GRC - AC - RAR - DataMart Configuration

Hi,
we are on GRC AC SP 10, ORACLE 10.2.0.2.0 Full sync and RA are done.
We have created drivers (classes12.jar) and datasource (GRC) on Visual administrator (based on SDN DataMart configuration guide).
In Visual Adminsitrator -> JDBC Connector -> MyNewDatasource (GRC) -> JDBC 1.x Compliant, we have inserted this information:
Driver Calss: oracle.jdbc.OracleDriver
DataBase URL: jdbc:oracle:thin:@192.168.0.125:1521:GRC
When try to start application an exception arising:
Caused by: java.sql.SQLException: Io exception: The Network Adapter could not establish the connection
It's correct Driver Class and DataBase URL syntax?
Many thanks.
Massimo

Daniela Bork wrote:
Hi Jay,
>
> activating the BC set does not fill any default parameters for any of the tools.
> You will need to add them into the list manually.
>
OK. I'll put them manually or see if I should go with the default ones.
Daniela Bork wrote:
> For your second issue, we have the same effect: Two new invalid parameters 2021 and 2022 are listed with value 009 which have not been there within SP05 and definitely not added manually. Also a complete empty line.
> I think this will be a bug/issue with SP06.
> Did you report this to SAP?
>
I'm glad that I'm not alone. Yes, I have reported to SAP and expect them to reply by tom.
@Anyone, I am working in the implementation and configuration of GRC AC and would like to share some configuration related issues. Would be glad if someone who has worked on GRC (esp ERM), drop me a mail frm my business card (click my name).
Thanks,
Jay

Similar Messages

Important GRC AC 5.3 Configurations

Hello,
Can anyone provide me, with answers to the following 11 queries.
1- The list of the day-to-day activities of a SAP GRC AC 5.3 Consultant.
2- What are the most important mandatory configurations in SAP GRC AC 5.3?
3- Important parameters for extracting data, into SAP GRC Suite (RAR, CUP, SPM, ERM), from SAP and Non-SAP Applications.
4- Performance Tuning Parameters for SAP GRC AC 5.3 Suite
5- Steps/ parameters for export/import utility
6- System monitoring steps for SAP GRC System.
7- List of important GRC AC Background Jobs.
8- Different types of workflows in GRC etc and their usage?
8- How to configure workflows in GRC?.
10- SAP GRC AC 5.3 Integration with IDENTITY Management etc?
11- AC 5.3 Integration with PC (process control)?
Thanks in advance!

Hello,
In the URL mentioned, https://wiki.sdn.sap.com/wiki/display/BPX/Governance,%20Risk,%20and%20Compliance%20(GRC)%20How-To%20Guides,
I am unable to open the guide "How-to Integrate Access Control 5.3 and Business Warehouse 7.0". I am getting the following error
An error occurred while processing your request.
Reference #30.5a4fe3c.1248181333.380356
1- Can you please provide me the correct URL for the guide "How-to Integrate Access Control 5.3 and Business Warehouse 7.0".
2- Also can anyone provide the guide "How-to Integrate Access Control 5.3 and ECC 6.0".
THANKS!

Will GRC AC RAR (CC) add value to SOA based SAP implementation?

Hello GRC Experts,
I thought of asking other GRC experts to get their opinions on the GRC AC RAR for the following scenario:
These days there are numerous SAP clients implementing SOA based Composite Applications using the CAF. These SAP PORTAL applications use Adaptive RFC (direct calls) and Web services calls (thru PI/middleware) to the back end SAP applications to complete the 75-100% of the work. The remaining 0-25% work may be completed using the transaction codes. There are also calls to the back end systems originating from non-SAP applications using the web services via some middleware tool to complete the 100% work.
When the GRC AC RAR deals only transaction codes and their associated authorization objects, how do you assess the risk for this type of access in GRC AC RAR and how do you build a custom rules matrix for this type of applications?
Thanks,
Himadama

Hello again,
Has anyone implemented SAP GRC RAR for the SOA based application? What are the challenges faced? If this is not possible, then anyone has any idea if this is covered in GRC AC 2010 version.
Regards,
Himadama

