GRC - Security Administrator task

I have the intermediate knowledge about installing, configuring and administration of all the 4 components of GRC. I know how to interconnect all of them, wherever possible. I tried to go through some of the GRC Forums and found mostly related to my current knowledge about using and configuring GRC Components.
Now would like to know, if this is sufficient for a security admin career in SAP GRC. Do I need more knowledge about some other topics. All the SOD and risk are categorized by Functional owners, therefore, I dont have much idea about them, i only know the administration of GRC.
Thanks,
Sanjay

Hi Sanjay,
Following few areas that I would recommend:
- Knowledge of Web-services of Access Control
- Integration knowledge of Access Control with IDM
- Integration knowledge of Access Control with BI for reporting purpose
- Knowledge of Greenlight adapters for Non-SAP systems
Information for above topics is available on BPx --> How-to-Guides. Following is the link:
https://wiki.sdn.sap.com/wiki/display/BPX/Governance%2C%20Risk%2C%20and%20Compliance%20%28GRC%29%20How-To%20Guides
Where as documents for Greenlight adapters are part of the adapter software.
Best Regards,
Sirish Gullapalli.

Similar Messages

CAreer in SAP BASIS comaprision with SAP GRC/Security

Hi Everyone,
I am an SAP BASIS consultant with 2 years of experience working in a MNC company,
I want to change my career to SAP GRC/SAP Security, i have some basic knowledge on SAP Security,
COuld you please advice me, which one to choose,?
Does SAP GRC/Security has demand , and can we get oportunities to work abroad compared to SAP BASIS ?
which one has more scope SAP BASIS or SAP Security/GRC ?
Because in BASIS, i am not getting enough scope to work on some good things like Installation, upgrades, Migration,
i am doing a very basic kind of work like tranports, job scheduling, monitoring, and other small activities ?
So request you people to advice me ?
<removed_by_moderator>
Read the "Rules of Engagement"
regards
Rakesh Rao
Message was edited by: Juan Reyes

Hi Rakesh
I saw your post in GRC and was waiting of it to appear here
First up - 2 years is still junior. You may find batch jobs, transports, monitoring, etc all mundane but it is a foundation and learning ground work and foundations to being a good Basis Administration. And one things for sure, an awesome basic (I name my best-techy-friend) makes a huge difference on project timelines and deliverables for the rest of us.
Installation and Upgrades come with time. Whilst still performing junior tasks you could focus on reading up on approaches in case an opportunity in your job comes us and be prepared to prove to your management that you are ready for a bigger responsibility.
Switching to GRC/Security would be pointless unless you have a desire to learn GRC or Security. These are my background and they are undervalued until things go wrong (insurance policy in a way).
If you do switch you will reset your 2 years of domain experience back to 0 and you will start off with password resets and basic user administration
It takes time to work through the ranks. It was 3 years before I got to build my first role. I spent my first few years in security on email chasing approvals, password resets, user account creation, running reports for audit - sounds familiar to what you are doing now?
You have to master the basics before you are trusted and ready for the more complex activities. By knowing what you are doing now you will be more successful when the time comes to step up and do migrations, upgrades and installations. Support production by mastering you technical analysis skills is how you can break through being a fresher/junior
Regards
Colleen
Ps - if your motivation is more than "good things" happy to answer questions specific to security and GRC.
Also, boring doesn't mean it can't get interesting nor does it mean it's a worthless activity: SPAU transport imported before patching!!
Message was edited by: Colleen Lee
Added link for when transports go bad

