GRC system validation steps

Hi, Please check and provide GRC system validation steps in serial. I am looking for the serial steps which we need to follow while validating GRC system after applying support packs or upgrade etc. Appreciate your feedback. Thanks & Regards, Koteswara Rao.

Hello Gurus,
I too am looking for similar information so I am posting my question in the same thread.
I was going through the GRC 5.3 sizing guide for figuring out the hardware requirement for RAR. We wanted to go with the expert sizing of RAR. Expert sizing takes into account the factors such as no.of users, roles and violations. I thought we can easily figure out the no.of roles and no.of users but how do I estimate "Number of SOD Violations"? Please advice..
@ Sanjay,
I will just outline of what we did so far..hope this might help you
Here at our company, we started off by 1) buying the GRC access control suite, 2) deciding what components within GRC will be implemented first. 3) systems (ECC, BI, etc) in scope
4) System landscape (Dev and Test will be on one box, Prod will be on another box)
5) Sizing based on systems in scope
6) Decide whether to install on existing Solman or install on a new box...(bcos all that GRC 5.3 needs is NW04s Java stack)
7) Buy hardware based on sizing, Install NW
and so on...
Thanks in advance for your input...
regards,
Venkateswara Rao

Similar Messages

SSRS 2008 R2 Problem understanding View State Validation steps

Hi,
Sorry, but I have some problem understanding this steps. Please help me to understand this.
Pasted from
http://technet.microsoft.com/en-us/library/cc281307.aspx?lc=1033
How to Configure View State Validation
To run a scale-out deployment on an NLB cluster, you must configure view state validation so that users can view interactive HTML reports. You must do this for the report server and for Report Manager.
View state validation is controlled by the ASP.NET. By default, view state validation is enabled and uses the identity of the Web service to perform the validation. However, in an NLB cluster scenario, there are multiple service instances
and web service identities that run on different computers. Because the service identity varies for each node, you cannot rely on a single process identity to perform the validation.
To work around this issue, you can generate an arbitrary validation key to support view state validation, and then manually configure each report server node to use the same key. You can use any randomly generated hexadecimal sequence.
The validation algorithm (such as SHA1) determines how long the hexadecimal sequence must be.
Generate a validation key and decryption key by using the autogenerate functionality provided by the .NET Framework.
(Well, how to generate Validation key using .Net Framework?) In the end, you must have a single <machineKey> entry that you can
paste into the Web.config file for each Report Manager instance in the scale-out deployment.
The following example provides an illustration of the value you must obtain. Do not copy the example into your configuration files; the key values are not valid.
Copy Code
<machineKey validationKey="123455555" decryptionKey="678999999" validation="SHA1" decryption="AES"/>
Open the Web.config file for Report Manager, and in the <system.web> section paste the <machineKey> element that you generated. By default, the Report Manager
Web.config file is located in \Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVER\Reporting Services\ReportManager\Web.config.
Save the file.
Repeat the previous step for each report server in the scale-out deployment.
(Do I need to repeat all 3 previous steps?)
Verify that all Web.Config files in the \Reporting Services\Report Manager folders contain identical <machineKey> elements in the <system.web> section.
Thanks

Jerry,
Thanks for the reply.
From the above View State Validation Steps,
For 1st step , how to generate validation key using .Net Framework?
for 4th step, Do I need to repeate all 3 previous steps?
Thanks
Kp

Approval process - 'System Validation' - Pending - Assigned to xelsysadm

I created an approval process for a resource.
Whenever a request for a resource is generated for a user, the approval request is sent to a group based on user's location.
Steps:
-I created an approval process in which I added a task which sends the request to the appropriate group.
-An adapter is attached to this task which determines the group to which request is to be sent.
-I have added tcComplete adapter to the Standard Approval
However, after the request is approved by the approver(belonging to the above mentioned group), the resource does not get provisioned and the system validation is shown 'pending' - assigned to user 'xelsysadm'.
I am not able to figure out why the system validation is 'pending' and going to 'xelsysadm'.
Note that I am logged in as xelsysadm and the above pending 'system validation' task is present under 'Open Tasks' under 'To-Do-List'. Once I set the response from there as 'Complete', the resource is provisioned.