GRC AC10 RAR :"Ignore Critical Roles/Profile" option not available in

Hello Gurus,
I have configured RAR and the reports are working as usual , but i observed that i could not see two things
1) Option to select "IGNORE CRITICAL ROLES/PROFILE" during Role/User ANALYSIS under "Reports & Analytic" tab.
I checked in SPRO>GRC>AC-->Maintain Config Settings
There is a parameter "Ignore Critical Roles/ Profiles" which i first set to "Yes" and then checked in NWBC , i was unable to see the option under "Additional Option".
Later i changed SPRO setting to "NO" , then again it did not show me .
Where can i find this option , so that if i upload say 10 roles which are assigned to firefighter ID they should not be analyzed for RAR ??
2) I also could not find any option to upload "DEFAULT roles" which need to be assigned to any "NEW USER" request coming through CUP ??
Where can we make this setting, so that the basic roles can get assigned to the user when any new user request comes in.
Will you please put some light on this area ?
Thanks in advance.
Regards,
Victor

Hi Johanna
Have you run the synchronization job subsequent to the configuration of critical roles / profiles ? If not so try running the Synchronization job and then try risk analysis.
Regards
Swarna

GRC AC 10 ERM Configuration

Dear All
We are on GRC AC 10 SP 6 ... and configuring Business Role Management (ERM). I have activated all the relevant BC Sets in inst guide (Page 33) and GRAC_ROLE_MGMT_LANDSCAPE.
However, I am not able to find any default configuration for Role Management in SPRO->IMG-> Access Control->Maintain Configuration Settings ... ?
Also, after applying SP6 for GRC AC 10, we get two invalid parameter groups updated in Configuration Settings with group name '0' param ID 2021 and Value 009
Any clue across these problems ?

Daniela Bork wrote:
Hi Jay,
>
> activating the BC set does not fill any default parameters for any of the tools.
> You will need to add them into the list manually.
>
OK. I'll put them manually or see if I should go with the default ones.
Daniela Bork wrote:
> For your second issue, we have the same effect: Two new invalid parameters 2021 and 2022 are listed with value 009 which have not been there within SP05 and definitely not added manually. Also a complete empty line.
> I think this will be a bug/issue with SP06.
> Did you report this to SAP?
>
I'm glad that I'm not alone. Yes, I have reported to SAP and expect them to reply by tom.
@Anyone, I am working in the implementation and configuration of GRC AC and would like to share some configuration related issues. Would be glad if someone who has worked on GRC (esp ERM), drop me a mail frm my business card (click my name).
Thanks,
Jay

Rule converstion from Approva to SAP GRC AC RAR 5.3

Hello All,
We have rule files of approva in XML format , please let me know is there any short cut mettod or process to change it into SAP GRC Rule files
Please help me on this.....
Thanks in advance
Jagat

Jagat,
the import file structure is documented in the appendix of the configuration guide.
Now all you need is a PERL or XML style sheet wizard to make one into another (or the ability to generate a flat file download you can work with in Excel).
Frank.

GRC AC RAR rules not picked up

Hello All,
I am new to GRC AC and we have a sandbox set up. When looking at SRM a user that has SAP_ALL and is set up in the Java stack for open access. When we run the RAR for this user there are a number of the standard rules that are not showing up. I can explain away the ones that are cross system (ECC and SRM because we have not yet set up the Cross System to look at both) however there are a number of rules that are strictly SRM that are not being picked up can anyone explain why?
Thanks
MK

Hello All,
I am new to GRC AC and we have a sandbox set up. When looking at SRM a user that has SAP_ALL and is set up in the Java stack for open access. When we run the RAR for this user there are a number of the standard rules that are not showing up. I can explain away the ones that are cross system (ECC and SRM because we have not yet set up the Cross System to look at both) however there are a number of rules that are strictly SRM that are not being picked up can anyone explain why?
Thanks
MK

