I have created a role in child system .

i have created a role in child system and i want to create a composite role in cua with this role in child system but
when i am entering its name in pfcg it saying the role not present please help.

Hi Suvodeep,
Please do not confuse this with CUA.
If you have created a new role in the child system, and want to see it in the CUA, goto PFCG-> Environment -> "text compare for CUA system"
You can try the other option too to see what it does
Hope this helps
Abhishek

Similar Messages

I have created a quotation in CRM system. I want that to be downloaded into ECC, so that, I can create a sales order there with reference to that quotation. So, what are the parameters that I need to set in CRM system so that my quotation gets replicated?

Dear Experts,
I have created a quotation in CRM system. I want that to be downloaded into ECC, so that, I can create a sales order there with reference to that quotation. What are the parameters that I need to set in CRM system so that my quotation gets replicated without any error?
Please help me in this regard. An early and in detail step by step guidance is highly appreciated.
Thanks,
SMTP

It may be best to recreate the folder and the smart playlists from scratch.
tt2

Roles in child system

Hi,
Is there any way that I can see the roles in all child systems from CUA ? I cant use USLA04 table as it is a new role and no users are assigned.
Thanks in advance.
Regards,
Subha

Hi Colleen,
I have related same question like,
I want to get child-parent relationship for roles and profiles across the SAP CUA system.
there we like to get the list of assigned roles to user, type of role and the subsystem on which it is residing.
Same like we can get through BAPI_USER_ACTGROUPS_ASSIGN
From the table USRSYSPRF we can get similar information for profile but I also want same for roles.

Create single-roles in satellite-system

Hello everybody,
I want to create Single-role´s in a satellite-system over RFC but the Fm´s in the Functiongroup PRGN are not remotable. Is there an alternative way to create these single-roles in a satellite-system? Up-/download and transport function isn't a alternative because my requirement is to create the single-roles an from excel-import. I considered that one way could be to copy the roles in the satellite.
Regards,
Christian

You can create an RFC-able FM that is a wrapper for that FM.
Neal

User update in Child system through CUA

Hi,
I created a role in child system and assigned it to the users in the parent system
However, users are not getting updated in the child system
Plz suggest

Did you run text comparison after creating the role ?
If not do that .
[SU01 --> enter user --> Roles --> Text comparison from child system OR run report SUSR_ZBV_GET_RECEIVER_PROFILES ]
Thanks
Prince Jose
Message was edited by:
Prince Jose

CUA client doesn't know any profile/role anymore after adding child system

Hi,
I did set up a CUA client on our Solman system. The client is client 500 which has been copied over from 000 via the SAP_CUST profile.
In this client 500 I did create some users with the SAP_ALL profile, so no problem here.
After adding a child system to the CUA, it seems that if I want to create a new user in the CUA client 500 it doesn't know any role/profile anymore which is standard available in this client.
In PFCG I can find a lot of standard roles, but when adding one via SU01 I do get the error that it doesn't exist. The same goes for the profile SAP_ALL.
Just to be clear, adding profiles or roles from child systems is not a problem, just adding roles or profiles for the CUA client itself doesn't seems to work anymore.
I had this problem on a 7.0 solman system and now also on a 7.01.
Did anyone had the same problem?
Thanks,
Gregory

Hello Georges,
I have exactly the same issue.
I have created a new CUA. I have copie 001 client to 333 client, using SAP_ALL profile.
Now, from CUA client (333), I cannot add any roles or profiles to my user.
I have created an RFC D1CCLNT333, but it does not resolved the problem.
Did you do anything else to fix your issue ?
Thanks
Best regards
CP2009

New role in CUA user record not getting pushed to child system

I added a new child system to our CUA setup. I've confirmed that the RFC connections from both sides are working properly (test connection succeeds) and I've successfully completed the user transfer function in SCUG. All exisitng roles assigned to the users in the child system are now appearing in the CUA central system as expected. I added a new role to a user via SU01 in the central system to this child system, but when I go to the child system, it does not appear in the user's SU01 record. Any ideas why this would not be syncing properly?
Thanks,
Michael