Channel stopped by administrative task - ADAPTER.JAVA_EXCEPTION

Hi Guys,
             Adapter engine at RWB has the following error message.
==== Events on Server 44769350 ====
Adapter Engine, message: Fatal DeleteJob (Default Delete Job) failed.
(Details: Code: MS.JOB.DELETE, Location: com.sap.aii.af.ra.ms.impl.core.archiving.executor.DeleteExecutor, Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Failed to delete unassigned audit log entry keys. Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Could not get unassigned audit log entry keys, due to: ORA-01089: immediate shutdown in progress - no operations are permitted
, Time: 08.03.2009 10:00:15)
Adapter Engine, message: Fatal DeleteJob (Default Delete Job) failed.
(Details: Code: MS.JOB.DELETE, Location: com.sap.aii.af.ra.ms.impl.core.archiving.executor.DeleteExecutor, Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Failed to delete unassigned audit log entry keys. Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Could not get unassigned audit log entry keys, due to: ORA-01089: immediate shutdown in progress - no operations are permitted
, Time: 15.02.2009 10:00:11)
Adapter Engine, message: Fatal DeleteJob (Default Delete Job) failed.
(Details: Code: MS.JOB.DELETE, Location: com.sap.aii.af.ra.ms.impl.core.archiving.executor.DeleteExecutor, Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Failed to delete unassigned audit log entry keys. Reason: com.sap.aii.af.ra.ms.api.DeliveryException: Could not get unassigned audit log entry keys, due to: ORA-01089: immediate shutdown in progress - no operations are permitted
, Time: 01.02.2009 10:00:20)
At the adapter engine monitoring at RWB
Adapter type JPR has following error message
SLD host:port = ERPDEV02:50400
Error getting JPR configuration from SLD. Exception: No entity of class SAP_BusinessSystem for DXI.SystemHome.erpdev02 found
No access to get JPR configuration
I am getting following error when try to send a file from other business system to XI server.
<SOAP:Envelope xmlns:SOAP=''http://schemas.xmlsoap.org/soap/envelope/''><SOAP:Header/><SOAP:Body/></SOAP:Envelope>
as the response.
<?xml version='1.0'?>

<SOAP:Envelope xmlns:SOAP='http://schemas.xmlsoap.org/soap/envelope/'>
<SOAP:Body>
    <SOAP:Fault>
      <faultcode>SOAP:Server</faultcode>
      <faultstring>Server Error</faultstring>
      <detail>
        <s:SystemError xmlns:s='http://sap.com/xi/WebService/xi2.0'>
          <context>XIAdapter</context>
          <code>ADAPTER.JAVA_EXCEPTION</code>
          <text><![CDATA[
com.sap.aii.af.service.administration.api.cpa.CPAChannelStoppedException: Channel stopped by administrative task.
                at com.sap.aii.af.service.administration.impl.cpa.CommonCPA.checkChannelState(CommonCPA.java:58)
                at com.sap.aii.af.service.administration.impl.cpa.LookupManagerDelegate.getCPAObject(LookupManagerDelegate.java:83)
                at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.setup(XISOAPAdapterBean.java:227)
                at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:689)
                at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl0_3.process(ModuleLocalLocalObjectImpl0_3.java:103)
                at com.sap.aii.af.mp.ejb.ModuleProcessorBean.process(ModuleProcessorBean.java:292)
                at com.sap.aii.af.mp.processor.ModuleProcessorLocalLocalObjectImpl0_0.process(ModuleProcessorLocalLocalObjectImpl0_0.java:103)
                at com.sap.aii.af.mp.soap.web.MessageServlet.callModuleProcessor(MessageServlet.java:174)
                at com.sap.aii.af.mp.soap.web.MessageServlet.doPost(MessageServlet.java:436)
                at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
                at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
                at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
                at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
                at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:387)
                at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:365)
                at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:944)
                at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:266)
                at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
                at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
                at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
                at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
                at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
                at java.security.AccessController.doPrivileged(Native Method)
                at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
                at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
          ]]></text>
        </s:SystemError>
      </detail>
    </SOAP:Fault>
</SOAP:Body>
</SOAP:Envelope>
Thanks for Ur time
Senthil

Hi Senthil,
As suggested by others there is no problem with your communication channels ,,, the problem you face is because Your DBA has initiated the SHUTDOWN IMMEDIATE command. This will shutdown Oracle and terminate all active operations.
Please tell him to start the services and Wait until Oracle has been restarted by your DBA.
Regards
joel

Error in SOAP sender CC. Channel stopped by administrative task.

