One CUP request for assigning role to multiple users

Hi,
We assign roles to users in production only through CUP requests.. We use GRC 5.3
Here we have a case where we need to assign one role to 60 users in production(each user may have different roles assigned in the back end) . I can raise one CUP request for all users using " multi-user" option in Copy request . But when we want to make a risk analysis , it will not show risks at user level as each user had different roles and may get different risks by adding new role.
Instead it will give risks if any for only that new role which want to assign. Our manager is not accepting as this is not giving complete picture of risks for each user when we add new role.
Please suggest me if there is any other way where I can make a risk analysis for each user when I created a CUP request for multiple users.
Or the only solution is to create 60 CUP requests ?? this would be too manual
Regards ,
jaags

Raghu,
thanks for the reply, you are right as per the audit .But suppose if it is for 200 users ,creating 200 CUP requests will be impractical right.
there should be some solution for this , because there will be many situations practically where we have to assign roles to N number of users.
Is this possible in GRC 10 ? any idea ?
Regards,
Jaags

Similar Messages

Role created in ERM is not appearing in CUP request for assignment-GRC 10.0

Hi,
We are on GRC 10.0 - SP5
We have created a role in ERM and it was succesfully created in backend system. However when we tried to assign the same role using CUP request - the role is not appearing.
1) Do we need to upload roles for CUP in GRC 10.0 (similar to 5.3) to populate. Will the role doesnot automatically appears in GRC database for CUP as it is created through ERM?
2) If the roles are imported in ERM with role owner information, does the same reflects for CUP also for role owner approver assignments?
Thanks and Best Regards,
Srihari.K

Hi Sri,
Is the role status set to "production" ??
Cheers,
Diego.

CUP v5.3 SP11.1 - CUP Request button "Existing Roles/Groups"

Hi!
Re: CUP v5.3 SP11.1 - CUP Request button "Existing Roles/Groups"
Can anyone explain why some of our CUP users will see this CUP button in the CUP Request and others will not? Are they missing a UME "ACTION"?
The button works fine, but it only shows up for some users and not others.
Thanks for your help!
-john

Hello ,
For Approvers , the button "Existing Roles /Groups" will be visible only when the following "stage" level setting is set
Change Request Content = Yes
Add Role =Yes .
Regards
-Ranjiv

Table to find the assigned Roles with my User ID

Hello Experts,
1.Is there any specific table to find out the assigned roles to my User ID?
If there is no table, let me know is there any transaction to find out the assigned roles to my User ID?
2. When I assigned Marketing Pro role to my user id in Organization Unit, I am not able to see in webui screen.
when I click on webui transaction, it is displaying some selection screen, there it is not displaying the role I have assigned?
Could you help me to sort out these two queries?
Thanks and Regards
Madhu

Hi Madhu,
1.Is there any specific table to find out the assigned roles to my User ID?
If there is no table, let me know is there any transaction to find out the assigned roles to my User ID?
Sol'n : You have so many Class Methods for finding your requirement else FM aslo.
Go to SE84 there u will find search ClassMethods. There u type getuserRole or userRole* and press F8. Pick the one which you feel it may give you the result
ie you have to execute the class...if it showing instance on the tool bar click on that then press execute the method which you feel relevant to you, and give input parameters.
Sol'n for 1 point is: CL_CRM_UI_ROLE_ASSIGN->GET_BUSINESSROLES_FOR_USER.
2. When I assigned Marketing Pro role to my user id in Organization Unit, I am not able to see in webui screen.
Sol'n: Go and check in T-code : BP. Dispay Ur BP and check for Employee Meantaied -- Identification Tab..Did u maintained ur Userid over there or not
when I click on webui transaction, it is displaying some selection screen, there it is not displaying the role I have assigned?
Sol'n: Need clarification on this point.
Regards,
Lokesh
Edited by: Lokesh on Mar 8, 2010 7:37 AM

Deleting roles from multiple users simultaneously

I need to delete all of the roles from multiple users and I was wondering if anyone knows of a way to do it simultaneously other than a Mercury script(it wont take the roles away that are lower than the initial 20)?