I tried provisioning another user, got the oim api error again:
INFO,18 May 2010 13:28:36,925,[XELLERATE.WEBAPP],Key not found in Custom Resource Bundle: newKey = GC.GCPROV.ADAPTER_OIMAPIERROR
DEBUG,18 May 2010 13:28:36,925,[XELLERATE.WEBAPP],Setting the response code as OIM API Error

SSO between EP and GRC systems

Hi,
We have EP 7.0 and GRC 5.3 systems in our landscape. In the login page of the portal, we have a link configured to the GRC system to use the Compliant User Provisioning application.
On clicking the GRC link for accessing CUP, the user is prompted to enter the username and password to login to the GRC system. In our landscape both the EP and GRC systems have the ECC ABAP system as the UME and hence the user credentials are exactly the same for both EP and GRC systems for a particular user.
I would like to avoid another logon for the user in GRC as he has already logged in with the same user credentials in EP system.This, i believe is achieved through SSO but i'm not sure about configuring SSO between two Java systems.
Please help me in the configuration.
Regards,
Ragav

Ragav_ss wrote:
Everything is working fine when i click User Logon link in GRC system which comes up through the link from EP. The SSO is working fine there. But when i click Request Access or Request Status link, the SSO does not work.
Any clues.
GRC version is 5.3 SP 12
Did you ever get that resolved? I'm having the same problem with 5.3 SP 15.
Regards,
Sean

Vendor's/manufacturer's QM system validity

Hi Team,
How to increase Vendor's/manufacturer's QM system validity date?
ERROR: While creating PO is as below.
Vendor's/manufacturer's QM system only valid to 06.05.2010
Message no. QB301
Diagnosis
The quality assurance system of the chosen vendor/manufacturer is no longer valid. You cannot, therefore, order the material concerned from this vendor/manufacturer.
Thanks

It seems vendor/Material QM info record date is past .Go to transaction QI02 ,Check the date in inspection control tab and change the date to valid date.

