GRC AC10 EUP Repeated Descriptions

Hello,
I have an EUP ID we created (100). We want to change the fields but when we make an entry the description gets repeated with a different setting. In other words, when we select the entry to change it, it doesn't just change, it creates an additional line with the desired entry. Any thoughts? Please help. Im on SP14 GRC AC10. I have attached the screenshot.

Gustavo,
Very strange And surprised to see this kind of behaviour!
Just to check, what happens if you try to configure your settings for both of the entries? Does it accept and works as expected?
At least we can play with this work around.
Regards,
Faisal

Similar Messages

Functions and Permission in GRC AC10.0

Hi All,
We are creating the custom functions as a part of custom rule set creation in GRC AC10.0. We have defined the custom function as shown in the below example table(first table) . We uploaded the custome rule set with mass upload transaction and generated it. We noticed that the system is interpreting the values in the condition column differently than we mentioned in the upload files.
Does any one has idea on this? How the system evaluates the condition column?
Below is the one example and we have number of cases like this.
Uploaded with values
Fun ction
Transaction
Auth object
Field
value From
Value To
Condition
ZXXXX
SU10
S_USER_GRP
ACTVT
1
2
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
5
6
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
22
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
50
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
78
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
PP
AND
Values in the system after upload
Fun ction
Transaction
Auth object
Field
value From
Value To
Condition
ZXXXX
SU10
S_USER_GRP
ACTVT
1
2
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
5
6
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
22
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
50
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
78
OR
ZXXXX
SU10
S_USER_GRP
ACTVT
PP
OR
Thanks in advance for your help
Hari

Hi Colleen,
Thanks for the reply.
my doubts got clarified after referring the below notes, but they are related GRC 5.3.
I hope the same logic will apply to GRC 10.0 also. Please let me know if you have any additional information.
1330165 - Instructions on how to use Operators AND OR NOT
1358952 - Rule Architect - logic of the NOT operator
Cheers
Hari

GRC AC10 sync job error

Hi Experts,
I am getting error while running sync job. I searched but couldn't find a solution.
We have two GRC AC10 clients setup, one is for fresh AC10 installation testing and another is for migration testing.
Both clients talk to two different ECC clients. Issue is that we have setup all SPRO configurations, plug-in settings and stuff which is described in AC10 post -installation and migration documents,
Sync job for one client is successful, but sync job for another client is giving error -
Error message -
Starting authorization sync for connector IE9_600 and language EN
Error in IE9_600; Reason Error in RFC; 'Function module "/GRCPI/GRIA_AUTH_G
PFCG authorization sync failed with errors
I have checked plugin settings, RFC and other settings, it seems ok as it is in another client.
What could be the cause and solution? Any suggestions are highly appreciated.
Thanks in advance,
Regards,
Sabita

The issue resolved, RFC was incorrectly pointed to wrong client.
Regards,
Sabita

GRC AC10 Mitigation Control Temporary Tables

Hi everyone,
I'm trying to find the table where GRC stores the organizational unit for a new mitigation control before the request is approved. As I could see, after approval (when the control is created) they are moved to HRP1000, 1001, etc.
I've also tried with system trace (ST01 and ST05) but I could only find these tables: GRFNMWRTINST, GRFNMWRTINSTAPPL. Unfortunately I've checked them but they don't store OU data.
Maybe it is stored in an XML file and that's why I cant reach the table.
If you have any idea or any experience to share, I would really appreciate it!
Thanks and regards,
Fernando

Hi Fernando
Maybe it is stored in an XML file and that's why I cant reach the table.
I was trying to figure out the same thing and suspected that was the case. Or if there might be a temporary text file
I hope someone here can clear it up. But it's a bit annoying in the approach as you cannot tell what changes have been requested or compare changes to current. Hope SAP eventually cleans this up.
Might need to trace it to identify the function module that is used by approver to view the request?
Regards
Colleen