GRC AC RAR: Comprehension question Mitigating Controls

Hello all,
I have a small comprehension question regarding Mitigating Controls.
Situation:
We have identified some authorization roles that contained lots of risks and we decided that they should not be used anymore. I therefore had our admins remove those roles from all the userIDs and update the role descriptions so it is clear that these roles are obsolete and must not be used anymore. For specific reasons we are currently not able to archive those roles in order to remove them from the system (can't delete them either for unclarified data retention questions).
What has been done:
1. I have created the necessary userIDs for Management Approver, Monitor, etc. in tab Mitigation -> Administrators -> Create
2. I have created the necessary business unit and assigned to userIDs created in 1. in tab Mitigation -> Business Units -> Create
3. I have created a Mitigation Control "Obsolete Roles" in tab Mitigation -> Mitigating Controls -> Create
4. Within the Mitigatin Control I have mitigated all associated risks in tab "Associated Risks", added a userID in tab "Monitors" and I have added all the obsolete roles using the button "Mitigate roles"
What I want to achieve:
- Roles should not show up in the analysis anymore -> I've checked that and it works as expected
- I now want the userID I added in tab "Monitors" and when mitigating the roles to regularly check in the SAP system whether the mitigated roles have been assigned to any userIDs again (using PFCG or any other suitable report in the system).
Can I achieve that by using tab "Reports" within the Mitigating Control ?
If I provide the system in column "System", provide "PFCG" in column "Action", "Use PFCG to check is role is assigned again" in "Description", add the userID in tab "Monitor" and set Frequency to "4" this would mean that that userID needs to check whether the roles have been used again at least every 4 weeks ?
Will the system automatically send a reminder eMail to that userID every 4 weeks or does the user have to check the RAR manually in order to see "his/her" tasks ?
Regards,
Benjamin

Hi Jwalant,
sorry for my late reply, but I have waited for a few weeks to make be sure wheather the way you described works or not.
- The background job gets executed once a week and finishes without any error.
- The only thing that doesn't work is that the userID that I maintained in clolumn "monitor" and for which I defined a mitigation control which has to be executed every 2-weeks (using column "report") does NOT get a mail from the system that reminds him/her to execute the mitigating control.
Log of background job execution:
INFO: -
Scheduling Job =>16----
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob run
INFO: --- Starting Job ID:16 (GENERATE_ALERT) - Z_SAP_GRC_AC_RAR_MITIGATION_CONTROL_ALERT_GENERATION
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob setStatus
INFO: Job ID: 16 Status: Running
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob updateJobHistory
FINEST: --- @@@@@@@@@@@ Updating the Job History -
1@@Msg is Z_SAP_GRC_AC_RAR_MITIGATION_CONTROL_ALERT_GENERATION started :threadid: 2
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.dao.BgJobHistoryDAO insert
INFO: -
Background Job History: job id=16, status=1, message=Z_SAP_GRC_AC_RAR_MITIGATION_CONTROL_ALERT_GENERATION started :threadid: 2
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob alertGen
INFO: @@@ Alert Generation Started @@@
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob alertGen
INFO: @@@ Conflict Risk Input has 1 records @@@
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob alertGen
INFO: @@@ Critical Risk Input has 1 records @@@
Mar 28, 2011 4:00:00 AM com.virsa.cc.xsys.bg.BgJob alertGen
INFO: @@@ Mitigation Monitor Control Input has 1 records @@@
Mar 28, 2011 4:00:00 AM com.virsa.cc.comp.BackendAccessInterface alertGenerate
INFO: @@@@@ Backend Access Interface execution has been started @@@@@
Mar 28, 2011 4:00:00 AM com.virsa.cc.common.util.ExceptionUtil logError
SEVERE: null
java.lang.NullPointerException
     at com.virsa.cc.comp.wdp.IPublicBackendAccessInterface$IStatRecInputElement.wdGetObject(IPublicBackendAccessInterface.java)
     at com.sap.tc.webdynpro.progmodel.context.NodeElement.getAttributeAsText(NodeElement.java:888)
     at com.virsa.cc.comp.BackendAccessInterface.execBAPI(BackendAccessInterface.java:401)
     at com.virsa.cc.comp.BackendAccessInterface.executeBAPI(BackendAccessInterface.java:302)
     at com.virsa.cc.comp.BackendAccessInterface.get_TcodeLog_Rec(BackendAccessInterface.java:2800)
     at com.virsa.cc.comp.BackendAccessInterface.alertGenerate(BackendAccessInterface.java:1940)
     at com.virsa.cc.comp.wdp.InternalBackendAccessInterface.alertGenerate(InternalBackendAccessInterface.java:4355)
     at com.virsa.cc.comp.wdp.InternalBackendAccessInterface$External.alertGenerate(InternalBackendAccessInterface.java:4824)
     at com.virsa.cc.xsys.bg.BgJob.alertGen(BgJob.java:1666)
     at com.virsa.cc.xsys.bg.BgJob.runJob(BgJob.java:697)
     at com.virsa.cc.xsys.bg.BgJob.run(BgJob.java:362)
here it keeps ranting on for pages about Null Pointer Exceptions
I'll just leave that part out
Mar 28, 2011 4:00:29 AM com.virsa.cc.comp.BackendAccessInterface alertGenerate
INFO: -
No of Records Inserted in ALTCDLOG =>16 For System =>XXX_xxx -
Mar 28, 2011 4:00:29 AM com.virsa.cc.comp.BackendAccessInterface alertGenerate
INFO: ==$$$===Notif Current Date=>2011-03-28==$$$==Notif Current Time=>04:00:00===$$$===
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.mgmbground.dao.AlertStats execute
INFO: Start AlertStats.............
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.bg.BgJob alertGen
INFO: @@@=== Alert Generation Completed Successfully!===@@@
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.bg.BgJob setStatus
INFO: Job ID: 16 Status: Complete
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.bg.BgJob updateJobHistory
FINEST: --- @@@@@@@@@@@ Updating the Job History -
0@@Msg is Job Completed successfully
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.bg.dao.BgJobHistoryDAO insert
INFO: -
Background Job History: job id=16, status=0, message=Job Completed successfully
Mar 28, 2011 4:00:29 AM com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob scheduleJob
INFO: -
Complted Job =>16----
- Anothjer thing I noticed is that the job always adds some entries to table "ALTCDLOG" which I guess means something like "Alert T-Code Log".
It always adds entries like:
581 XXX_XXX userID#1 SE16 2011-03-21 07:49:44 xxx 5
582 XXX_XXX userID#1 SM37 2011-03-21 07:55:44 xxx 5
Where does the system get the information which T-Codes are "bad" and for which it needs to create those entries ? I have never configured anything like that in the system.
Or is this an indicator that the authorization roles I mitigated have been used again ?
Regards,
Benjamin