Adobe Offline Forms issue in GRC System

Experts:
I am working on creating a Offline Form for GRC Process Control in SAP GRC System. I have couple of doubts.
1. In the Form property, there is a new field call 'Inbound Handler'.    The document which I referred says that, this 'inbound handler' helps in processing the inbound pdf's which comes thro mail.       In this place we need to select the class developed with 2 methods, 1.Create Instance and 2. Handle PDF.    And the document also talks about creating a separate class and referring it in the exit rules (SO50).     I am not sure whether Inbound Handler is a replacement for Exit Rules (SO50) so something else. Please Clarify.
2. While generating the PDF file, as you know we call the series of function modules. I have problem with the FM ' CALL FUNCTION fm_name' . When this FM is executed, normally it should generate the PDF and XML which will be available in fp_formoutput-pdf and fp_formoutput-xml. But in this system even when there is no issues with the export parameters, the FM is not able to generate the PDF and XML. Both fp_formoutput-pdf and fp_formoutput-xml are coming as EMPTY. Result of which when the FM 'FP_JOB_OPEN' is called it displays the message 'No Job Started' and exits the program. This same program works find in ECC 6.0 system. Can anyone thro some light on this?
Line: -
TYPES: BEGIN OF st_test,
       one   TYPE string,
       two   TYPE string,
       three TYPE string,
       END OF st_test.
DATA: it_test TYPE st_test OCCURS 0.
DATA: wa_test TYPE st_test.
DATA: fp_outputparams type sfpoutputparams.
DATA: fm_name TYPE rs38l_fnam.
DATA: fp_docparams TYPE sfpdocparams.
DATA: result TYPE sfpjoboutput.
DATA: fp_formoutput type fpformoutput.
SELECTION-SCREEN BEGIN OF BLOCK b1 WITH FRAME TITLE text-b02.
PARAMETERS: p_taskid TYPE grfntaskplan-taskplan_id DEFAULT 'DF492600B7308BF19F5E00237D624FE0' OBLIGATORY,
            p_email TYPE ADR6-SMTP_ADDR DEFAULT 'a@b' OBLIGATORY,
            p_tmail TYPE ADR6-SMTP_ADDR DEFAULT 'a@b'' OBLIGATORY,
            p_form   TYPE fpwbformname   DEFAULT 'ZAOF_TEST',
            p_langu TYPE spras          NO-DISPLAY DEFAULT 'EN',
            p_countr TYPE land1          NO-DISPLAY DEFAULT 'US',
            p_pages TYPE fppagecount    NO-DISPLAY DEFAULT 2,
            p_loop   TYPE i              NO-DISPLAY DEFAULT 1.
SELECTION-SCREEN END OF BLOCK b1.
INITIALIZATION.
START-OF-SELECTION.
wa_test-one = 'One'.
wa_test-two = 'Two'.
wa_test-three = 'Three'.
append wa_test to it_test.
END-OF-SELECTION.
CALL FUNCTION 'FP_FUNCTION_MODULE_NAME'
EXPORTING
    i_name     = p_form
IMPORTING
    e_funcname = fm_name.
fp_outputparams-getpdf = 'X'.
fp_outputparams-nodialog = 'X'.
CALL FUNCTION 'FP_JOB_OPEN'
CHANGING
    ie_outputparams = fp_outputparams
EXCEPTIONS
    cancel          = 1
    usage_error     = 2
    system_error    = 3
    internal_error = 4
    OTHERS          = 5.
IF sy-subrc <> 0.
MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
      WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
ENDIF.
DO p_loop TIMES.
fp_docparams-langu   = 'E'. "p_langu.
fp_docparams-country = 'US'."p_countr.
fp_docparams-FILLABLE = 'F'.
fp_docparams-dynamic = 'X'.
fp_docparams-UPDATE_INTERACTION_CODE = 'X'.
CALL FUNCTION fm_name
    EXPORTING
      /1bcdwb/docparams = fp_docparams
      Ztest      = it_test
    IMPORTING
      /1bcdwb/FORMOUTPUT = fp_formoutput
    EXCEPTIONS
      cancel             = 1
      usage_error        = 2
      system_error       = 3
      internal_error     = 4.
ENDDO.
CALL FUNCTION 'FP_JOB_CLOSE'
IMPORTING
    e_result       = result
EXCEPTIONS
    usage_error    = 1
    system_error   = 2
    internal_error = 3
    OTHERS         = 4.
IF sy-subrc <> 0.
MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
      WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
ENDIF.
Thanks in Advance
Vijai
Edited by: Thomson VijaiAnand on Apr 21, 2010 11:15 AM

Hi Thomson
I met a similar probleam.
Could you explain how you get it through?
Thanks

