using this, a system connector P6E100 is created in RAR
3. A JCO destination is created with this name i.e., P6E100
4. Now the system connectors are created for all other three components CUP, SPM, ERM with same JCO destination.i.e., P6E100.
Is this process correct?
Thanks
Ram

Hi Ram,
Yeah this is exactly what we've done and it works.
Best regards.

Similar Messages

Error while creating new connector in GRC CUP 5.3

Hi,
I am trying to create a new SAP Connector in CUP 5.3, when i fill in all the fields in the new connection and select "Test Connection" it says Connection successful and when i save it and look at the Available connectors, i am unable to see my new connector there.
Does anyone know why is this happening.
a quick response is appriciated.
Thanks.
Edited by: Chaitanya Pallapotu on Jul 14, 2009 9:17 PM

Hi Chetan,
I have the same issue when configuring connectors in CUP. I solved it in this way:
1- Go to RAR(Risk, Analysis and Remediation) --> Configuration --> Connector --> Search
2- Select one of the connectors and write down the values in the list box of the field JCO Destination.
3 - Now, go to CUP, and create the connector using the names writed down in step 2.
CUP will warn you with an error, ignore it, and then save the connector.
Note: when creating the connector in CUP, fill the fields, then save/create(here you will have the error msg), then Test Connection, and then save again.
That works for me!!!
PD: Always log in to GRC with the same language configured in CUP.
Hope this works for you!!!

GRC 10.0 - Transport Connector Relevant Settings

Hi Gurus,
Many of you have already completetd GRC 10.0 implementaion. One of the Key advantage of GRC 10.0 stated as "Changes can be transported".
While carrying out configuration settings under nodes SPRO -->GRC --> Common Component Settings --> Integration Framework and other Subsequent nodes in Access Control, we find many steps involve Connector, Connector Mappings, Actions related Settings which are connector dependent.
Further, there are relevant sub-nodes viz. User Defaults, User data sources, HR Triggers etc., which involve connector values as part of configuration steps.
We have created Back end test / Development related connectors and carried out the relevant configuration settings. We find that all these settings are getting collected in the transport request.
Once we move this transport request to GRC QAS / Production landscape all the back-end Test / Development /QAS related connector settings will also move. Further this will also call for defining back-end Production systems related Connector Settings in GRC Development System itself.
Looking forward for inputs with respect best practices for managing the GRC 10.0 config / workflow related transports across Dev / QAS / landscape.
Regards
Hemant

Hi Hemant
SAP has made a lot of the transport functionality in GRC10. I find that they hereby created a huge expectation with the customer, that in fact is not true.
For instance Exclusion Objects and Mitigation Controls are NOT transported. What about Organizations? Critical Roles and Profiles are also not transportable.
As for the Connectors - system specific parameters are transported. Therefore you end up having to delete the DEV and QA connectors in the PRD GRC system.
On this question, has anyone used CLM yet? It seems that only Functions and Risks will be extracted to CLM and then deployed in the other system (DEV to QA for example). Does CLM even work?
SAP provide not guidance on all of these important issues. I agree that it is about time that SAP takes some leadership and produce a proper best practise guide for this software. By the way, an offical sizing document from SAP is still to be delivered.
Thanks
Will

GRC 10.0 Connector error

Hi experts,
I'am working on a GRC 10.0 (AC) implementation and when creating a conncetor to the SAP ERP, we have no error nor problem.
But, when I try to run the SYNC programs, lets say GRAC_ROLEREP_PROFILE_SYNC, GRAC_PFCG_AUTHORIZATION_SYNC, etc. I get the following error: Processing for connector XXXXXXXX, Correctly define the logical connection in CCITS, Role sync failed with error. And when trying to run it in background a get the job cancelled and with the following error: Connector is not properly configured in common component setting.
Yeah, I know what you are thinking...the problem is the connector!!! That's what I also think. But when I go to the IMG and look at the custominzing, cant find anything that makes me believe that the connector is not properly configured. At least following all the procedures in the configuration guide.
I have upgraded up to Support package 4.
Lets take a look at the customizing:
In IMG/GRC/Common Component Settings/Integration Framwork/Create connectors
I Have created an RFC ABAP connection (with the same logical name as the ERP), and tested the RFC connection and works fine.
In IMG/GRC/Common Component Settings/Integration Framwork/Maintain connectors and connection types
I have the connection types definitions by default. In Define connectors I have one entry with my target connector (the one created in the last step), connection type=SAP, Source connector=empty, Logical port=empty and max no of bg=3
Could be the source connector and logical port fields?? Cause I dont know what to fill the fields with...
Well hope somebody can give me a hand on this.
Regards,