I am getting an error in my SOAP sender communication chanel as follows;
com.sap.aii.af.ra.ms.api.DeliveryException: XIAdapterFramework:GENERAL:com.sap.aii.af.ra.ms.api.DeliveryException: Channel stopped by administrative task.
The channel is Active but still gets the same error. Any help would be appriciated.

RWB ---> Component Monitoring ---> Adapter Engine ---> Communication Channel Monitoring ---> Choose your CC and check its properties....check if it shows Channel Stopped...if yes then restart it.
Channel should be Active in ID and Started in RWB to work properly.
Regards,
Abhishek.

SOAP request to XI. error: "Channel stopped by administrative task"

Hi ,
We are working on SOAP --> XI --> Idoc scenario.
The webservice call is an Asynchronous one. I done the design and configuration and provided the WSDL to the webservice applicant. When they tried to send the message they are getting the following error.
HTTP/1.1 500 Internal Server Error
Set-Cookie: JSESSIONID=(xi-dev_XID_00)ID2003803250DB10535090330849072702End; Version=1; Domain=89.0.30.150; Path=/
Set-Cookie: saplb_*=(xi-dev_XID_00)5198450; Version=1; Path=/
Server: SAP J2EE Engine/7.00
Content-Type: text/xml; charset=utf-8
Date: Fri, 16 Jan 2009 00:57:14 GMT
Connection: close
<?xml version='1.0'?>

<SOAP:Envelope xmlns:SOAP='http://schemas.xmlsoap.org/soap/envelope/'>
<SOAP:Body>
    <SOAP:Fault>
      <faultcode>SOAP:Server</faultcode>
      <faultstring>Server Error</faultstring>
      <detail>
        <s:SystemError xmlns:s='http://sap.com/xi/WebService/xi2.0'>
          <context>XIAdapter</context>
          <code>ADAPTER.JAVA_EXCEPTION</code>
          <text><![CDATA[
com.sap.aii.af.service.administration.api.cpa.CPAChannelStoppedException: Channel stopped by administrative task.
     at com.sap.aii.af.service.administration.impl.cpa.CommonCPA.checkChannelState(CommonCPA.java:67)
     at com.sap.aii.af.service.administration.impl.cpa.LookupManagerDelegate.getCPAObject(LookupManagerDelegate.java:83)
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.setup(XISOAPAdapterBean.java:227)
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:689)
     at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl0_3.process(ModuleLocalLocalObjectImpl0_3.java:103)
     at com.sap.aii.af.mp.ejb.ModuleProcessorBean.process(ModuleProcessorBean.java:292)
     at com.sap.aii.af.mp.processor.M
In XI SOAP sender communication channel, it is showing as below in communication channel.
16/01/09   error occured
16/01/09   request received
Can anyone pls let me know what might be the problem.
Thanks
Seema.

Hi seema,
I hope you would be knownig that IDOC is Asynch.(well this has nothing to do with question).
Just stop and start your SOAP channel from RWB.
Thanks
Sunil Singh

Does OEM 12c supports for performing administration tasks on Oracle SOA Suite 10.1.3.5 environment ??

Hello Everyone,
I would like to start a discussion on the OEM 12c see if anyone has used for SOA Suite 10g. We are currently running on Oracle SOA Suite 10.1.3.5 we want to make use of OEM 12c for monitoring and perform administration activities. I have gone through some Oracle documents for OEM 12c,I found it's supported up to 10.1.3.4.However I am not so sure so I just wanted to clarify on this.
Can we install the client in Oracle Application Server/SOA OC4J container to perform any administration task,purging,patching,monitor interfaces etc.
I look forward to your valuable input and feedback on the discussion.
Best Regards,