Search request issue in GRC AC10.0

Hello Experts,
When we want to check the status of the request logged by others by using the below option we are not getting any results
GRC 10.0 with SP14.
My Home ->My Profile -> Request Status then click on the Change Query. In the Change query screen enter the request number created by others and click on Preview.
This is not authorization issue. We tested with user having SAP_ALL authorization.
Does anyone has any idea?
Thanks in advance
Hari

Hi Hari,
When we talk about page My Home / My Profile, this shows the information which is related to me/us only. If end user logon using this page/link, he/she can see his/her own data.
Change Query is to filter the existing data which comes at the time of loading/refreshing the window. This should not show data out of scope.
So request status using my home page would not be able to show data for other users.
Search Request link is the only way to check others request data.
Thanks & Regards
Neeraj

GRC AC10 RAR :"Ignore Critical Roles/Profile" option not available in

Hello Gurus,
I have configured RAR and the reports are working as usual , but i observed that i could not see two things
1) Option to select "IGNORE CRITICAL ROLES/PROFILE" during Role/User ANALYSIS under "Reports & Analytic" tab.
I checked in SPRO>GRC>AC-->Maintain Config Settings
There is a parameter "Ignore Critical Roles/ Profiles" which i first set to "Yes" and then checked in NWBC , i was unable to see the option under "Additional Option".
Later i changed SPRO setting to "NO" , then again it did not show me .
Where can i find this option , so that if i upload say 10 roles which are assigned to firefighter ID they should not be analyzed for RAR ??
2) I also could not find any option to upload "DEFAULT roles" which need to be assigned to any "NEW USER" request coming through CUP ??
Where can we make this setting, so that the basic roles can get assigned to the user when any new user request comes in.
Will you please put some light on this area ?
Thanks in advance.
Regards,
Victor

Hi Johanna
Have you run the synchronization job subsequent to the configuration of critical roles / profiles ? If not so try running the Synchronization job and then try risk analysis.
Regards
Swarna

GRC AC10 Agent based upon Role Attributes

Hi Experts,
Need your help on the issue.
We are trying to achieve below configuration-
After the Access request is generated, at the first stage, the approver should be selected based upon the business process of the role. If there are multiple roles with different Business Processes and their approvers, all of them should approve the request and then request should go to the next stage.
There is also a field Business Process in the Access Request Screen which denotes the User's association with Business Process and not of the role. We are able to trigger the approval based upon this field, but we can;t find any option of approver selection based upon the business process of the role.
Can some one show a way to achieve that?
We are facing another problem, when the request is approved based upon the field Business Process in the Access Request screen, we are not able to find the request in next stage, it is still showing in the same stage while the role attached is only one and no other approver defined.
What could be the reason behind it? Any help is highly appreciated.
Thanks in advance,
Sabita

Hello Sabita,
You can use the transaction : GRFNMW_DBGMONITOR_WD to check the logs.
What i understand from your requirement and what would be my approach.
1) Approvers who will be ROLE OWNERS
> In this case 1st thing is you should upload few ROLES( NWBC>Access Mgmt-->Role Import) with all the details i.e function area, company , role owner, alternate approver
---> Now create a "Custom Initiator from SPRO >GRC>AC>workflow for access control>Define Worflow Related to MSMP rules for Process ID SAP_GRAC_ACCESS_REQUEST
Run Tx: BRF+ , and you will see a rule created , drill down to "Expression-->Decision Tree"
and use "Table settings" to select "Condition Column" & "Result Rule sets", where you can configure the Custom Initiator
Now run Open MSMP workflow config window
1) Process Global settings ( Notification details if necessary)
2) Maintain Rules (add your custom initiator rule )
3) Maintain agents ( check & if not present add Role owner agent)
i.e. GRAC_AR_ROLE_OWNER (This will satisfy 1 st requirement)
Create a new agent as BSM and mapp them as "directly mapped user" , similarly for the 3rd stage you can use directly mapped user.
4)Variables & Templates --> Skip
5)Maintain Path ( add 3 stages as required i.e role owner, BSM & security officer)
Now for each stage click on "modify Task Settings" & click on individual check boxes as relevant , you can select "All approvers" or "Any one approver", Approve Request based on System & Role , or Request .
Same applies to all the other 2 stages.
6) Maint Route Mapping --> put the path ID created in previous stage and save and activate.
I hope this should give you some fair idea.
Thanks
Victor