Offline Form Issue in SAP GRC System

Experts:
I am working on creating a Offline Form for GRC Process Control in SAP GRC System. I have couple of doubts.
1. In the Form property, there is a new field call 'Inbound Handler'.    The document which I referred says that, this 'inbound handler' helps in processing the inbound pdf's which comes thro mail.       In this place we need to select the class developed with 2 methods, 1.Create Instance and 2. Handle PDF.    And the document also talks about creating a separate class and referring it in the exit rules (SO50).     I am not sure whether Inbound Handler is a replacement for Exit Rules (SO50) so something else. Please Clarify.
2. While generating the PDF file, as you know we call the series of function modules. I have problem with the FM ' CALL FUNCTION fm_name' . When this FM is executed, normally it should generate the PDF and XML which will be available in fp_formoutput-pdf and fp_formoutput-xml. But in this system even when there is no issues with the export parameters, the FM is not able to generate the PDF and XML. Both fp_formoutput-pdf and fp_formoutput-xml are coming as EMPTY. Result of which when the FM 'FP_JOB_OPEN' is called it displays the message 'No Job Started' and exits the program. This same program works find in ECC 6.0 system. Can anyone thro some light on this?
TYPES: BEGIN OF st_test,
       one   TYPE string,
       two   TYPE string,
       three TYPE string,
       END OF st_test.
DATA: it_test TYPE st_test OCCURS 0.
DATA: wa_test TYPE st_test.
DATA: fp_outputparams type sfpoutputparams.
DATA: fm_name TYPE rs38l_fnam.
DATA: fp_docparams TYPE sfpdocparams.
DATA: result TYPE sfpjoboutput.
DATA: fp_formoutput type fpformoutput.
SELECTION-SCREEN BEGIN OF BLOCK b1 WITH FRAME TITLE text-b02.
PARAMETERS: p_taskid TYPE grfntaskplan-taskplan_id DEFAULT 'DF492600B7308BF19F5E00237D624FE0' OBLIGATORY,
            p_email TYPE ADR6-SMTP_ADDR DEFAULT 'a@b' OBLIGATORY,
            p_tmail TYPE ADR6-SMTP_ADDR DEFAULT 'a@b'' OBLIGATORY,
            p_form   TYPE fpwbformname   DEFAULT 'ZAOF_TEST',
            p_langu TYPE spras          NO-DISPLAY DEFAULT 'EN',
            p_countr TYPE land1          NO-DISPLAY DEFAULT 'US',
            p_pages TYPE fppagecount    NO-DISPLAY DEFAULT 2,
            p_loop   TYPE i              NO-DISPLAY DEFAULT 1.
SELECTION-SCREEN END OF BLOCK b1.
INITIALIZATION.
START-OF-SELECTION.
wa_test-one = 'One'.
wa_test-two = 'Two'.
wa_test-three = 'Three'.
append wa_test to it_test.
END-OF-SELECTION.
CALL FUNCTION 'FP_FUNCTION_MODULE_NAME'
EXPORTING
    i_name     = p_form
IMPORTING
    e_funcname = fm_name.
fp_outputparams-getpdf = 'X'.
fp_outputparams-nodialog = 'X'.
CALL FUNCTION 'FP_JOB_OPEN'
CHANGING
    ie_outputparams = fp_outputparams
EXCEPTIONS
    cancel          = 1
    usage_error     = 2
    system_error    = 3
    internal_error = 4
    OTHERS          = 5.
IF sy-subrc <> 0.
MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
      WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
ENDIF.
DO p_loop TIMES.
fp_docparams-langu   = 'E'. "p_langu.
fp_docparams-country = 'US'."p_countr.
fp_docparams-FILLABLE = 'F'.
fp_docparams-dynamic = 'X'.
fp_docparams-UPDATE_INTERACTION_CODE = 'X'.
CALL FUNCTION fm_name
    EXPORTING
      /1bcdwb/docparams = fp_docparams
      Ztest      = it_test
    IMPORTING
      /1bcdwb/FORMOUTPUT = fp_formoutput
    EXCEPTIONS
      cancel             = 1
      usage_error        = 2
      system_error       = 3
      internal_error     = 4.
ENDDO.
CALL FUNCTION 'FP_JOB_CLOSE'
IMPORTING
    e_result       = result
EXCEPTIONS
    usage_error    = 1
    system_error   = 2
    internal_error = 3
    OTHERS         = 4.
IF sy-subrc <> 0.
MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
      WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
ENDIF.
Thanks in Advance
Vijai
Edited by: Thomson VijaiAnand on Apr 21, 2010 11:15 AM

Hi Thomson
I met a similar probleam.
Could you explain how you get it through?
Thanks

Validation steps.