Hi Experts,
I'm using the SP5.
I'am facing the same issue with the job GRAC_PFCG_AUTHORIZATION_SYNC.
I tried to run it in background and foregroung in several langages but it doesn't solve my issue:
Unable to locate connector xxxxxxx
PFCG authorization sync failed with errors
My connector's setting seems to be right as I can run a risk analysis and see results.
Other synchronisation jobs (GRAC_REPOSITORY_OBJECT_SYNC for example) works fine.
Have anyone an idea ?
Best regards

GRC 10.0 Connectors

Dear Experts,
I have two systems: SY1 (GRC 10.0 Main component), SY2 (Plug-in system)
I want to create connectors between SY1 and SY2.
RFCs are created as below:
Rfc connection between SY1 and SY2 (created this connection in GRC main system)
Rfc connection between SY2 and SY1 (created this connection in Plug-in system)
I have maintained this info in Maintain Connectors and Connection Types as below:
Target Connector : SY1_SY2
Source Connector: SY2_SY1
Logical Port: SY2_SY1
While running the sync jobs I am getting message connector SY1_SY2 is not located.
Please advise if I have created connectors correctly.
I appreciate your help.
Thanks,
Raj

Raj,
For general GRC use, you need to configure the RFC destinations for all systems within the GRC system, including the GRC system.
The Logical port should = Target Connector (not the source), i.e. SY1_SY2 in your example.
Check out the following document also http://www.sdn.sap.com/irj/bpx/go/portal/prtroot/docs/library/uuid/40535c03-9666-2e10-33a4-b6b003dac3cb

GRC 10 - Legacy connector as user detail data source

Hello,
I'm trying to use a legacy connector (with a text file as input) as a user data-source.
Repository user sync for this legacy connector works : checked GRACUSER table, it is populated with all the user details from the input file (id,firstname,lastname,mail,department,phone
I got it working for user search data source : when creating an access request for "other" user, searching for a user ID/name works : data are displayed in search result, however when I select the user from the serach result the user details are not populated in an access-request form.
Any clue about this ? Any one already got this working ?
GRC 10.0 SP13.
Checked SP14 and SP15 release notes, and found no relevant notes yet.
repository-related notes applied :
-1864423
-1950231
Regards,
Emmanuel.

Hi Pedro,
You only have confirmed that 2 accounts are maintained in HCM and in SU01 as well, so you would be able to see these accounts' details both ways.
Yes, you are right about user account maintenance first in HCM at the time of new hire, then you can manually raise the access request to grant them access to various SAP systems. Or in order to automate this process as Prasahant suggested, you can take help from HR Triggers.
You can refer: GRC 10.0 - HR Trigger configuration - Governance, Risk and Compliance - SCN Wiki
But responding to your original discussion, whatever user accounts are maintained in HCM you would see those details provided you define HR for the "user search data source" AND from SU01 for "user detail data source"
In your case you have 2 accounts which have been maintained in HCM as well as SU01, so that is what creating confusion for you.
Let us know if you need any more clarifications.
Regards,
Ameet

GRC AC 5.3 EP Connector

1. i'm trying to connect portal to my GRC AC server.
i made the connector in RAR and i upload the masterdata from the portal. now i need to check it with CCDebugger and it doesnt seem to work.
2. in order to create connector in CUP i need to enter URL does any one know where i can find this information
any ides?