SAP GRC AC10 Common Practices on Mitigation Control

Hi all,
Currently, our company is implementing the GRC tool globally and we are required to set up mitigation control. I would like to get some ideas about what structures are used in various companies. And are those mitigation control align with the internal audit practices?
We are having some initial idea that setting up template for those mitigation control, but should these be applied to all companies? And if we set up in this way, do we still need to identify any approver and monitor in local organization?
And the mitigation controls should be owned by global organization or compliance department or local organization?
Please help.
Thx!

Hi "GRC_SAP_AUDIT"
I presume that you have a single Global Ruleset used within the company to define the risks across the company, but some risks may not be applicable or realistically avoidable in certain parts of the organisation in different countries due to the possible nature of a "Small office" structure (i.e. a small team doing various types of job tasks which are bound to cause SOD conflicts etc). So you may want to create a control for a risk in one area/region, but not for another. This is all possible with GRC AC.
You can have a Specific Risk assigned to as many Mitigating Control definitions; therefore if you had different controls in different countries for that risk, e.g. UK Risk F001 is to have control X applied, whilst USA Risk F001 is to have control Y applied, it is good practice to define it that way.
With the example above, you can then assign regional Control Owners and Monitors. Usually, I recommend giving the ownership of controls to the regional/company/departmental leads (depending on your org structure) who would manage the control, as I strongly feel that this has to be business driven. The decision of what approach to take is yours, as you have to see what will be the best solution to implement within your organisation.
Hope this helps. If you wish to add any further detail, im sure the forum members are happy to help.