Hi,
Whenever you create a new role in child system, it has to be sync up with the central system.
To sync up with the central system, login to central system goto su01>enter any user name>go to roles tab- click on Text comparision from chiled system. Its navigate to another screen, there you have to mention the child system and click on execute. it syncs up with child sytem. Hope it will help you out to resolve the issue.
If still you are getting the same issue login to the central system.. goto SE38-- enter the program name as "RSCCUSND" and click on execute there mention the user name and the logical system id of the Child system name, select the parameters which you wanted to distribute to child system and execute it.
Best Regards
Mani

Transport All Roles to Another System

Hi Experts,
I have one requirement. I want to create same roles in Development System that I have made in QA System.
So is there any technic, I dont have to make it again in Development system and copy from QA system?

Hi,
Transport is not possible from QAS to DEV system.
So in this case you can use upload download roles.
Go to PFCG. Create one composite role and add all the roles that you want to transfer.
Then select that composite role in PFCG screen. Go to Role --> Download. It will ask to save the role file. Save it on your machine.
Now login into the DEV system, go to pfcg. Go to Role --> Upload and select the file which you have stored earlier.
It will create all the roles in DEV same as QAS. You have to create profile of all that role.
You can generate mass profile using SUPC. Go to SUPC and select all the roles which you have transfered and generate their profile.

Creating standard roles transaction

Hello,
Please let me know transaction code of standard roles creation in SAP Business Workflow.
Regards,
Amey

Create Roles
The role also contains the authorizations users need to access the transactions, reports, web-based applications and so on, contained in the menu.
You can assign a role to an unlimited number of users.
Procedure
To create a single role:
1.     Choose the pushbutton Create role or the transaction PFCG in the initial transaction SAP Easy Access. You go to the role maintenance.
2.     Specify a name for the role.
The roles delivered by SAP have the prefix 'SAP_'. Do not use the SAP namespace for your user roles.
SAP does not distinguish between the names of simple and composite roles. You should adopt your own naming convention to distinguish between simple and composite roles.
3.     Choose Basic maintenance (in the Profile, Other objects menu).
4.     Choose Create.
5.     Enter a meaningful role description text. You can describe the activities in the role in detail.
You may use an existing role as a reference.
6.     Assign transactions, programs and/or web addresses to the role in the Menu tab. The user menu which you create here is called automatically when the user to whom this role is assigned logs on to the SAP System. You can create the authorizations for the transactions in the role menu structure in the authorizations tab.
If you want to call the transactions in a role in another system, enter the RFC destination of the other system in the Target system field.
You should only use RFC destinations which were created using the Trusted System concept () to guarantee that the same user is used in the target system. This is only necessary if you want to navigate via the Easy Access Menu in the SAPgui.
If you use the Workplace Web Browser, you can use any destination containing a logical system with the same name.
If the Target system field is empty, the transactions are called in the system in which the user is logged on.
You can also specify a variable which refers to an RFC destination. Variables are assigned to the RFC destinations in the transaction SM30_SSM_RFC.
To distribute the role into a particular target system, specify the target system (its Release must be 4.6C) and choose Distribute. This function is most useful when you use the Workplace.
You can create the user menu:
o     from the SAP menu
You can copy complete menu branches from the SAP menu by clicking on the cross in front of it in the user menu. Expand the menu branch if you want to put lower-level nodes or individual transactions/programs in the user menu.
o     from a role
this function copies a defined role menu structure in the same system into the current role. You can also copy the menu structure of a role delivered by SAP. Click on the menu branches and copy them.
o     from an area menu
You can copy area menus (SAP Standard and your own) into a role menu. Choose an area menu from the list of menus and copy the transactions you want.
o     Import from file
See Upload/Download roles.
o     Transaction
You can put a transaction code in the user menu directly.
o     Program
This function puts programs, transaction variants or queries in the user menu. They need not be given a transaction code.
ABAP Report
Choose a report and a variant. You can skip the selection screen.
You can generate a transaction code automatically and copy the report description by setting checkboxes.
SAP Query
Enter a user group and query name. If the query has a variant, you can specify it. You can also specify a global query. See Query work areas.
Transactions with variants
The system administrator can create transaction variants in the SAP System Personalization. Transaction variants adjust complex SAP System transactions to customer business processes, by e.g. hiding superfluous information and adding other information such as pushbuttons, text or graphics. You can put a transaction variant call in a user menu by entering the transaction code and variant which you created in the transaction SHD0.
BW report
Include a Business Information Warehouse report. Enter the report ID.
ReportWriter, Search, Report
These function put other application-specific report types in the user menu.
o     Others
Enter other objects:
Web address or file
Enter internet/intranet links with a descriptive text and the web address. You can enter a file name if the browser can call an application.
Drag and relate component
Enter the component name.
Knowledge Warehouse link
Use the Document field possible entries help. Choose the information object type. You go to a selection screen in which you can search for the object in the Knowledge Warehouse.
There are other pushbuttons for editing the user menu. Choose a menu entry with the cursor before you call one of the following functions.
Function:     Meaning
Create folder
Group transactions, programs, etc. in a folder
Change node text
Change a menu entry text
Move down
Move a menu entry down one place
Move up
Move a menu entry up one place
Delete nodes
Delete a menu entry
Any subnodes are also deleted.
Delete all nodes
Delete the complete role menu
Translate node
Translate a menu entry
Documentation
Display the documentation of transactions, programs, etc.
Find doc.
Find programs
You can restructure the menu by Drag & Drop.
The Menu tab status is red if no menu nodes are assigned. If at least one menu node is assigned, the status is green.
You can assign Implementation Guide (IMG) projects or project views to a role under Utilities  Customizing auth. Do this to generate IMG activity authorization and assign users. The authorization to perform all activities in the assigned IMG projects/project views is generated in profile generation. You make the assignments in a dialog box. Choose Information to display more information on using this option.
7.     Save your entries.
You have created a role.

