Object Sync

Hi All,
I am in the process of including the additional child client into the SAP GRC 10 systems and I have configured all required plugin related connectors in both GRC and ECC system.
RFC connection has been established between both the systems from GRC to ECC and ECC to GRC
GRC system configuration:
GRC\Common Component Setting\Integration Framework\Maintain Connectors and Connection type
In the Define connectors -> I have defined the new child system ECC and also defined in the logical connector
Maintain Connector setting -> I have defined new child systems in all four integration scenario's ,AUTH, PROV, ROLMG and SUPMG
Access Control\Maintain Connector Settings - I have defined the Target connection as ECC
4000 - application type was set 1 already
4010 - Firefighter ID role name was set the the role
In the Child System (ECC)
GRC (Plugin) \ AC\ Maintain plugin configuration settings
I have defined the parameters
1000 (Child system)
1001 (GRC system)
1089 (SUPM) EAM Application
1090 FFID role Name
I have verified several times and I did not missed any configuration.
Issue:
I have created the two firefighter id in Child system ECC and assigned the FF_ID Role to the users and then executed the GRAC_REPOSITORY_OBJECT_SYNC for fetching the user id information to the GRC system. the job was completed successfully but FF_ID are not showing up in the GRC environment.
Please assist
Thanks,
Esh

Hi,
Yes, Role was assiged to the FF_IDs in the backend system already.
Requirement:
My client has two production client 100 & 101. We had established the connection to 100 earlier and every thing working well for 100. but now the client want to bring client 101 also under the GRC for setting up the FF_ID's.
We have done all required configuration ib both GRC and backend client 101 and job ran secussfully but FF_ID are not visible on GRC system.
We are able to setup the trusted RFC connection to only 100 client and not able to create the t-rfc for the client 101. I am getting a messgae that t-rfc was already exists for this server. does this impact of getting a data from the client 101 to GRC system?
Please assist.
Thanks,
Esh

Similar Messages

Ad objects sync time

Hi,
what is the time of directory objects sync.
Is it 15 min default?
Example: multisite domain (10 DCs):
1. 5 users created on site 1
2 5 users created on site 2
3. they are added to a group on site 10
4. 5 computers from site 4 added as a group members of site 1
What is the sync time in the examples above?
Thanks.
--- When you hit a wrong note its the next note that makes it good or bad. --- Miles Davis

Hi,
what is the time of directory objects sync.
Replication of AD Objects between domain controllers in a site is "Instant". However intersite replication (I mean replication between sites) depends on your configuration. I configured mine to be 60 minutes because I needed it that way. The default
is 180 minutes however.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or
to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Managing impact of GRC10 portal repository object sync

Hello all,
Now that our repository object sync for the Enterprise Portal connection is (finally) working accurately again, we are again facing the issue of how to manage the impact, since the system is, for all practical purposes, not usable during that 3+ hours each day. We are considering locking out the users and posting the sync schedule on the portal page to remind users that they will be locked out. Is this what others are doing? If you have a better idea, I would be interested in hearing about it.
Thanks,
Gretchen

Hi Nitesh,
We worked on this issue for quiet sometime with SAP to get this finally fixed You can check all below mentioned notes.
First Check:
Please check the Note: 1915763 - Error Provisioning from GRC 10 to SAP Portal while adding or removing a role in Change Account request type.
This Note says that if your LDAP set as data source is read-only in Portal, then you need to change it to Modifiable in order to allow create or change user belonging to LDAP.
We have set the UME correctly and no longer read-only. But our access requests still used to fail with the following messages.
"Object class name does not exist in IDM".
Second Check:
Kindly ensure the field mapping for portal is done in IMG settings properly.
If it is fine please check below note 2033714 - AC10.0: error in SGL1 "Object class name does not exist in IDM".
This note is only to check if you have made any mistake with your portal mapping and doesn't address the correct issue.
Third Check:
Finally after implementing SAP note 1941250 - UAM: Truncated parameters provisioned on changing users from Access Request
our issue got fixed.
Regards,
Madhu.

Is it possible to archive FIM admin objects (sync rules, email templates, MPRs etc..) as XML files.

