Mass Role Import of derived roles.
Hi All,
I am trying to mass import derived roles. I have created the files Bulk Download File, Role Expert Information File and Primary Org Level File.
All these files are tab delemited text files.
But when i am uploading, it gives me error on Primary Org Level file format is incorrect.
Please suggest me on file format of Primary Org Level. We are on Role Expert 5.2.
Format I am using is
ROLE NAME<TAB>DERIVED ORG LEVEL<TAB>FROM VALUE<TAB>TO VALUE
My To Value is blank.
Thanks in Advance.
Regards,
Pravin
Hi Alpesh,
I was able to upload all the derived roles. What i found was that, there is a limitation on number of rows for primary org value file. It could be limitation of RE 5.2 SP9.
Whenever, primary org value file use to exceed 500 rows, it gives format error.
So, then i restricted the primary org value file within 500 rows & upload went smoothly.
Now, there is one query.
Is it possible, that all the roles which are uploaded can be set to phase generated.
Please suggest.
Thanks in Advance.
Regards,
Pravin
Similar Messages
-
Mass role import with derived roles out of master roles
Hi everybody,
I want to import a mass of roles with derivation (org. values) levels.
Could you please provide me with the terminology of the org. info file.
Bulk and role info were created and could successfully imported, but the derivation level (comes up with the
org info file) never works. There are no derived roles.
Look of the org file:
Role Name [ Alphanumeric (100) ] [ Mandatory ] Derived Org. Level [ Alphanumeric (50) ] [ Mandatory ] From Value [ Alphanumeric (100) ] [ Mandatory ] To Value [ Alphanumeric (100) ]
Z0007_K:FI_AP_CHANGE Company Code (BUKRS) CN10
Z0008_K:FI_AP_CHANGE Company Code (BUKRS) CN20
Z0009_K:FI_AP_CHANGE Company Code (BUKRS) CN30
Z0010_K:FI_AP_CHANGE Company Code (BUKRS) CN40
Z0011_K:FI_AP_CHANGE Company Code (BUKRS) MA10
Any ideas ?
Reg,
UlrichHello everybody,
The right way to import orglevel fields is like that:
before the org level field, you need to add the "$" sign- like that - $BUKRS
in every line.
good luck,
best regards,
Haim Brauner -
Mass Role Import -- 9000 derived roles with 9 org Levels, how to get TXT
Hello,
I hava a problem.
I want to use the (Mass Role Import) Bulk Role Import element in the ERM (SAP GRC AC 5.3 )for importing SAP roles (I only found that way to import roles from SAP).
I have 100 primary roles and more or less 9000 derived roles with 9 org Levels.
Is there a way to get this 9000 derived roles with their 9 org Levels in a TXT file?. Or do I have to do it manually this part to insert it in the "Bulk Role Import ".
Can someone help me?
Thank you in advance.
Pablo Mortera.Hi Mike,
what kind of TA´s are in your role. Is it possible to integrate a "dummy" TA (without conflicting
your SOD)?
In my example I have CO TA´s bundled in a role:
Role: ZXXXX_O:CO_ORDERMANAGER_CRE - CO Order Manager Pflege
with
KO01 Create Internal Order ...
KO02 Change Order ...
KO04 Order Manager ...
KOK2 Collective Proc. Internal Orders ...
KOK4 Aut. Collect. Proc. Internal Orders
update this role with TA KO01 and KOKRS will be available for derivation.
Done this manually without import in ERM.
Reg,
Ulrich -
GRC 10 Role Import error(Master role does not exist) in SP12
Hi,
We have completed connectors part and ran sync jobs successfully.
We have given required inputs in Define Criteria,Select Role Data in Role Import.When we submit this,only few roles are successfully imported.
It is giving error like Master role does not exist(some roles) but it is successful for few other roles.
We have tried with SKIP option in role authorization source as per a note but it is not successful for all the role import and getting above mentioned error.
Please check and advice.
Thanks & Regards,
Koteswara Rao.Hi Koteswara
Have you confirmed in SAP that your ZM* roles are definitely imparting roles only? When you tried to upload them on second attempt, did you relaunch the the role import screen to ensure any buffering completely cleared?
Another thing to try - import the master role and then exit NWBC and run the repository synch job. Go back to NWBC and attempt to import the derived roles to see if error is gone?