Creating single role by copying profiles from other roles

HI ,
I am creating a single role from 4 roles. Ihave copied the authorizations of 4 roles and added into the new role. This is done by copying the profiles.
Problems Faced :-->
1. )In table AGR_TCODES i am not able to see the Tcodes for this new single role present in the new role, whereas if i goto object S_TCODE i am able to see tcodes and have that access.
2.) Some of the objects are not copied into this new role. Even from the roles whose all other objects are copied into this role.
Can anybody help me on this and also if someone knows what other problems can be faced by doing this.
<removed_by_moderator>
Thanks,
Rajesh
Edited by: Julius Bussche on Oct 15, 2008 3:55 PM

Hi Rajesh,
If you have created a role by copying authorizations, then it is possible to get the t-codes provided your role contains the auth.obj S_TCODE which you might have copied manually from one or two among the 4 roles.
If S_TCODE exists in your role then you can find out the t-codes belonging to this role through SUIM->Transactions->Executable for Roles-> Insert your role name
or
Go to SE16-> Table AGR_1251->
In the field AGR_NAME, give the role name
In the field OBJECT, enter S_TCODE and then
Execute.
Q.My second question THere is one role created by some user I am checking it in AGR_Tcodes and SUIM ....I am finding that the no. of Tcodes in both cases donot match....Can anybody tell where i can look for this and what is the possible reason.
Possible reasons for this could be that some of the t-codes have been entered into the role manually and not through the menu in PFCG and as mentioned earlie that AGR_TCODES only shows the transactions that exists in the menu of the role.
It could also be that the manually entered t-codes contains wildcards specifying a range of values.
The best option would be to find it out from the AGR_1251 table.
Hope this helps !
Thanks,
Saby..