Hellos.
We are wondering if we can extract/dump FIM objects as .xml files for Archive/Version control purposes.
The objects we are interested in archiving are basically all the FIM Administration stuff.
Is there some documentation about how individual FIM Administration objects can be archived via Portal or FIMcmdlet
*HH

you can even visualize this using visio
https://unifysolutions.jira.com/wiki/display/FIMTEAMCOM/2014-02-19+-+Auto-document+your+FIM+Portal+Solution
Henry

RFC error while running sync job in AC 10

I have done all the configuration to add new SAP system via SPRO in GRC 10. Now I am trying to run the sync job for the first time, I am getting the below mssage. I checked the RFC desitinations, it looks fine.
Error in RFC; 'Function module "/GRCPI/GRIA_ROLE_GET_RANGES" not'
Error in RFC; 'Function module "/GRCPI/GRIA_ROLE_GET_RANGES" not'
Role sync failed with errors
Program for Repository User Synchronization
Error in RFC; 'Function module "/GRCPI/GRIA_USR_GET_RANGES" not f'
User sync failed with errors
Repository Object sync job failed with errors
Please check SLG1 for further details
I checked in SLG1 also, its displaying the same errors as listed above. I have some systems added earlier which are correctly configured and working fine. I tried to match the configuration with the new systems, and everything looks fine. Not sure why this error is coming.
Please someone can help.

Hello,
It seems to be a problem with the add-on in the back-en system, and a function module couldn't be found. Check the RFC connection (refer here for example GRC AC10 sync job error ) and make sure the add-on is properly installed.A simple check could be go to the back-end system, tx SE37 and check if the function modules exist.
Cheers,
Diego.

GRC AC 10.1: Authorizaion Sync Job Error

Hello Everyone,
I'm currently configuring my GRC 10.1 Access Control, I have just finished my common configuration tasks and ran the initial Authorization full sync job.
and am facing the below error message.
Authorization Sync
Starting authorization sync for connector SE3CLNT302 and language EN
Error in SE3CLNT302; Reason Error in RFC; 'No RFC authorization for function m
PFCG authorization sync failed with errors
Repository Object Sync
Program for Repository Profile Syncronization
Processing for connector SE3CLNT302
Error in RFC; 'No RFC authorization for function module /GRCPI/GR'
Profile sync failed with errors
Program for Repository Role Synchronization
Processing for connector SE3CLNT302
Error in RFC; 'No RFC authorization for function module /GRCPI/GR'
Role sync failed with errors
Program for Repository User Synchronization
Processing for connector SE3CLNT302
Error in RFC; 'No RFC authorization for function module /GRCPI/GR'
User sync failed with errors
Repository Object sync job failed with errors
Please check SLG1 for further details
I have double checked my connector settings and connection setting, everything seems fine. I checked the tables GRACCONNSTAT and GRFNCONNSCNLK, the tables are populated correctly. I checked to see the RFC ID passes the authorization test and connection test and the logical systems are populated in BD54, can anyone please tell what I'm missing here and why i'm facing this error message?

Hello Reddy
Kindly assign the role SAP_GRAC_ALL to the RFC user . This user can also be
assigned the profile SAP_ALL.
Best Regards,
Neeraj

Errors while running Sync Jobs in GRC 10

Dear Experts,
I am trying to configure RAR in GRC 10. I have all required config steps and now I am trying to run Sync Jobs and I am getting below errors.
Authorization Synch
Program for Authorization data Synchronization
Starting authorization sync for connector RC1 and language EN
Error in RC1; Reason Error in RFC; 'Function module "/GRCPI/GRIA_AUTH_G
PFCG authorization sync failed with errors
Repository Object Synch
Program for Repository Profile Syncronization
Processing for connector RC1
Error in RFC; 'Function module "/GRCPI/GRIA_PROF_GET_RANGES" not'
Profile sync failed with errors
Program for Repository Role Synchronization
Processing for connector RC1
Error in RFC; 'Function module "/GRCPI/GRIA_ROLE_GET_RANGES" not'
Role sync failed with errors
Program for Repository User Synchronization
Processing for connector RC1
Error in RFC; 'Function module "/GRCPI/GRIA_USR_GET_RANGES" not f'
User sync failed with errors
Repository Object sync job failed with errors
Please check SLG1 for further details
I appreciate your help.
Thanks,
Raj

Hi Raj,
I have a similar error for which I have put up a separate post, your input would be highly valuable.
My RFC connection works via the test in SM59 but when executing GRAC_AUTH_SYNC I get a simiar error to your above.
Please let me know what steps you took.
Best regards,
Paul

REPOSITORY SYNC

Hello,
Currently we are working on configuration of LDAP AD on GRC(sp13) system.
Done with all the required configuration as per the recommendations by SAP.
But, while trying to perform repository sync getting error as" USER ADAPTER IS EMPTY".
I am able to search the users in access request form. But,when i select the user,the user details are not being populated automatically.
Our AD has has an upper limit of 1,000 entries, which is the maximum possible number of hits in a search request. The no.of user's I am trying to sync is more than 7000.
I tried changing the page size, and gave values as 100,200,500,1000 but it doesn't work out.
SAP Notes refereed are, 1823253,175567,1510286,584121.
Please suggest,what steps needs to be performed.