Hi there,
there could be easier ways to do it, but this is how I'd go about it if I didn't want to go to each user ID.
Get a list of all roles assigned to your users you want to restrict from SUIM (display the list of users via tcode S_BCE_68001400). Click on the 'roles' button and it will pull up a list of all the roles assigned to those users. Extract and save that).
Filter the list so you have only one entry of each role name.
Then go to SU10, enter in all your user IDs to change and go to the role tab, enter the unique list and put wide dates on it say from 01.01.1995 - 31.12.9999 (you want them earlier than the earliest role 'valid from' date and later than the latest role 'valid to' assignment).
Click the 'Remove' box and save and you should have all roles removed.
Good luck with it.
Cheers,
Dianne

Give same role to multiple users in CUA

Hi gurus
Urgent!!!!!! need help
How do I give same roles to multiple users in CUA without going to user id and giving access to the same role individually in CUA.

SU10 or SECATT
Edited by: John Navarro on Feb 22, 2008 10:22 PM

Create a CUP request with no roles

Hello
Is there a a way to create a CUP request only with free text and not with assigned roles? we are trying to find a way to configure that with no luck.
Since the end user does not know which roles he needs the customer asks that he will fill in his request in the free text space
(with the relevant mandatory fields that are in the initial screen) and the first approver will add the relevant roles based on the text that the user entered in the system.
Kind Regards,
Shira

Hello Shira,
Thats correct, there is no feature to force the approver to select roles prior to approval of the request.
In my case we were using default roles so every request created would have minimum set of default roles available in it. Apart from that, we forced the request to go through the Functional Lead stage who would be responsible to check if correct roles have been assigned to the request by the Functional Executive in the previous stage. Also, since the Functional Lead stage used the approver determinator as Role (role owner defined for roles), if there was no role attached by functional executive in previous stage, he/she would not be able to approve the request without any role as it would not be able to find the approver for the next stage and thus the system will throw error.
We also used the organizational process procedures to educate the functional excutive about their responsibilities of attaching roles to the request. So i would say that combination of factors worked for us in this scenario.
Regards, Varun

SECATT for assigning roles to users

Hi All,
How do we make the ECATT to work for the below scenario:
Users already have roles assigned to them. We need to add a new roles to the users which can vary in number based on the users job.
A simple ECATT script that was developed to add a single role to a new user does not work in the above case and gives an error of invalid batch input. How do I create a ECATT to assign role to user who already has a set of roles assigned (number of roles assigned to users differ, so I cannot assume to train the ECATT to assign a role on line X). Is there something I am missing while the ECATT script creation?
We are doing this from a CUA and its very difficult to assume how many roles a user could have.
Thanks,
Jay

Thanks Alex for the insight. For some reason SU10 is slow in the CUA environment and I wanted to avoid it but yes I finally had to use SU10. Talking to one of our ABAPer I came to know that even in their BDC recordings they get the error which I receeived, but he changes his program to skip all the lines with data and then fill the empty line.
In CUA environment, how do we create ECATT to delete a role from many users?
Thanks,
Jay

Creation of auto approval process for assigning role for a user in oim11g

currently i'm doing a scenario like a user must be automatically assigned to a role by using approval policy where the user is already there in oim and then we use csv file in that we take 2 columns like userlogin and role name so by running this scheduled task user must be automatically approved to that role.But i have to use the default auto approve policy in oim without creating any bpel process for that so can any one suggest me how to proceed with this scenario.
Thanks in Advance for quick response.

If I understand correctly, You have users and their respective roles in csv file. Users are present in OIM. You want to assign those roles in csv file to respective users?
If this is the scenario, you need to write a custom code for schedule task which will read data from your csv file, create roles and assign them to respective users.
to create custom schedule task in OIM 11g, you may refer to:
http://docs.oracle.com/cd/E21764_01/doc.1111/e14308/scheduler.htm
regards,
GP

Error in assigning role to multiple task

Hi,
We are using BAPI BAPI_BUS2175_ROLE_ASSIGN_ADD to assign role to task. It is working fine if we are assigning different role to different tasks. But if we assign the same role to different tasks in a project, it is giving dump while saving the data.
We are using following sequence in the code:
1. BAPI_BUS2172_LOAD to load the project
2. BAPI_BUS2175_ROLE_ASSIGN_ADD to assign role to task
3. BAPI_CPROJECTS_COMMIT_WORK to save the changes.
So when BAPI_CPROJECTS_COMMIT_WORK is executing, it is giving dump as follows.
The exception 'CX_DPR_FATAL_ERROR' was raised, but it was not caught anywhere
along
the call hierarchy.
Since exceptions represent error situations and this error was not
adequately responded to, the running ABAP program
'CL_DPR_AUTHORIZATION_SERVICES=CP' has to be
terminated.
Could you please let me know what may be the reason for getting dump.
Regards,
Anil Salekar

I can tell you the table where the the role assignments get stored . It is
DPR_ENTITY_LINK.