GRC AC10 Risk analysis error

Hi Experts,
We are getting error in Risk analysis.
We have checked configuration, RFC, Batch Jobs, Rule Generation.
Rules are showing active in Rules library, User and Roles are appearing while searching. I searched SMP for notes and sdn for similar issue but couldn't find anyone.
During risk analysis, explorer gives dump -
The URL call http://itdgrctest.itconline.in:8002/sap/bc/webdynpro/SAP/grac_sod_search_appln was terminated because of an error.
Note
The following error occurred in system G10 : File Could not be opened
The error occurred on application server ITDGRCTEST_G10_02 and in work process 4 .
The termination type was: ERROR_MESSAGE_STATE
The ABAP call stack was:
Method: UPDATE_FILE_DATA_DETAIL of program CL_GRAC_SOD_REPORTING=========CP
Method: SET_VIOLATIONS of program CL_GRAC_SOD_REPORTING=========CP
Method: WRITE_OUTPUT_TO_DB of program CL_GRAC_SOD_RISK_ANALYSIS=====CP
Method: RISK_ANALYSIS of program CL_GRAC_SOD_RISK_ANALYSIS=====CP
Method: DO_RISK_ANALYSIS of program /1BCWDY/0O2TMNDMBELX0AO58TG7==CP
Method: IWCI_GRAC_RISK_ANALYSIS~DO_RISK_ANALYSIS of program /1BCWDY/0O2TMNDMBELX0AO58TG7==CP
Method: EXECUTE_ANALYSIS of program /1BCWDY/0O2TMNDMBFK6DDPI1C1Q==CP
Method: IF_SEARCH_VIEW~EXECUTE_ANALYSIS of program /1BCWDY/0O2TMNDMBFK6DDPI1C1Q==CP
Method: ONACTIONSEARCH of program /1BCWDY/0O2TMNDMBFK6DDPI1C1Q==CP
Method: IF_WDR_VIEW_DELEGATE~WD_INVOKE_EVENT_HANDLER of program /1BCWDY/0O2TMNDMBFK6DDPI1C1Q==CP
What can I do?
If the termination type is RABAX_STATE, you will find more information on the cause of termination in system G10 in transaction ST22.
If the termination type is ABORT_MESSAGE_STATE, you will find more information on the cause of termination on the application server ITDGRCTEST_G10_02 in transaction SM21.
If the termination type is ERROR_MESSAGE_STATE, you can search for further information in the trace file for the work process 4 in transaction ST11 on the application server. ITDGRCTEST_G10_02 . You may also need to analyze the trace files of other work processes.
If you do not yet have a user ID, contact your system adminmistrator.
Error Code: ICF-IE-http -c: 600 -u: SABITADA -l: E -s: G10 -i: ITDGRCTEST_G10_02 -w: 4 -d: 20111115 -t: 162851 -v: ERROR_MESSAGE_STATE -e: File Could not be opened -X: 005056A41E8C1ED183EF148A3F5AFCCF_005056A41E8C1ED183EF142157E41CCF_1 -x: A4780FE1FA51F1DD9CCF005056A41E8C
The termination type was: ERROR_MESSAGE_STATE, we I checked in St11. There error log is -
N *** ERROR => System ID and client from ticket are not the same than mine. [ssoxxkrn.c   1061]
N {root-id=005056A41E8C1ED183EEA264CAA11CCF}_{conn-id=005056A41E8C1ED183EEA264C5BA5CCF}_1
N *** ERROR => Neither was ticket issued by myself nor can I find issuer in TWPSSO2ACL (see note 1055856). [ssoxxkrn.c   1067]
N {root-id=005056A41E8C1ED183EEA264CAA11CCF}_{conn-id=005056A41E8C1ED183EEA264C5BA5CCF}_1
M
M Tue Nov 15 16:02:49 2011
M *** ERROR => AdCvtRecToExt: unknown opcode 71 (AD_OPCODE_71), ser 0, ex 0, errno 0 [adxx.c       2472]
M {root-id=005056A41E8C1ED183EEA4E10D4C3CCF}_{conn-id=00000000000000000000000000000000}_0
M *** ERROR => AdCvtRecToInt: unknown opcode 71 (AD_OPCODE_71), ser 0, ex 1, errno 1 [adxx.c       2530]
M {root-id=005056A41E8C1ED183EEA4E10D4C3CCF}_{conn-id=00000000000000000000000000000000}_0
M
If anyone has encountered the similar issue and has found a solution, please reply.
Thanks in advance, Regards,
Sabita