Hi Sai,
Can you confirm and follow these steps..
1. LDAP connector name should be identical as LDAP Server name. These have to be the same.
2. What string is used while searching users in LDAP. Execute LDAP tcode and find the users with default string. for example ...(&(objectclass=*)(samaccountname = a*)). If you have some different string to serach users, then we need to find out from LDAP team if they can set your searchable string as default.
3. Check whether Base Entry is maintained in LDAP tcodes for your LDAP server. If not, maintain that as well.
4. Refer to SAP Note "1755767 - Repository object sync from LDAP fails".
Following these steps will ensure that you have all the configuration as per recommendations.
You can refer to GRC10 LDAP as search data source
This must help you in resolving your issues.
Regards,
Ameet

LDAP user sync in GRC.

Hi Experts,
We are trying to configure LDAP AD on a GRC system(sp 13).
Done all the required configuration and field mapping.
Connector is working and able to login to LDAP server with system user.
LDAP connector name is same as LDAP Server name.
Base Entry is maintained in LDAP tcode for LDAP server.
But, not able to perform repository sync,showing error message as "USER ADAPTER IS EMPTY".
Not mentioned attributes for the connector in "maintain connector settings", do i need to maintain these to run repository sync.
Please suggest,
Thank you in advance.....

Dear Sai,
please follow the instructions below:
1. LDAP connector name should be identical as LDAP Server name. Please check if this is same?
2. What string is used while searching users in LDAP. Execute LDAP tcode and find the users with default string. for example ...(&(objectclass=*)(samaccountname = a*)). If you have some different string to serach users, then we need to find out from LDAP team if they can set your searchable string as default.
3. Check whether Base Entry is maintained in LDAP tcodes for your LDAP server. If not, maintain that as well.
4. Refer to SAP Note "1755767 - Repository object sync from LDAP fails".
Following these steps will ensure that you have all the configuration as per recommendations.
Regards,
Alessandro

PFCG authorization sync job has been running for over a day?

We have installed GRC10 with NWBC and are attempting to run the initial PFCG authorization synchrozniation using transaction GRAC_AUTH_SYNC. It was set to run first followed by the Repository object sync for users, profiles and roles however the initial PFCG authorization synchrozniation is still running over a day later.
There has been no error yet but wanted to check with everyone how long it should take, if there are any known errors and if the process followed in the SAP GUIDE below is correct.
Synchronize PFCG Authorization Data
1. Execute transaction GRAC_AUTH_SYNC.
2. Select a variant (optional) and click Execute.
3. Enter the system connector ID to execute the User Master Data synchronization.
4. Enter the connector language.
Thanks

You can check the background process running in SM50 transaction.
Time for running this job depends upon the selected varian/systems and data (SAP Auths/Fields) present in the backend system
Regards
Rajan Arora

Ical syncs with tungsten t2 but NOT with Tungsten E2 on same computer

iMac 1.25 Ghz
OS X 10.3.9
Hotsync Mgr 3.2.1
iSync 1.5
Palm Desktop 4.2.1d
Tungsten E2 - Palm OS Garnet v 5.4.7
Tungsten T2 - Palm OS 5.2.1
I have two Palms (one for me - one for wife). We also have two logins on the iMac.
Objective: Sync with iCal, Address Book (i.e. not Palm Desktop utilities)
My Palm (T2) has been installed for 2 years - syncing flawlessly
Her Palm (new E2 - installed tonight) will sync Contacts but not iCal. When I place test entries into either the Palm or her iCal, iSync sees the new data and claims it has transferred it but it doesn't show up in the destination device. Both directions fail.
It seems that the system is smart enough to connect the right Palm with the right set of iCal/Address Book whichever person is currently logged in and I have seen exactly the same problem, regardless of whether only one or both users is logged in (with Fast User switching).
It seems as if lots of people have observed iCal sync problems with Palms while the other apps sync fine but I haven't yet seen somebody with two Palms like me having different experiences.
Is there something particularly flaky about Tungsten E2 or is this an issue between two different versions of Palm OS?
TIA
Adrian

Assuming that the issue outlined below is not the problem, and that you have unique HotSync names, have you tried logging out, having her log in, and performing an initial synchronization in iSync? Procedures for that are outlined below.
http://docs.info.apple.com/article.html?artnum=25611
Mac OS X 10.3, 10.4, Palm HotSync: Fast User Switching - one Mac OS X user may sync at a time
One logged in user may sync a PDA via Palm HotSync at a time. This applies to iSync Palm Conduits, too.
When your computer is using Fast User Switching and other users are logged in, you can't sync your Palm OS-based device using Palm HotSync or iSync.
This can happen if another account has already used Palm HotSync or iSync to sync a Palm OS-based device. Have the other person log out of his account. Log out of your account, then log back in. You should be able to sync.
Before you perform the procedure outlined below, be sure that you are logged out and she is logged in, and that the drop-down preference pane which appears for her device in iSync when you press the Tungsten icon has legitimate calendar options selected.
To reset and perform an initial synchronization, launch iSync and open the Preferences… dialog. Press the Reset Sync History… button, then perform an initial synchronization. When asked if you want to Replace or Merge your data, choose Replace. This will overwrite the data on her handheld, and subsequent synchronizations should work properly, so long as you are not logged in in the background.
This issue has nothing to do with the different Palm OS releases embedded in your respective devices.