Hi,
The zip p6511843_101330_Generic.zip contains a README.txt which explains the steps to be followed to apply this patch.
In the README.txt
Refer to Section2 point No.1.
Get the latest Opatch from metalink for bug 2617419.[this zip will contain a Opatch Directory].Extract this zip into your Oracle SOA home.[ex: C:/product/101.3.1/OracleAS_1]
Also make sure that the Opatch directory in set in the path.
Since we are running this Opatch on a Basic SOA installtion , you don't have to execute the changeNamesWindows.pl script[make sure that you have installed Basic version of SOA and not the Advanced].
This patch will not work on Advanced Install.
You can directly excute
opatch apply.
Follow the remaining steps mentioned in README.txt.
Thanks
Hot-Plug Team

CPAChannelStoppedException: Channel stopped by administrative task (SAP XI)

Hello friends.
I am running a interface to R3 from sap-xi, but the ejecutión return the next error:
Delivery of the message to the application using connection RFC_http://sap.com/xi/XI/System failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: Channel stopped by administrative task.: com.sap.aii.af.service.administration.api.cpa.CPAChannelStoppedException: Channel stopped by administrative task..
I need your help, but quickly. Many thanks
Cristian

Hi,
Are u using RFC adapter to communicate ? IF so find out RFC adapter service is active in Adapter Engine (Visual Admin)
Do the CPA Cache Refresh
Hope all adapter engine is active and running..
Check out these
Rgds,
Moorthy

Channel stopped by administrative task.

Hi dear experts,
I got following error in message:
com.sap.engine.interfaces.messaging.api.exception.MessagingException: com.sap.engine.interfaces.messaging.api.exception.MessagingException: XIAdapterFramework:GENERAL:com.sap.engine.interfaces.messaging.api.exception.MessagingException: com.sap.aii.af.service.administration.api.cpa.CPAChannelStoppedException: Channel stopped by administrative task.
Current state:
1. Communication channel where error appears is Active in Integration Directory.
2. CPACache full refresh, SLD Cachere fresh doesn't help.
3. Channel in RWB says that "Channel is running but has errors".
4. STOP/START of channel helps only till time when first message is comming, than again same error is comming up.
Any ideas how to make it running?
Marek

Hi,
@Greg: I tried Re-activate (InactiveActivate, ActiveActivate), but without success.
@Krishna: Simple RFC communication channel.
Before this error appeared there was another problem.. That's also only error in Adapter Log..
Error in processing caused by: com.sap.aii.adapter.rfc.afcommunication.RfcAFWException: RfcAdapter: receiver channel has static errors: can not instantiate RfcPool caused by: com.sap.aii.adapter.rfc.RfcAdapterException: error initializing RfcClientPool:com.sap.aii.adapter.rfc.core.repository.RfcRepositoryException: can not connect to destination system due to: com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION: Connect to message server host failed Connect_PM TYPE=B MSHOST=******* GROUP=SPACE R3NAME=*** MSSERV=**** PCS=1 LOCATION CPIC (TCP/IP) on local host with Unicode ERROR partner '******' not reached TIME Sat Feb 11 20:37:49 201 RELEASE 710 COMPONENT NI (network interface) VERSION 39 RC -10 MODULE nixxi.cpp LINE 3147 DETAIL NiPConnect2: ***** SYSTEM CALL connect ERRNO 79 ERRNO TEXT A remote host refused an attempted connect operation. COUNTER 5
After basis has done additional configuration (some SAP Note), restart of communication channel was successful, but new error came.. Actual one..

Error: All administrative tasks must go through an Administration Port

Hi,
I run weblogic's example MedRec as a cluster. I follow the
instruction and it works.
I have a java application (swing) connecting to the cluster.
When I set MedRec to use 7001 port for both admin and other
tasks, it works fine.
Now, I set weblogic to have separated administration port
(9002). I set ssl as requested. I can deploy ejbs to the
cluster from my swing application. So, the cluster setting
seems okay.
But I want to access ejbs from my swing application. When I
try to get InitialContext using url like "t3://mymachine:8001"
or "t3s://mymachine:7002" I get error:
"All administrative tasks must go through an Administration Port"
For my understanding, request an instance of InitialContext
is not an administration task. What is wrong here? What should I do?
Any information would be appreciated. Thanks in advance.