GRC AC DATA MART CONFIGURATION

Hi All,
We are on GRC AC 5.3 SP 11. The customer wants to use the Data Mart functionality with crystal report 2008 for custom reporting purpose. In my knowledge this functionality is available in AC since SP 9. But don't know the exact procedure to go ahead and configure the same. Though I have gone through couple of documents available on SDN on this, no document is Step by step.Can anyone please suggest me any detailed configuration guide available in SMP/SDN or on web.
Thanks in Advance.
Best Regards,
Guru

Hi Gangadhar,
I have already gone through the AC config guide and the notes mentioned by you and some other available docs also. But nowhere it is detailed and step by step. Is there any detailed document or step-by-step on the same. Because in the config guide it has been given the steps need to be performed in the GRC AC side. To view the custom report in Crystal Reports 2008, what configurations need to be done there is no such details. However I have got some other docs like, 'SAP BUSINESSOBJECTS ACCESS CONTROL 5.3 SP09 DATA MART u2013 SAMPLE REPORTS', from SDN where it has been given the frontend configurations. But I am confused where to start and how to get the custom reports after doing the necessary configurations. Any idea on the same.
Thanks,
Guru

GRC AC CUP LDAP configuration

Dear team,
I am facing issues with one of my LDAP connections. Users beloning to one particular LDAP are not able to login to the self-provisioning link on CUP. The system log returns 'nulpointer' exception, which generally comes on incorrect logon credentials.
I have checked the user in the connector. It exists and is working well.
The only point is this LDAP is my 6th. How do I make this working?

Assuming User Data Source is pointing to LDAP;
Please check the Connector User[Configuration Tab-> Available Connectors->select the LDAP Connector] between the LDAP and GRC AC CUP is locked .Unlock It and save .
Then check is TEST CONNECTION is successful.
Regards
Ajit.

GRC AC v10 NWBC: Configure LaunchPad for Menus

I would like to add a new menu Launchpad, but am having trouble getting it to appear in NWBC.
I followed the instructions at: http://scn.sap.com/community/grc/blog/2014/01/31/configure-launchpad-for-menus
However, it still does not appear.
Any help would be appreciated.
thanks,
-john

Dear John,
did you authorize the end user for the application? If the user is missing authorization the work center is not applicable in the screen. Hence the user cannot see it.
Regards,
Alessandro

GRC AC 10 CUA Configuration for Data Sources

When using CUA as the search data source in GRC AC 10.0 the search is not working. If I change the data source to my ECC system it works fine. Also trying to use CUA as the first sequence in the Details sources, but it does not work either. Also noticed that the details sources only seems to recognize one sequence when multiple sequences are setup. Has anyone come across this as a problem?