REQUIRE One spool request for n copies in one print command in smartform

Hii Friends,
          I created a smartform..I require 5 copies of that form..There is a text which needs to be changed in evry copies...eg Original in first copy
                        Duplicate in second copy
                        Triplicate in third copy....n so on
So i used a loop n i am calling smartform 5 times....The problem is i need one spool request to be created..
Note: By default sometimes it create one spool request and sometimes 3 spool request...
Pls share your inputs ............
Thanks,
Regards,
Sujit.

hi,
this is more complicated see below description from help
regards,darek
Printing Several Forms in One Print Request
Use
You want to bundle several forms into one print job.
Print Request vs. Spool Request
SAP Smart Forms allows you to bundle several forms to form one output unit. This output unit is called a print request. A print request is different from a spool request:
Whether a new spool job is created in the spool depends on the settings in the spool dialog.
Whether a new print request starts depends on the standard parameters of the generated function module you set in SAP Smart Forms. For each print request, the spool dialog is called only once. If you suppress the dialog, you can pass parameters for spool processing only at the beginning of the print request.
This means that a print request gathers several forms before submitting them to spool processing. Thus they cannot be spread over several spool requests. Vice versa however, you can include several print requests into one spool request.
Procedure
Use function module SSF_FUNCTION_MODULE_NAME to retrieve the name of the function module generated from the Smart Form (see also: Integrating the Smart Form Into the Application).
Call the Smart Form for the first time and set the NO_CLOSE parameter of the control structure. This prevents the print request from being closed after accepting the output of the Smart Form and allows you to include all other form output into this print request as well. Leave the NO_OPEN parameter empty.
Instead of calling the Smart Form for the first time you can also call function module SSF_OPEN .
If you want to start a new spool request for the print request, set the TDNEWID field of the Output Options in this first call.
For all other form output of the application program that you want to include into the print request, use a loop to set both the NO_OPEN field and the NO_CLOSE field of the control structure.
To close the print request, in the call of the last Smart Form set the NO_OPEN parameter and unmark the NO_CLOSE parameter.
Instead of calling the Smart Form for the last time, you can also call function module SSF_CLOSE .
Result
The forms you called in the steps described above are included into one print request. If in the first step you started a new spool request, you can now view its status in the spool request overview (transaction SP01 ).

Requesting for Security Roles

hi,
can you just tell me the security roles.
our company is going to implement a project. we dont have any KT and procedure for creating roles
our company is starting to implement SAP. please suggest me for creating roles and authorisation design.
thanks
Ramesh

Hi Ramesh,
If you don't have security training/experience I suggest that you book yourself on course ADM940 which covers auth basics (including info on creating a role matrix etc).
If you don't have this then make sure that you work with someone who has done this. You would be very lucky to produce a reasonable design without either the training or using someone who knows what they are talking about.
Other resources are the following publications (you can find them via google):
Authorizations Made Easy (the 4.6 version is bit out of date but if you read & learn it you will be more than OK)
SAP Security and Authorizations
Risk Management and Compliance with Legal Regulations in the SAP Environment
SAP Authorization System
Design and Implementation of Authorization Concepts for SAP R/3 and SAP Enterprise Portals
For a wide overview of security I would recommend the SAP Security and Authorizations book, as a design aid I personally feel that SAP Authorization System would be more appropriate for a newbie

Assigning Action to multiple users dynamically

Hello,
I have a GP Application wherein the user fills out a form which goes for approval to the Approver....the approver is determined using the 'Assign users to Process Role' Callable Object dynamically which works fine....now i want one more approver to get the same workitem in the worklist as the other....i tried to map this user to the same user identifier as done for the first user.....but it does not work.....how can i achieve this..?
Any help would be highly appreciated..
Regards,
Anil