Hi all
Can any please explain me about validation steps.
My requirement to validate cost center. When ever I enter customer invoice with a particular customer (Ex: 20001) cost center should be Admin, if I give another one it should give error message.
I tried in this way:
T.cod: GGB0
     What should I give in step: Prerequisite
     And in step: check for above requirement.
If you have any document please forward to [email protected]
Its argent to me.
Thanking you
NOTE: reward points will help you all ways

your prereq should be
if kunnr=20001, click on constant values and select 2001
validation kostl= admin , similarly click constant values and select admin.
Then maintain a message, cost center should be admin or whatever your req is
use sap help to understand a validation better
http://help.sap.com/saphelp_erp2005vp/helpdata/en/6e/8970389fa8f63fe10000009b38f842/frameset.htm
Points will be appreciated
Regards,
Zaid Azam

Two GRC systems linking to one SAP system

Hi,
I have a possible scenario where there are 2 GRC systems (for company 1 & company 2) connected to two seperate ECC6.0 systems.
Both companies are now looking to split out the HR element of their ECC6.0 systems and share a common HR system.
I am wondering what is the recommended approach to take for the GRC systems? I was thinking of creating a link from each GRC system to the new HR system.
However I am not sure how to deal with SPM- as this seems to have a one to one connection with the SAP system, meaning that only one GRC instance will be able to report against SPM usage.
Does anybody have any suggestions?
Thanks,
Niamh

Niamh,
As long as you configure the connectors from the SPM Java side, you can report on multiple SPM backend instances from a single GRC Java System.
However, if you want to integrate SPM with RAR for the critical transactions / SOD analysis, I believe that you can only specify one RAR source.
If you split out the HR elements to a single shared system, you can also have both GRC systems connected to that HR system You would need to consider the rulset defined in each RAR instance and the users who report on it to ensure that you are getting the "correct" rules in the correct place.
I would recommend not reporting from both grc systems as it doubles the administrative overheads and adds further complexity to the implementation. I would pick one of the GRC systems and adjust the functions in that one to look at the new HR system for the relevant authorisation definitions.
Simon

FF ID is not available in GRC system.

Hi All,
i have configured FF in GRC system and have dine following activities
1. maintain connection setting in SPRO.
2. created FF id in ECC system and assigned FF standard role.
3. run all necessary synchronization job.
4. assign owner.
but FF id is not available in GRC system.
can you you please help me.?

Hi Alessandro,
Thanks for your replay. please find my configuration in details.
1. Parmid 4000=1,
4010=SAP_GRAC_SPM_FFID
2. Maintain maintain connection SUPMG in SPRO > GRC > Common Connection Setting > Integration Framework > Maintain Connection Settings.
3. Create FFid in ECC DEV system.
4. assign role SAP_GRAC_SPM_FFID to FFid.
5. create FF id owner and FF id controller.
6.Run Syn.
but when want to assign controller to the FF ID then found FF is not available.

Managed system configuration step 8: No Admin User Id provided for TS SID

Hello experts,
I face the following problem in step 8 of managed system configuration (Configure automatically, SolMan 7.1 SPS 3):
All Activities fail (except Activate services) with the following Details message:
No Admin User Id provided for TS <SID> (ABAP)
Any hint?
Thanks and best regards, Basti

Hi Sunny,
I don't find anything where I can provide the user information. It just uses the actual user (SOLMAN_ADMIN). Can you tell me where to provide the user for this step?
Managed system configuration -> step 8 Configure automatically -> SSO Setup
Thank you, Basti

(Solved) Workflow System Verification Step 4: workitem could not be created

Hello all
We're on R/3 4.7 and I'm trying to get workflow runtime environment up and running. I've already passed through the automatic customizing (SWU3), all is green!
When starting the verification workflow I get a mail in my SAP Workplace inbox telling me something about error WL 410.
In the workflow log I can see this (had to translate it from german, so please bare with me if wording in english is not absolutely correct):
green -> Start event received
green -> (sub-)workflow created
green -> workflow started
green -> SWW_WI_ERROR_MESSAGE_SEND_S
red   -> Callback vom Workitem ausgeführt
red   -> GET_DEADLINE
red   -> SWW_WI_STATUS_CHANGE
Clicking on the first red light pops up a message telling me something like that:
Workflow 'Workflow-System-Verification' Step n° 4: Workitem could not be created
The long text message of this and the workflow protocol tells nothing more.
Anyone out there able to help me on this issue?
Kind regards,
Renaud