Hi Experts,
Iam also facing the same issue as below..
Please let me konow if nay one of you encountered same issue and how you resolved..
Error while processing your query
What has happened?
The URL call http://yashgrcsrv.sapyash.com:8010/sap/bc/webdynpro/SAP/GRAC_UI_SPM_OWNER_POWL was terminated because of an error.
Note
The following error text was processed in system G10 : The ASSERT condition was violated.
The error occurred on the application server YASHGRCSRV_G10_10 and in the work process 1 .
The termination type was: RABAX_STATE
The ABAP call stack was:
Method: IF_POWL_FEEDER~HANDLE_ACTION of program CL_GRAC_POWL_SPM_FFOWNER======CP
Method: FEEDER_HANDLE_ACTION of program CL_POWL_MODEL=================CP
Method: DISPATCH_ACTION of program CL_POWL_MODEL=================CP
Method: DISPATCH_PREPARED_ACTION of program CL_POWL_TABLE_HELPER==========CP
Method: ON_OBJECT_ACTION of program /1BCWDY/07CT55XNN6UHRCSZMBJE==CP
Method: IF_TABLE_DATA~ON_OBJECT_ACTION of program /1BCWDY/07CT55XNN6UHRCSZMBJE==CP
Method: ON_TOOLBAR_OBJECT_ACTION of program /1BCWDY/07CT55XNN6UHRCSZMBJE==CP
Method: ON_TOOLBAR_OBJECT_ACTION of program /1BCWDY/07CT55XNN6UHRCSZMBJE==CP
Method: IF_WDR_VIEW_DELEGATE~WD_INVOKE_EVENT_HANDLER of program /1BCWDY/07CT55XNN6UHRCSZMBJE==CP
Method: INVOKE_EVENTHANDLER of program CL_WDR_DELEGATING_VIEW========CP
What can I do?
If the termination type is RABAX_STATE, you will find more information on the cause of termination in system G10 in transaction ST22.
If the termination type is ABORT_MESSAGE_STATE, you will find more information on the cause of termination on the application server YASHGRCSRV_G10_10 in transaction SM21.
If the termination type is ERROR_MESSAGE_STATE, you cansearch for further information in the trace file for the work process 1 in transaction ST11 on the application server. YASHGRCSRV_G10_10 . You may also need to analyze the trace files of other work processes.
If you do not yet have a user ID, contact your system adminmistrator.
Error Code: ICF-IE-http -c: 100 -u: GRCADMIN -l: E -s: G10 -i: YASHGRCSRV_G10_10 -w: 1 -d: 20111117 -t: 124258 -v: RABAX_STATE -e: ASSERTION_FAILED -X: 00188B01D3231EE1849D72367EF328EF_00188B01D3231EE1849D723252D408EF_1 -x: 91EB10E1F7B3F19FA8EF00188B01D323
HTTP 500 - Internal Server Error
Your SAP Internet Communication Framework Team
Regards,
Ravi Alluri.

GRC AC10 Role Import.

Hi,
Can anyone please let me know the broad steps for importing the roles from SAP backend to GRC10? I am not quite sure about the options listed under the import source. My requirement is basically to import the roles from SAP backend and then maintain their attributes and approvers. Should I do it via file upload or can it be done directly via a sync of roles from the backend?
Thanks for your help!

It can be done both ways:
1. Through Backend - usually in case your naming conventions are good and match wtih the role atributes.
2. Through File - In the other case. Uslually this option is easy to take and go ahead with ease.
Regards,
Hersh

GRC AC10 - Fire Fighter ID Question

Hi SAP Gurus,
Can we do configuration to send an email once a week with SAP firfigher activity reports
Thanks
Madhu

G'Day Alessandro,
This is in response to your following comment:
in AC 10.X the functionality is given to use with dialog users. Each time you log-in the system changes the password so that the end-user doesn't know the password.
If that's the case what is the significance of enabling user exits? I mean there is no way the end user can login directly without knowing the password right?(come to think of it he/she will never know unless you give it to them). I would also appreciate if you can kindly explain how user exit works from firefighting point of view. I know it is to prevent users from logging in directly using SAP GUI. However for this to happen they need to know the password of the FFID right?
Regards,
Leo..

Connect CUP (in GRC 10.0) with ABAP CUA

Hi ,
Has anyone a short guide how to connect the CUP in GRC 10.0 with an ABAP CUA?
We would like to use the CUP to trigger the CUA for the deployment of the CUP assigned authorisations.
Thank you in advance!
Br,
Frank

Hi Frank,
There is one for SAP GRC 5.3 that you can access with the below link:
http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/80ee8c81-7812-2a10-ce91-e1be55f43491
The GRC AC10 documentation is not available.
May be this can be an input for the BPX team to create one
Regards,
Raghu

SAP IDM 7.2: How to setup SSO functionality for WebUI of CRM and GRC?