Jimmy Ivanov <[email protected]> writes:
If you use the admin credentials then its an admin task. Try using a
different user.
andy
Hi,
I run weblogic's example MedRec as a cluster. I follow the
instruction and it works.
I have a java application (swing) connecting to the cluster.
When I set MedRec to use 7001 port for both admin and other
tasks, it works fine.
Now, I set weblogic to have separated administration port
(9002). I set ssl as requested. I can deploy ejbs to the
cluster from my swing application. So, the cluster setting
seems okay.
But I want to access ejbs from my swing application. When I
try to get InitialContext using url like "t3://mymachine:8001"
or "t3s://mymachine:7002" I get error:
"All administrative tasks must go through an Administration Port"
For my understanding, request an instance of InitialContext
is not an administration task. What is wrong here? What should I do?
Any information would be appreciated. Thanks in advance.--

RDP to VDI 3 fails with 'Administrative Task closed the connection'

The RDP to the VDI 3 login page described in the page below would be a really useful feature for us. Unfortunately when I connect using MSTSC (Windows XP SP 3) the screen goes black, then a message pops up with 'The connection was closed by an administrative task' (or words to that effect).
Any idea on how to resolve this issue?
http://wikis.sun.com/display/VDI3/Accessing+Desktops+with+Microsoft+RDC
Thank you in advance for any replies,
Dono

Finally worked this one out.
Turns out I had two pools assigned but it still eludes me how to set one to the default...
Anyway, what was required was to clear the 'Prompt for credentials' and use the <username>::pool= etc etc to connect to the pool.
Doesn't render as quickly as using the Sun Ray DTU but it's good enough.
Many thanks,
Donovan

Administrative task don't show up in timesheet in Pwa 2010

One of the user project manager is not able to see Administrative task in his timesheet.We deleted and recreated the timesheet still it doesnt show up.

Might it be possible that he intentionally or by mistake deleted the administrative tasks for those 2 periods? I've just tested that it is possible to remove administrative tasks using the "remove task" feature.
Try to add the administrative task using "add row" then select "add a non-project activity" (approximative translation from french). You'll be able to add the removed admin tasks for the 2 periods, save the 2 timesheets and see if it
keeps it.
Then:
Hope this helps.
Guillaume Rouyre - MBA, MCP, MCTS

What are the data target administration tasks?

What are the data target administration tasks?

Hi,
Check this:-------
Urgent: Relevant Master Data Data Sources for FI-GL & FI-AP
http://help.sap.com/saphelp_nw04/helpdata/en/04/47a46e4e81ab4281bfb3bbd14825ca/frameset.htm
Regards,
Suman
Edited by: Suman Chakravarthy on Sep 28, 2011 7:33 AM

How secure a task sequence advertisement

Hello
We have a task sequence for the replacing of the OS. Only the local 1 level support should available do run this task sequence when he
is logged on.
When I advertise the
task sequence to this usergroupe the task sequence fails because task sequences can only be advertised to Computers.
How can I secure the task sequence that only a limited group of Users can run the task sequence?
minou