Hello Alan
Yes, this nearly made me crazy. Posted a customer message to SAP concerning this in parallel last week and also sent them some screenshots. They also advised me to move unit H from (non standard) dimensionless to dimension "time". This corrected it as already mentioned before.
I did several workflow activations before and never had any problems with automatic customizing and the verification workflow... until I came across this system here. Also on all other systems known to me the unit H was never dimensionless. Double checked it last week as well. Probably someone else fiddled around in CUNI without knowing what he or she was doing? Will probably never find it out. I just hope that this was an exception! Else...
Some extra points would be great of course )
Thanks and kind regards,
Renaud

System Validation task and orc status X

Hi All,
we noticed on some accounts where a resource status is Enabled but the orc status is X. even when we try to force them to C the X always seems to come back somehow. the only thing we can find is that for all of these at one time the System Validation task was manually completed.
of course this causes some problems with code that is dependent on the orc status. is there a way to fix these resources?
Thanx in advance.
Fred

Hi,
AD connector version is 9.1.1.0 and "System Validation" is the first default task for the AD user Resource Object. I am not sure, what will it perform. Once its complets, then process form will be generate by executing all releated adaapters and then will be create AD account for that user. How ever, the same user has been created in other Environment with same detials(So no data releated issue).
FYIP. "Auto Save Form" option for the Process Defination is checked.(I got this as solution from some other thread).
Can you please suggest me, what "System Validation" performs, and why its pending status.Any usefull links please?
Thanks.
Edited by: user13285646 on Jul 8, 2011 8:07 AM

Adding Validator step in MDG Customer workflow

Hello All,
I need to add validator step in MDG - Customer workflow - WS54300003 and process is, requestor will create CR and it should go to Validator. Once he approves then it should go to final approval team. Currently it is going to final approval stage at first step itself.
I added that additional step(Validator) to workflow templete(WS54300003) under processing modeling->workfloe->other MDG workflow->Define Change Request Step Numbers. Also, assigned process at ...-->Assign processor to Change Request Step Number (Simple Workflow).
Seems i am still missing some thing. Could you please guide me what else need to be done? we are on MDG 6.1

step numbers are hard-coded in this workflow template (WS54300003). if you open any task container, you will see the value of the step in the container of that task.
any way, you should not modify workflow WS54300003 as that is considered modification to standard objects. you can copy it to a custom workflow template and then add any new step as you like. you can assign whatever number you like to any step as long as the numbers in the workflow template are consistent with the numbers assigned in the MDGIMG configuration node.
A recommended solution is to use the rule-based workflow template. your MDG process will be much more dynamic and a lot easier to modify/enhance going forward.
this document can help you understand how you can use the rule-based workflow template: How to Fill MDG Rule-Based Workflow Decision Tables

Determine which validation step called the user exit, possible?

Hello all,
We have a a validation with different steps that use the same user exit in their respective check.
My functional analyst asked me if there is a way to programmatically determine in the user exit which step is executing the user exit.
So I am asking the same question here.
As an example:
Validation FI100 has step 001, 002, and 003.
Each of these steps use the user exit U100 from module pool ZGGBR001 in their check.
I haven't found a way in the code of U100 to determine which step called U100.
Does anyone know if this can be done?
I have used the following technique to get a variable from the program's call stack.
data: var_name(30) type c value '(Z_CALLING)VARIABLE' .
field-symbols: <fs> type any.
assign (var_name) to <fs>.
write: / 'Variable from Z_CALLING', <fs>.
But I'm not sure how this might work with validation steps/user exits.
Thanks
Bruce

Vinod,
I did some debugging after I posted my question. I came to the same solution, use FM 'SYSTEM_CALLSTACK'.
VALCHCK_2FI100##001
loop at i_callstack into w_callstack
where EVENTNAME+0(9) = 'VALCHCK_2'.
FI110 is the validation
001 is the step
Thomas,
Thanks for the caveats.
Bruce

GRC system validation steps

Similar Messages

Maybe you are looking for