Hi,
Please check the Post installation guide.
https://wiki.sdn.sap.com/wiki/display/BPX/Governance%2CRisk%2CandCompliance%28GRC%29How-ToGuides
1) for CC debugger URL
http://<server>:<port>/webdynpro/dispatcher/sap.com/grc~ccappcomp/CCDebugger
2) To Create Connector in CUP
>>CUP>>Configuration>>Connectors>>Create
Hope this wll help you.
Regards
Gangadhar
Edited by: gangadhar hm on Aug 18, 2009 3:50 PM

SAP GRC 10 SP13 PC- AM scenario not available for assigning to connector

Hello Expert,
We are on GRC 10 SP 13 PC . We want to add connector to AM connector group under SPRO-GRC_Common Componenet Setting - Integration framework - Maintain Connector and Connector types - Define Connector groups.
I remember all other groups ( AC related) which are available in this area are coming because of activation of BC sets. I have activated all the BC sets related to PC but AM group is not available.
Any Suggestion?
Kind Regards
Asheesh

Hello Asheesh,
AM Integration scenario is available in next path in SPRO.
SPRO -->GRC --> Common Component Setting - Integration framework -->Maintain Connection Settings
Regards,
Gowrinadh

GRC PC 10 - Source Connector update impact to AC 10

Hello
We had an issue with one of our controls where we were utilizing an ABAP sub scenario. The job would not finish and remain "in progress" for any scenarios involving a GRC satellite system (e.g. ECC, SRM). SAP advised us to change the source connector in the "Maintain Connectors and Connection Types" in SPRO so that the source system is GRC instead of the satellite system. We tested the updated assignment and noted that the update worked.
Our concern is what, if any, impact these changes will have to our AC side. I have done a bit of research and noticed that the "source connector" field is not needed for AC so there may not be an impact. We are going to test provisioning to confirm but also wanted to query the SCN to see if anyone else had experience with this. I've included a screen shot below that displays the updates we made to the source connector.
Does anyone know if updating the source connector will have an impact on the GRC AC side?

Hi Stacey,
Updating the source connector should not impact any AC functionality, you make a test and in case
it impacts then could be some other reason which we can check.
Regards,
Silky Sharma

Steps for replacing a connector in GRC CUP and RAR

Hi All, We have GRC 5.3 CUP and RAR installed and I would like to replace an existing connector PRD with one called PRD010. Does anyone have the necessary steps to follow to perform this? Your input is appreciated.

Hi Sudip,
Sorry I didn't clarify and thanks for responding. This will be the same backend. I want to change the connector name within the RAR and CUP config, etc. I'm concerned about all the "tags" in the database tables pertaining to this connector name if you know what I mean. It seems that when you make a change like this you end up with data in the database tagged with the old connector names which makes it difficult to clean out the old stuff unless maybe there is a proper sequence of steps to go thru. Can it be just as simple as creating the new connector and then exporting and importing the rules with the new connector name? Maybe I'm making this more difficult than it really is.
Regards,
Gary

Connector from GRC 5.3 to IDM failed

Hi,
In our landscape, we had a requirement to connect GRC 5.3 (RAR) and our IDM UI (NW 7.0 EHP1). The connector type is defined as 'Web Service' connector. But the connection fails with the following error
WARNING: Cannot get data extractor forD2H. Reason:D2H/D2H
com.virsa.cc.dataextractor.dao.DataExtractorException: D2H/D2H
at com.virsa.cc.dataextractor.bo.DataExtractorSAPPORTAL.init(DataExtractorSAPPORTAL.java:98)
There was no EP component installed on our IDM UI (SID : D2H). Hence i had installed EP components and the VIRPERTA (RTA of Enterprise Portal) in our IDM system.
Now when i create a connector in GRC system with the following webservice
http://<IDMhost>:<port>/CCRTAWS/Config1?wsdl&style=document the connector fails. But the Web service URL works fine returning an XML page.
Can anyone please help here???
Regards,
Ragav

Hi,
The migration utility is very simple. You install it on GRC 5.3 box and then select the items you want to migrate. It will generate tab limited text files and you can use those files to import data into 10.0 box.
Regards,
Alpesh

Connector Deletion on GRC

Hi
I am trouble shooting an installation.
What I need to acomplish is : Connect a new ECC system to GRC QA box.
GRC- QA box has 2 connectors defined one to ECC and one to CRM
GRC QA is wrongly connected at the back end to production ECC and CRM systems inplace of ECC QA and CRM QA
All the uploads have been done against the back end production physical connectors.
As there is data I am not able to delete the connectors.
If I manage deletions by deleting the Rule sets I need to do a fresh upload from Function authorizations to SU24 against all the three systems, is this a good approach to accomplish my objective.
Thanks
Vidyar

Hello Partha,
Thank you for the answer,
I have one more system connected in the past 4 days as we needed to run SoD on another system.
So now the initital 2 system connectors are still present, added with a 3rd ECC system.
Now I am planning to delete the 1st ECC and 2nd CRM system, 3rd ECC needs to stay back.
Can I delete the 1st ECC and 2nd CRM system with out disturbing the GRC Rule sets as the 3rd system needs to stay for 2 more years.
Thanks
Vidyar.