Here's an excerpt of the smsts.log:
Executing command line: smsswd.exe /run: ServiceUI.exe -process:explorer.exe %SYSTEMROOT%\System32\mshta.exe c:\safefolder\zticonf.hta TSManager 10/20/2010 2:02:06 PM 3824 (0x0EF0)
=======================[ smsswd.exe ] ======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
PackageID = '' InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
BaseVar = '', ContinueOnError='' InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
SwdAction = '0001' InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Command line for extension .exe is "%1" %* InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Set command line: Run command line InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Working dir 'C:\SafeFolder' InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Executing command line: Run command line InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Process completed with exit code 4294967295 InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Matched Processes InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Process Found: [explorer.exe] ID [1744] SESSION [1] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Logon Lookup InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
[winlogon.exe] Session: [1] PID [436] [Target Session [1] = Match] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Launch Process InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Program to launch : [C:\WINDOWS\System32\mshta.exe] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Command line : [C:\WINDOWS\System32\mshta.exe c:\safefolder\zticonf.hta] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
API [CreateProcessAsUser] Error: [5] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Exiting with [-1] InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
======================= InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Command line returned 4294967295 InstallSoftware 10/20/2010 2:02:06 PM 2908 (0x0B5C)
Process completed with exit code 4294967295 TSManager 10/20/2010 2:02:06 PM 3824 (0x0EF0)
!--------------------------------------------------------------------------------------------! TSManager 10/20/2010 2:02:06 PM 3824 (0x0EF0)
Failed to run the action: Require Password Input.
Unknown error (Error: FFFFFFFF; Source: Unknown) TSManager 10/20/2010 2:02:06 PM 3824 (0x0EF0)

Splitting Security Administration Permissions

Can I split Security Administration Permissions? I want to allow people to assign permissions to roles but not have access to delete users or change other users passwords. So can I write permissions for the roles and users screens separately? Ideally in
the long run I would like there to be a way for Only one person ie me(or one Admin) to be able to delete users and a way for uses to register themselves without nessisarily having access to the permission to assign themselves Roles.
Is any of this possible? Is there a way to maybe write my own security screens to overide Lightswitches build?

Again I wasn't reading this right I am an individual developer making no money to develop so I guess this is the same as VS pro just free for people in my situation
-thanks
link
Visual Studio Community 2013 includes all the great functionality of Visual Studio Professional 2013, designed and optimized for individual developers, students, open source contributors, and small teams and it has some limits on
Who Can Use It.
link
Q: Who can use Visual Studio Community?
A: Here’s how individual developers can use Visual Studio Community:
Any individual developer can use Visual Studio Community to create their own free or paid apps.
Here’s how Visual Studio Community can be used in organizations:
An unlimited number of users within an organization can use Visual Studio Community for the following scenarios: in a classroom learning environment, for academic research, or for contributing to open source projects.
For all other usage scenarios: In non-enterprise organizations, up to 5 users can use Visual Studio Community. In enterprise organizations (meaning those with >250 PCs or > $1 Million US Dollars in annual revenue), no use is permitted beyond the open
source, academic research, and classroom learning environment scenarios described above.

4 tiered security vs. task based security design

I have recently joined a company that has only FICO implemented. They are currently ramping up to implement all modules globally.
The current security model is 4 tiered security approach, in other words, there are 4 single roles which are roled up into a composite depending on what your position is in the hierarch. For example, an end user AP Clerk will get the basic role and probably one other. The AP clerks boss would get those 2 roles plus one other role and so on. Because the security is not very granular, they have a huge amount of mitigating controls in GRC to pass the yearly audits.
Most companies I have worked at are changing to a task based security approach to make the security more granular and therefore easier to manage and manipulate (for want of a better word) and possibly eliminate having to create and maintain a huge number of mitigating controls. Task single roles would be added to a composite per job position.
My question is, which version would be the SAP best practice approach? The 4 tiered approach is easier up front but a lot more maintenance going forward. The task based approach is a lot of work up front but less maintenance going forward.
No matter what road we take, there may also be derived roles thrown into the mix!

@Lovin_JV_941794
The welcome page is public available since it does not have appropriate PageDef file.
Login page comes not from the welcome page, it comes after attempt to access the test page. So after the login succeeded the test page appears, because redirect to welcome page after successful login is not configured. I do not need to return the welcome page at this moment, I need to go to the test page.
It seems the task flow call stack to be destroyed after redirect to login page.
Edited by: user13307311 on Apr 17, 2013 12:45 AM

GRC - Security Administrator task

Similar Messages

Maybe you are looking for