Hi all,
I agree with Patrick, I received the answer from SAP, that once a user is found in a detail data source, GRC will take all data from this data source and not continue looking in the following details systems.
Eg. USER1 is existing in CUA and HR, it will find the user in the CUA system, take email, phone no etc from CUA but will not continue looking for e.g. the missing personnel no data in HR.
USER2 is existing in HR only but not in CUA - GRC will take the detail data from HR only.
Did you try these scenarios?
Regards
Daniela

Change Management & Change Transport Process in GRC AC RAR

With RAR not being able to leverage the SAP ABAP Change Management Process (CTS) what is the best practise for controlling the changes for RAR rule set ?
How do we acheive job segregation from
1. Making Changes to Rules in Dev RAR
2. Transporting (Importing) them to RAR Prod
How do we make sure the 'Import Rules' functionality is restricted. ? (Can we remove Action 'ImportRules' from all the roles and restrict that to one role & restrict the administrator from making role assignments directly in RAR (Only from CUP) )
Thanks

Hi Prashanth,
You can restrict the access by removing the action ImportRules from the customized role that you can create in UME for RAR.
Thanks,
Darshan

Migration of GRC AC 5.2 configurations into GRC AC 5.3

Hello,
I already have GRC AC 5.2 on 1 system. We have GRC AC 5.3 installed on a seperate system.
We would like to download/ upload all the rules, functions, risks, mitigations etc from old GRC AC 5.2 to new GRC AC 5.3 system.
My query is.
What would be the best approach among the below 3 options.
Option 1- Download rules, functions, risks, mitigations from old GRC AC 5.2 and upload them to new GRC AC 5.3 system. (I assume it will append)
Option 2- Export rules, functions, risks, mitigations from old GRC AC 5.2 and Import them to new GRC AC 5.3 system. (I assume it is overwrite)
Option 3- Install GRC AC 5.3 System and upload 5.3 ruleset, functions, risks and mitigations and then download 5.2 rules, risks, mitigations, and upload them in 5.3?
Thanks for your valuable inputs in advance.
Thanks,
Haleem

Haleem,
Here is my respone:
Option 1: This is not even an option. There is no way you can download and upload the files with append option. Append option requires files in totally different format.
Option 2: This may or may not work. I have never done it.
Option 3: This is your best bet.
Alpesh

GRC AC RAR - long time for user analysis

Hi all,
we have scheduled a Risk Analysys at permission level with 2.000 users. Looking at report log we see that each user is processed in around 2 seconds. The system seems to be freezed at 41% to a specific user. Now it is working on this single user since 2 hours.
Any suggestions to uderstand why it happens ?
What can we look at ?
Andrea

First of all check the Directory where you are storing the RTA extracts to get populated in RAR analysis engine. Also check the Batch Job daemon from your browser by using the url: http://<servername>:port/webdynpro/dispatcher/virsa/ccappcomp/BgJobStart?debug=1
Next check can be at connector level. Try to generate the Rule Set for all the Rule Ids. If the Rule set generation also takes longer time than earlier cases then you may need to check the following notes and their suggestions:
[Note 1121978 - Recommended settings to improve peformance risk analysis|https://websmp130.sap-ag.de/sap%28bD1lbiZjPTAwMQ==%29/bc/bsp/spn/sapnotes/index2.htm?numm=0001121978&nlang=E]
[Note 986997 - Risk Analysis & Remediation tuning for optimal performance|https://websmp130.sap-ag.de/sap%28bD1lbiZjPTAwMQ==%29/bc/bsp/spn/sapnotes/index2.htm?numm=0000986997&nlang=E]
Also based on the DB you are using you may need to check some other notes as well. For e.g.:
1313116 - Performance issues when running Risk Analysis in RAR w/MaxDB
Also to be in the safer side make sure that you are on the updated support pack level. Like SP 14 atleast for AC 5.2 or SP 8 for AC 5.3
Regards,
Dipanjan

GRC - AC - RAR - DataMart Configuration

Similar Messages

Maybe you are looking for