If these don't work for you it may be time to contact SAP. I assume it was the following note you referred to: 1576321 - Import derived role without master role
Also, this topic was raised in SCN last year (unfortunately the thread was not updated with the solution). Possibly reach to the thread owner and see if they will login to SCN and update it Role import failed with Master role does not exist in SP13
Regards
Colleen -
"save derived roles" and "generate derived roles"
Can anyone tell the difference between "save derived roles" and "generate derived roles".
Hi,
Save Derived role will save the changes you made to the role(Eg: You might have added a new org value for company code)but this will not be reflect to the users and user masters remain the same unless you generate the role.
Once the Role is generated user masters and profiles are updated.
Rakesh -
ERM: Importing Derived Roles Problem
Hello All,
It appears that if I download and mass import 1 derived role at a time, the ERM mass import works perfectly. But, if I download the same successful derived roles and import them together, the ERM mass import does not import all the role details. Instead, it drops the role description and long description.
This problem occurs if I upload 2 or more derived roles at a time.
Any ideas?
System Details: GRC AC SP12, VIRSANH 12, VIRSAHR 10.
-DylanHi Dylan -
We have found a work around for this, but before I list the steps let me not be presumptuous in my explanation as you must have both the parent roles uploaded in ERM in addition to updating the "Primary Org. Level File" with the appropriate data prior to loading the derived roles.
Upon downloading the derived roles from the backend, 3 files are exported [Bulk File, Info File & Org File] and this is true for all roles that are exported. However, only when derived roles are exported will the Org File be populated with data (i.e. role name). This makes sense because the only time this Org File is needed is when you import derived roles, all other roles only require the Bulk & Info File.
Our guess was the way it was supposed to work is that the Org values were supposed to be exported into this file with the role names, however the Org Level & Value fields are blank. We tried multiple combination of populating this file, but continued to get the same import error. We eventually figured out a way to update this file to pull in all of the Org level data:
*NOTE we found the most success with Mass Import files with the following extension: Bulk - .txt, Info - .xls, Org - .xls
As stated before, the derived role Org file auto-populates the role names that were downloaded. In the 'Derived Orl Level' & 'From Value' fields you need only populate the first value from the 'AGR_1252' table listed in the Bulk file.
Example:
In the Bulk file we have a role: ZD:HR_AT_ANALYST and the first value listed for line AGR_1252 is the client number+role name then the Derived Orl Level and Value. So we populated our Org file to look like this.
Role Name --->>> Derived Org Level --->>> From Value
ZD:HR_AT_ANALYST --->>> KORSS --->>> NRPC
ZD:HR_BN_PAYROLL_DSPLY --->>> PERSA --->>> *
ZD:HR_PY_AT_ANALYST --->>> BURKS --->>> NRPC
If the file is populated this way, somehow it magically picks up the remaining Org Level Data for role when loaded. So the file does not have to actually have all of the values for each role. I can be tedious to sift through the bulk file for the values, but there are quick ways to do it in excel.
Hope this helps, -
Importing master role from ECC into portal throws derived role exception
Hello,
While uploading master and derived role from backend system into the portal I am getting the following exception.
com.sap.portal.pcd.rolemigration.RoleMigrationException: Nested Exception. Failure to execute native function. Nested Exception. ROLE_IS_DERIVED
Does it imply that the derived role is already imported with the import of master role and there is no need to explicitly import the derived role?
The landscape uses role upload tool of portal for UME.
Regards
PoojaHi Pooja,
There is a limitation with the role upload tool that the derived roles cannot be uploaded.
The migration is only able to upload roles which have their own menus. Derived R/3 roles does not have menus themselves as they derive them from other roles. The purpose of the migration is to bring the R/3 navigation structures into the portal. Therefore you can only migrate the role from which your role is derived.
Regards
Anja -
All objects are inactive in derived roles (copied from existing derived role)
I need to create more than 1000 derived roles, from existing reference roles.
Reference roles are also derived roles. So I executed LSMW for mass copy.
Eg: Reference role XYZ with parent role XXX
New role(ABC) copied from XYZ ,so ABC is having same values as XYZ and master role also.