Problem running a Java program

Hi...I'm developing a CORBA project and I'm using java to implement it. I wrote a Hello World program and I could compile all my files (IDL files and all the generated .java files). But when I try to run my Server program I get the following error message:
Exception in thread "main" java.lang.NoClassDefFoundError: HelloApp/_HelloImplBase
at java.lang.ClassLoader.defineClass0(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:486)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:111)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:248)
at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:297)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:286)
at java.lang.ClassLoader.loadClass(ClassLoader.java:253)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:313)
at HelloStringifiedServer.main(HelloStringifiedServer.java:24)
Can anyone please help me!
Thanks in advance

Sure, here is the Server code:
// HelloStringifiedServer.java, stringified object reference version
import java.io.*;
import org.omg.CORBA.*;
import HelloApp.*;
public class HelloStringifiedServer {
class HelloServant extends _HelloImplBase
public String sayHello()
return "\nHello world !!\n";
public static void main(String args[])
try{
// create and initialize the ORB
ORB orb = ORB.init(args, null);
// create servant and register it with the ORB
HelloServant helloRef = new HelloServant();
orb.connect(helloRef);
// stringify the helloRef and dump it in a file
String str = orb.object_to_string(helloRef);
String filename = System.getProperty("user.home")+
System.getProperty("file.separator")+"HelloIOR";
FileOutputStream fos = new FileOutputStream(filename);
PrintStream ps = new PrintStream(fos);
ps.print(str);
ps.close();
// wait for invocations from clients
java.lang.Object sync = new java.lang.Object();
synchronized (sync) {
sync.wait();
} catch (Exception e) {
System.err.println("ERROR: " + e);
e.printStackTrace(System.out);
I get the previous error message when I try to run this file. Other files are those generated by the IDL compiler
PS: Are you familiar with CORBA?

Problem with BDOCS Business Partner CRM - PSCD(R/3)

I have a problem with BDOCS (Middleware, Data Exchange Synchronization).
I configured only Synchronization for Business Partner Type 2 Organization and 3 Group(In the Initial Load). However, when PSCD add or modify Identification Number (table : BUT0ID) for other types of Business Partner, for example type 1 Person, the BDOCS generate a update in CRM (inbound queue) specifically produced a show processes in PSCD, because the table TRFCOUT progressively grow, and also in the outbound queues table.
Do you have any idea what happen ??
or if i can use a kind of filter to the Bdocs online??
Because i only can filter the BDOCS in the initial load but not in the bdocs online.
thanks in advanced

Hi,
Configuring the business partner integration from R/3 is done in the PIDE-transaction on the R/3-side and in the customer_main object on CRM-side. Simply enter the filter settings in the object, sync it with R/3, check your filter settings in table CRMFILTAB on the R/3 side.
Grtz,
Michael.

User details are missing in Access request in GRC 10.0

Hello All,
When we are trying to create Access request in GRC 10.0 for an user it results as user details not found.
Under SPRO - Maintain data source configuration we have configured 2 HR systems HR1 and HR2.
But the User details exits in HR1 system and lies in validity also. We have tried to run the Repository Object Sync also still unable to search the details.
But we observed even after the Sync job User details are not created in table GRACUSER and GRACUSERCONN. Is this could be the problem. Why its not updating even after the Sync job many times almost 10 times.
We have also configured parameter 5023 to YES.Please advise.
Thanks in advance.

Did the sequence for HR1 set to 1 or 2, I hope you are following the suggestions given by Luciana in other thread.
Please post your data source config screenshots otherwise.
BR,
Mangesh

GRC 10.0 SP 14 access request form displays unassigned roles

Dear experts, when I open the Access Request form and I select a user, and then I click on existing assignments, I am shown a list of roles and systems assigned to this user. However, when I go to those corresponding backend systems to see if the roles are actually assigned, it turns out that they are not. I have rerun all the sync jobs and they all completed successfully. Auto provisioning works on all these systems and there are no issues in terms of the RFC. However, as indicated by the attachments, it continues to show rules that were unassigned from this user some time ago. where might these assignments be coming from?

Hi Santosh,
did you run the repository object sync job in full mode for this connector? This has mostly to do with outdated sync information as you can also see in the following note:
http://service.sap.com/sap/support/notes/1667112
Please check again.
Regards,
Alessandro

Object Sync

Similar Messages

Maybe you are looking for