How to create automatically users&roles in CUA and child systems

Hi,
i have a CUA on a 2 chlid R/3 systems (test and training) and 2 portal systems (test and training).
i need to create a web application to create automatically users test and users training in CUA and see them in the R/3 chlid systems and at the same time to create autmatically a roles in CUA and R/3 chlid systems for those users (we sppose that the role is already stored in a table).
are there any standard BAPI or Funcion modules that can do this job?
is the role created automatically in CUA can be seen automaticall in the portal child system?
any help?
Thanks&Best regards

Thank you all. I got the solution.
Regards
Rajesh

Integrate GRC 10.1 with CUA and how to import roles from CUA & Child systems into GRC for provisioning

Hello,
I am trying to integrate CUA into our GRC 10.1 system through the below steps and so far I have completed the below steps following SAP Notes 1680108 and 1616121:
1. Connected CUABOX to GRCBOX like a plug-in system.
2. Updated CUA Global System and CUA Model Distribution in Maintain CUA settings under User Provisioning.
3. Next I am trying to import the roles from CUA(CUABOX) into GRC(GRCBOX) to be able to provision roles in CUA Child Systems(ECCBOX).
After reading few discussions in SCN, I have figured that we have to download a template in Role Import and populate it accordingly to upload the CUA child system roles into GRC system for provisioning in CUA Child Systems.
Unfortunately, this template has multiple fields and I am unable to determine the fields that should be populated as CUA Global System and CUA Child System to import into GRC. Also, when we upload CUA Child System Roles template what selections should be made in Role Import window.
Any help in this regard is very helpful.
Thank you,
Pawan

Hi Alessandro,
I have "Create user if does not exist" setting checked for both change action and assign role action and also have CUA enabled. Here is the list of steps that I am performing:
1. Create an access request for new account, T-CUA_CHILD and select a role from a child system ECC Z_ECC_ROLE_IN_CHILD_SYSTEM.
2. Approvals provided to assign the ECC role.
3. I see the following in GRFNMW_DBGMONITOR_WD.
           Auto provisioning activity at end of request at Path GRAC_DEFAULT_PATH and Stage              GRAC_SECURITY
               New User:T-CUA_CHILD created in System(s): ECC (created without role assignments)
               T-CUA_CHILD User does not exist in target system CUA
GRC created an account without role assignment in ECC but also throwed me an error that the user does not exist in CUA.
However, if I select roles from both CUA and ECC it creates the account in both systems with the selected role assignments.
So I am wondering if there is way to provide CUA access to users by default for new account requests types. I have tried setting up default roles for CUA but it does not assign the roles by default until I select the CUA system.
Thank you for your help!
Pawan

Users were re-created in Child systems not in Cnetral System (CUA)

Hi,
The set of users were deleted some time back and today i verified in child system (PROD) with criteria as list of users without roles/profiles then I found a set of users in child systems.
Were as those user master records are not showing in Central System (CUA).
I verified the change document, It is showing the deleted date and later some time again it was created with no roles and profiles. On the same date all the others users are also get created.
Then I have checked the change document of a user and verified is there any IDOC was generated in central system on that time and date but I didnu2019t find anything...
I was expecting that the old IDOC's which are in status "distribution unconfirmed" with of the user and later there would be happen many changes for that user and which are get reflected in child system but the IDOC which was in unconfirmed status. When any one try's to execute the process through BDM2 or BD87 for that IDOC then again there would be chance of re-build the user account..... But one thing i was confused is if the old IDOC get re-generate then it has to be shown in the CUA system also?.
It was strange issue, so please let me know what the reason behind it.....
Please help me out...
SV

>
Nishant Sourabh wrote:
> I assume BD87 was executed in the child system and the idocs where manually processed which created these ids back again ....not sure if that is what happened. never seen something like that.
Hi Nishant,
what you are writing is the most common situation of how these users got 'recreated'.
If you have a look at the method for user change idocs, you will notice, that it is the same method for creation and changing (CLONE).
So if you have an unprocessed change idoc in the child system and you delete the user (succesfully) and reprocess this idoc in the child system locally, the user will get 'recreated'.
b.rgds,
Bernhard

Users created in CUA does not distribute to child systems

Hi
I searched this forum and after pulling my hair for 2 days I am asking this question. I created a user in CUA and gave him child system access with the necessary roles.
I was under the impression that the user will get replicated / distributed automaticlaly to the child systems which i selected at the time of user creation in CUA
But it does not happen. I login the child system and search for the user. It says User does not exist. I saw SCUL in CUA and the log shows a grey icon next to the username and when I place my cursor on the icon, the tect comes " Distribution unconfirmed"
What am I missing? Everything looks ok to me
Why is the user or users not geting replicated or distributed to the child systems with the necessary roles / profiles?