Now the issue is after executing the LSMW all roles are copied to new roles, but all objects are inactive in new roles .I am not able to activate the object also.Hi Colleen,
Issue: I have derived roles for plant XX, now I want to derive same set of roles for YY plant. My reference plant is XX, So what am doing is copying the XX roles to New roles (YY) .No change in object or description, just copy role to new role. And I am using LSMW for the same.
After copy the roles, I will change the description and profile using another script and manually change the org values. But after copy the roles to new roles using script all objects are inactive (In red color),if am selecting the org tab ,I will get message like ,no org levels maintained. Because all objects are inactive .And there are no options (edit) to activate the objects or maintain the fields.
Thanks,
Anusha -
GRC BRM: Update Org Levels of derived roles
Dear GRC experts,
we are using the GRC BRM Master Derived concept and have around 100 Master roles in place.
I understand that the Org Levels of derived roles are only once set per Org Value Map during the initial (Mass) Derivation.
If we add a transation like VA01 to a Master role this also adds some new Org Levels to the Master role. Via "Propagate to Derived roles" the new transaction and object values are added into the Derived roles.
For the new Org Levels these are added also but the values are not the one from the Org Value Map of the Derived role but exactly the same values of the Master Role.
Using "Derived Role Org. values Update" does not help us here to update the corresponding Derived roles as no change to the Org Value Map has been done.
In case a Master role has 40 different Derived roles associated this would require to update manually any of the Derived roles for adjusting the new Org Levels.
Does anybody know how to automate this task?
Many thanks for your help!
Regards,
MarkusHi Markus Richter
Once you maintain the imparting role and propagate to the derived role, the derived roles will inherit the new org values from the imparting. So that at least has the org values in the derived roles but not the correct values
Next up is to try to use the Mass Maintain Roles to update the derived roles with correct values from the org map (ensure org maps were updated first) mentioned in post
Mass Child role Org value update in GRC 10
Does this work for you as an approach?
Regards
Colleen -
ERP Mass Role generating from master role.
Hello
In our ERP system we have several master roles and lots of roles derived from those masters. My question is when I add a transaction or even change one authorization object I have to manually generate all of those sub roles.
How can I do "copy from master role" then regenerate and then compare users more easily? Editing hundreds of roles takes lots of time.
I know PFCG has option Mass Compare and Mass Generate but they are not working for those sub roles.
ThanksHi,
Please go through help.sap.com or google to search and understand the process of creation/generation of master-derived roles:-)
If you have master -derived role created in system, you do not need to generate each individual roles. Just go to change mode of Master role in Authorization tab and beside "Generate" button at the top, you also see an icon "Generate derived role" (CTRLSHIFTF4 is the shortcut key) which can be used to adjust-derive all derived roles inheriting all characteristics of the master role into the derived roles (except the organizational values in case they are separately maintained in the derived roles)
Thanks
Sandipan
Edited by: Sandipan Choudhury on Mar 18, 2011 2:53 PM -
ERM 5.3 (SP12) Derived Role Update Problem
Hello Experts,
I have a question.
We have a master role/derived role set up in the back-end system. We are trying to update a master role and its derive roles in ERM via PFGC sync.
Our problem:
We can add a transaction to a master role no problem in ERM via PFCG sync (adding a transaction code in the back-end and sync to ERM) However, we are unable to update the transaction for derived roles (nothing happens for derived roles in ERM).
If I am correct, we don't have to add a transaction to each derived role manually, and we should be able to update derived roles automatically once we update a transaction in a master role.
Please just note that we successfully imported all the master/derived roles from our back-end system, and we are not try to create a derived role in ERM at this time. All we want right now is to update a master role and its derived roles in ERM via PFCG sync.
If you can, please advice.
HMGo to the TXT file , cut the last line from the AGR_1252 (rtable and insert it to the top of the lines ( AGR_1252) , and reimport it will work I had the same problem in my previous implementation.
try for one parent & child role
This is a known problem with SAP they will rectify it in SP12/SP13 or so -
Org data in Derived role differ from Parent role
Hi there
I need some help please, I am in the process of creating various parent / derived roles and have found that when I update the parent role (org data) and I do a generate do a derived role update the values in the org data is not correctly pulled through to the derived roles.
e.g.
In the parent role for Org data "Purchase Org" the previous value was "/" so that it could be specified in the derived roles should they require the split on this field, however the business has decided that they do not require a restriction on this field so I went back to the parent role and changed the value to "*", so I generated the parent role, updated the derived roles, but when I go to any of my derived roles that field value is still blank, it did not pull through the value * .