Hello IDM-experts,
where can my customer find information about
SAP IDM 7.2: How to setup SSO functionality for WebUI of CRM and GRC?
Customer situation description:
The situation is that we are using SAP IDM 7.2. We are using a functionality to allow our users to access a webpage from where they can gain
SSO access to the Abap systems via the SAPGui. See screenshot as an example.
Now what we want is to access the CRM and GRC WebUI also with the same SSO possibility. We cannot find any guide/best practice on how to do
this or if it is possible via SAP IDM 7.2.
You can see a weblink in the first screenshot but it does not work. It will ask you for a username and password, see second screenshot.
Kind regards,
Daniela

Do you know how the SAP GUI SSO is setup ? Is it using SNC/Kerberos ?
If it is (I suspect it is), then you will need to use similar method of authentication for the ICF Services. These cannot use SNC since they are accessed via browser, but what you want is possible.
Thanks
Tim

Hide the Description of KF, only show data

Hello all,
I have a scenario where in BEx Analyzer I see repeated description somewhat like this:
2005...no.Products
2006...no.Products
2007...no.Products
2008...no.Products
I have used 'query properties'-display-Hide repeated key figures (checked) but its not working for me.
Acutally I don't want to display description 'no. Products', only its data is important to show.
when I go into Properties of 'no.Products'-display- there I can use 'Hide' but then its does not show anything: not description 'no.Products' and also no data.
Also I tried to delete the description of this CKF and in that case the technical name of 'no. products' is shown in BEx Analyzer
is there any way where I show data but not the description
best regards
Ahmad

Thanks for replying
Well I have already tried this but this doesnot work for me. I have CKF 'no.Products' which is created at global level and using it in a query.
Selecting this KF-properties-General tab-description: 'no.Products' but when I delete this description and save the query then there is no effect in BEx Analyzer; still I can see 'no.Products'. I come back in Query designer and 'no.Products' Description is there (which I deleted myself).
I even created a new CKF 'no.Products' without any Description (where it show 'new calculated key figure') and used that in my query but in that case 'Technical name' of this CKF is shown in BEx Analyzer.
the scenario is
..................................................................Region1,Region2,Region3
2005...ProductCategory1...no.Products......30........40...........50
...........ProductCategory2...no.Products......35........45...........55
2006...ProductCategory1...no.Products......37........44...........30
...........ProductCategory2...no.Products.....111......34...........88
2007...ProductCategory1...no.Products.....49.........49..........49
...........ProductCategory2...no.Products.....28.........47..........02
2008...ProductCategory1...no.Products.....42.........42..........21
...........ProductCategory2...no.Products.....68.........43..........99
This description 'no.Products' I don't want to see, only its values like
............................................Region1,Region2,Region3
2005...ProductCategory1........30........40...........50
...........ProductCategory2........35........45...........55
2006...ProductCategory1........37........44...........30
...........ProductCategory2.......111......34...........88
2007...ProductCategory1.......49.........49..........49
...........ProductCategory2.......28.........47..........02
2008...ProductCategory1.......42.........42..........21
...........ProductCategory2.......68.........43..........99
Also tried 'hide repeated KF' in Query properties. It works fine for the year where I see 2005 only once not repeatedly but not for 'no.Products'. Acutally I don't need this description 'no.Productrs' at all.
any solution to it
Best regards
Ahmad

Maintaining role detailed description(i.e long text) issue

Dear Experts,
Can anyone help me out with the issue which i'm facing while maintaining role detailed description(i.e long text) .
In standard GRC approver screen, on click on any technical role it opens role details popup where we have one tab namely detailed description.
Can any one let me know where to maintain that role detail description or from where (any table)it fetches the role detailed description?
PFB the snapshot for reference.
Thanks
KH

Hi Katrice,
what SP are you on?
This role detailed description is maintained at backend system (PFCG) during role creation.
This information is later replicated to SAP GRC BRM (role detailed description as on your screen shoot) during role rep sync jobs.
This data can be also maintained in SAP GRC (define stage) during role creation.
If I remember correctly from SP14 this information once updated in BRM is later populated to ECC (both way sync).
Hope this helps,
Filip

GRC AC10 EUP Repeated Descriptions

Similar Messages

Maybe you are looking for