>
Jackofalltrades wrote:
> 2. Also the communication user from Client to CUA is getting locked very frequently. When I do a text comparison from CUA, it always pops the username and password login screen and then I have to enter it and the text comparison happens. I don't know what that happens
>
> Any ideas for point 1 and 2 ?
Hi,
that is an indication, that the RFC-connection is not defined properly. As soon it does not work, you will get the login screen (on the login screen the default client (503) is filled automatically, but that has nothing to do with the problem you have).
First check the password of the RFC-user you use. Simply change this user to type 'dialog' and try to log on with the password you know. If that works, reenter this password in SM59. Perform the authorization test in SM59 afterwards. Mind possible upper/lowercase problems with the password depending on the releases your systems are.
You can also try to perform a remote login through sm59 to make sure, tath you can log on with that RFC-user (as long he is of type dailog this will work). If the rfc-user gets locked frequently, then something is wrong with the rfc configuration. In most cases the entered password is simply wrong.
Check this first!
b.rgds, Bernhard

User roles un-assigned in CUA but acces in child system is ok

hi
i am have a really weird issue. a user who has access in roles in child clients, suddenly his roles disappeared from CUA. it did not effect access in child systems. any suggestions how to investigate this.
thanks

Did you click the Naughty Button in SCUL? Check OSS Note 1074552...
Could also be a cause of failing idocs.
Regards,
Trond
PS: The above note is for cases where users loose their visible role assignments in CUA, although roles remain assigned in the child system(s), not for cases where role assignments from CUA never trickles through to the child systems. The mentioned OSS note is a direct result of a case worked on by yours truly in 2007. I include below a warning I posted on sapfans about the issue:
Word of warning: RSUSR_CUA_CLEANUP_USZBVSYS is faulty!!!
The program RSUSR_CUA_CLEANUP_USZBVSYS is available as a standard SAP program from at least version 6.20. It can be run from SE38/SA38 or launched from a pushbutton (far right) on the "results" screen of transaction SCUL.
The program is intended to delete "obsolete" entries from table USZBVSYS, which contains log entries for assigned child systems in a CUA environment. The program is run in the main CUA system, and supposedly deletes entries for systems where users no longer have access.
There is a serious problem with the program, as acknowledged and confirmed by SAP in an OSS note I opened a few days ago. Under certain circumstances (more than 500 entries for any child system in the CUA landscape), the program wipes clean the whole table, instead of just the obsolete entries.
The consequences are dire. Table USZBVSYS is used for several fundamental CUA functions, such as remote password reset from the CUA master system. After the wipe, executing SU01 and attempting to reset a users password in a child system will no longer work. The assigned child systems are no longer visible in the reset password pop-up (nor anywhere else in SU01, including the Roles tab). You'll have to edit the user via SU01, and click on the annoying pop-up showing "new system assigned to user" for each system where the user has access...
The only way to fix the issue is to re-run SCUG for all systems in the CUA landscape. We had to do this across 6 CUA's, each containing 30+ child systems/clients and 10000+ users, which was very time-consuming and annoying. Also, there seems to be cases where roles have been wiped out from users on the CUA master systems, possibly due to consequences of the empty USZBVSYS table.
SAP has conceeded the program is faulty, and have proposed a new version (note 1074551). Without applying this correction, the program should NOT be run.
Note that users can still log in to and work in the child systems, it's just the "visibility" from the CUA master system which is missing. Tables USLA04/USL04 are still intact.
Just wanted to warn the community; we've spent some considerable time discussing with SAP and rectifying the mess created by RSUSR_CUA_CLEANUP_USZBVSYS...
Edited by: Trond Stroemme on Aug 5, 2008 3:03 PM

I have created a role in child system .

Similar Messages

Maybe you are looking for