We are currently on
SAP_ABA 701 0005 SAPKA70105
SAP_BASIS 701 0005 SAPKB70105
I have created the derived roles with the parent role as the derived from role, it does pull through the values but just does not update it once I do make changes.
Your help / suggestions would really be appreciated as I need to create MANY roles.
Regards
SonjaHi Sonja,
obviously there is a misunderstanding of how the derivation works....
> Thanks guys for the feedback, but surely I do not only need to maintain the ORG data in the derived roles individually, if I have got an Org field that should be the same for all the derived roles I must be able to update the Parent role with this value which then upon generate, and generate / activate the derived roles must update the derived roles.
-->no.
Only the first time of derivation, if the field content in the derived roles are initial...
help.sap.com:
quote
The organization level data is only copied the first time the authorization data is adjusted for the derived role. If data is maintained for the organizational levels in the derived role, and if you have maintained the organizational levels using the dialog box, the data is not overwritten by another conciliation (See SAP Note 314513).
unquote
The whole stuff: http://help.sap.com/saphelp_nw70ehp2/helpdata/en/1c/c38028816c11d396bc0000e82de14a/frameset.htm
otherwise the maintained org.fieldvalues would get overwritten by the value of the master role every time. And that is exactly, what has to be avoided!
b.rgds, Bernhard -
Manually added auth objects and Derived roles
If there are manually added auth objects in the parent role do they come across to the derived roles?
Also if you manually added auth objects into a derived role will they be overwritten by the parent role if you auto derive from the parent role?yes, any auth objects will come across to derived roles when you click 'generate derived roles' from your parent role. basically its copying your parent role authorizations to derived roles except org. level data( if you had maintained them thru 'org. maintainence' button and not adding in individual objects).
yes. manually added auth objects in your derived roles will be overwritten by the parent role authorizations when you click 'generate derived roles' from your parent role.
if you just derived the role menu and din't copy the authorizations(generate derived roles) then there will not be any interlink between the parent and derived roles for authorizations.
http://help.sap.com/erp2005_ehp_02/helpdata/en/1c/c38028816c11d396bc0000e82de14a/content.htm -
Hi,
i am using pfcg for creating roles. When i want to derive a role from a mother role the profile is not taken with the role. Is there a way to derive not only the role but also the profile from a mother role?
Regards
FlorianHello Florian
I still do not see the point yet if the derived role should be identical to the master role then you could do the following:
(1) Copy master role -> name of derived role
(2) Update table AGR_DEFINE for the derived role name, i.e.
- select all values from AGR_DEFINE with AGR_NAME = '<name of derived role>'
- set AGR_NAME-parent_agr = '<name of master role>'
Regards
Uwe -
Does a compsite role can contain a derived role
hi guys pls answer this question
does a compsite role can contain a derived role?
thank youHi Sunny,
Yes composite role can contain derived roles in it. But a composite role cant contain any composite roles.
Please visit:
http://www.*********************/tutorials/composite_role.htm to find more about Composite roles.
Hope it helps.
Please award points if it is useful.
Thanks & regards,
santosh
Maybe you are looking for
-
Not able to drag new data control to my jsf
hi am not able to drag Queriable Attributes into the new query.jsf page and abl to Create it as a Query > ADF Query Panel. this is what i have done 1.In the Application Navigator locate the adfc-config file under the Page Flows node in the ViewContro
-
Webdynpro for ABAP, Enhancement and change of standard "visible" property
Hi Is it possible to change the standard Webdynpro element (in cProjects application), so that the original control "Input" from visible property "Visible" is changed to mine Context variable? How to change that default "Visible" flag in standard ele
-
How to read a flat file into a report?
The file format is like below: Company Code : BUKRS(header) Posting Period :3(header) Then The items data is started as a table format. Line items in table format. If anybody knows the answer please share with me.
-
I own Logic Pro 7( I used to have a PowerPC and need to upgrade to Logic Pro 9 (new Intel chip, system 10.8) . Do I need to buy a whole new set or do I upgrade for less cost?
-
Updates to Acrobat 8 Professional Cause Preferences to Reset
For some time now, any time the software is updated all Preferences settings return to their default settings. Anybody know why this is happening?