JCos (Java Connectors) from one GRC server to multiple clients on same DEV

I have installed SAP GRC Access Controls RAR on a server.
I have connected the RAR using JCo's to a client (800) on a DEV R/3 (4.7) box. I have also performed analysis succesfully on the roles and users in this DEV client.
I now have another development client on the DEV box (500) which I need to perform analysis for. This client is HR specific.
I know I can create a new JCo to connect to client 500. But what will be the impact on my analysis results? How will I distinguish between the results found from client 500 and those found from client 800?
How would you suggest the best way of doing this?
Many thanks in advance.

You will need to create a second JCO to the second client as JCO's are client specific (username password combinations to log on etc etc)
You distinguish the results in Risk ANalyses by choosing the JCO (system) when you create the reports eg: Client 500, Client 800 or ALL.
It can be very confusing and you have to be careful otherwise you will interpret the results incorrectly.
If your new client is HR specific make sure that you have the HR RTA installed as well and patch the HR and Non-HR RTAs up to the latest versions.

Problem in Connectors in GRC AC 5.3

Hello all,
While we are creating the connector in RAR the JCo destinations are not visible. In the drop down list of JCo destinations we are able to see the Value as <Host Name>_<null>_<Client Number> For Eg: GRRDEV_NULL_200 i am not able to see the JCo destinations which we activated in Java content administration
We have installed the latest patch SP18 and using the HR Module also.
What could be the cause?
Activated: JCo Destinations
VIRSAHR_MODEL & VIRSAHR_METADATA
VIRSAHR_01_MODEL & VIRSAHR_01_METADATA
*VIRSAHR_02_MODEL & VIRSAHR_02_METADATA *
Thanks in Advance.
Regards,
Kumar Rayudu

Hello Kumar,
Yes, you can use "VIRSAXSR3_01_METADATA" and "VIRSAXSR3_01_MODEL JCo destinations for HR backend. As mentioned by our friends in this thread it doesn't matter what kind of backend you use. You can still use these JC0 destinations.
With these JCo(Adaptive RFC connection) destinations, maximum number of system one can connect are 15. If you have more than 15 systems it is recomended to use SAP JCO connector type for RAR.
SAP JCo connector doesn't have any limitation like JCo(Adaptive RFC).
Hope this answers your question.
Best Regards,
Sirish Gullapalli.
Edited by: Sirish Gullapalli on Jul 28, 2009 12:03 AM

GRC 10 want to extend our ruleset for use by another connector

Hello.   We migrated our RAR ruleset from 5.3 to 10.0 and it is working for on our original connector (our SBX). Now we would like to use that same ruleset for a new connector (our QAS).   I do not see a way to do any mass maintenance for this. There is a mass maintance for functions where I can add a new system, but it appears I have to do it one function at a time. Is there a better way? I thought about transforming my original export files to modify the connector name, but wasn't sure if that would work since connector isn't one of the fields offered for transformation.
Would appreciate any suggestions from the experts!

Interesting suggestion about logical system.   As for your other suggestion, I do not see an option to "download SOD rules" offered in SPRO -- only "upload SOD rules". Hmm.   I found on Idea Please this has been logged as an enhancement:
https://cw.sdn.sap.com/cw/ideas/4448
In the meantime I figured out how to load. I took the export files created in 5.3 and manually modified (witha global replace in Notepad) the connector then ran GRAC_DATA_MIGRATION for only the FUNCTION_ACTIONdata.dat and FUNCTIONAL_PERMISSIONdata.dat (append mode selected). Then I generated the ruleset, and that seemed to do the trick.   Thanks for your input!

GRC AC Connectors

Similar Messages

Maybe you are looking for