Anil,
Has i am not wrong are you trying to assigning a task to multiple users dynamilally?
if so..
Please Use parallel dynamic block and pass list of users to role.
Reply me if you want more info.
Regards,
Rajesh

How to assign Action to multiple Users dynamically in GP

Hello Experts,
I have the following scenario in GP
I have created a Web Dynro GP Callable Object and from my Web Dynpro i need to a pass a list of Users to which a particular Action needs to be assigned.
I am able to return a single value from web dynpro to gp.
Can some one help me how to return a list of users to gp.
I have done the following: In the getDescription method I have added an attribute of multiplicity 1_N:
IGPStructureInfo outputStruct = technicalDescription.getOutputStructureInfo();
IGPAttributeInfo list1 = outputStruct.addAttribute("List1", IGPAttributeInfo.BASE_STRING);
list1.setMultiplicity(IGPAttributeInfo.MULITIPLICITY_1_N);
then in the complete method I am trying to set an Arraylist to this variable:
IGPStructure output = execContext.getOutputStructure();
output.setAttributeValue("List1", userList);
Here userList is an Arraylist which contains the list of User Id's..
However I get the following exception:
com.sap.caf.eu.gp.exception.api.GPInvocationException: Multiplicity of attribute with name List1 and namespace null does not allow single values to be set/received
at com.sap.caf.eu.gp.structure.impl.GPStructure.setAttributeValue(GPStructure.java:114)
Can someone help me in knowing how I can return a list as an output parameter to GP from Web Dynpro...
Regards
Sundeep

Hi Srinivasan,
Of course the Role is Runtime defined...
I would brief you again the mapping that I have performed in the Design time at the processlevel.
From Web Dynpro I return a List of type String and Multiplicity 1..N.
I map this List with the leaf item User Identifier contained in the User List Input parameter of the Assign User to Process Role callable object.
However since the User Identifier parameter is of cardinality 0..1 only the first value in the returned list is getting assigned to it. Thus the task is getting assigned to only one user.
Now it is not possible in Design time to Group or consolidate parameters of different types. Thus the List which is of type String cannot be mapped to User List or the User_Item contained within it which are both of type Structure and multiple cardinality.
I even created a Structure in Web Dynpro of cardinality 1..N and withing it i included a List of type String and cardinality 1..N. Now I returned this Structure from Web Dynpro and tried to map it to the User Item Structure of the Assign User to Process Role Callable object, but doint this the task did not get assigned to any user..
One question:
Don't you think that in order for the task assignment to happen using the Assign User to Process Role Callable Object the leaf item User Identifier parameter contained in the User_List input parameter of this callable object needs to be populated with the required User Id's.
But if the cardinality of this parameter is always 0..1 , is it possible to achive the assignment of an Action to multiple Users at runtime using this Callable Object?
Can you please explain the parameter mapping you followed in order to achive this...
Regards
Sundeep
I want to ensure that you remain in the top 3 contributors in this forum
I will continue to reward points for your answers
Edited by: Sundeep Sethi on Sep 4, 2008 1:47 PM

Assigning roles to 10000 users

Hi Guru's,
I need your solution regarding role assignment to 10000 users.My client is having 10000 users.
My perception for this is
[Role]
Roleid = Path;
user = user1;user2;user3;...............user10000;
Writing above code in text document and importing then exporting in user administration.....
Is there any approach to assign a role to 10000 users in one go.
Please share the solution for this issue.
Regard's,
Prashanth

You can use the Import functionality of User Administration.
Use Groups as principal.
Example
[group]
gid=Z_GRP_HR_ESS
gdesc=HR Group for Employee Self-Service
user=DHANZ1;DHANZ2;.......
Import utility times out for huge user base....so split 10000 in 2 batches...eg first load with 7000 users and second with 3000 users.
Second run do it in overwrite mode
Once the loads are complete you can manually assign the corresponding Roles to the Group. It is best practise to assign
Users -> Group -> Role.
Also you get a detailed log after import with errors -> You can fix that in your import file and run the utlity again.
Good luck ~ Dhanz

One CUP request for assigning role to multiple users

Similar Messages

Maybe you are looking for