PFCG composite role copy issue

'morning!
A colleague of mine is facing a strange problem at her customer site:
On copying composite roles with PFCG you should receive a dialog box with the question "Should the Single Roles Be Copied and Reentered?". This gives you the opportunity to just enter the original singles or to copy them and enter the copies.
Unfortunately this pop-up is missing on their ECC 6.0 system and the singles are always copied as well. This is not the required way.
Is there any system setting/parameter that steers this popup? We would really like it back....

Hmm... I am not logged on so I confess that this is guessing.
Next option is that the message is displayed using a popup function which is obsolete in ECC 6.0 but still using in the coding - which now simply defaults what the function module would have returned.
Activate the ABAP debugger immediately ahead of where the popup should have appeared and look at the call stack to see what the name of the function is?
Particularly keep an eye out
a) CALL FUNCTION 'POPUP_TO_CONFIRM_WITH_MESSAGE'
b) CALL FUNCTION 'POPUP_TO_CONFIRM_STEP'
c) CALL FUNCTION 'POPUP_TO_DECIDE'
d) CALL FUNCTION 'POPUP_TO_CONFIRM'

Similar Messages

CUA problem with composite role

Hello experts, I have a problem with a composite role in my CUA parent system. If you look at the roles tab you will see one of the child roles has a name of child CUA system in the 'target sys' column. the rest all have 'user system'. Can anyone explain how this 'target sys' column is defined?
Thanks
Dave Wood

I do not know if you have solved this issue, but the target system is defined within your single role on you menu tab.
No what happens is that in transaction SM30 table SSM_RFC you define system variable linked to your logical system.
This variable determines that when you import roles from another system by means of transaction PFCG > Read from other system from RFC and you select your variable the system will automatically default in the target system field the system it is suppose to go back to.
So this way when you distibute the roles it will only go back to that particular target system, and you do not need to specify and guess where the role came from.
Try removing that table entry in SM30 SSM_RFC and see if that way you will be able to remove the target system from the role.
However it is not a bad thing to have activated. If you are working with position base authorizations and you have more than 1 system, you define 1 composite role for all the roles, for all the systems and you will be able to see where the composite resides by means of the target value.
Hope this makes sense.
Regards
Sonja

Profile for a composite role

Hello Experts,
We are having a problem dealing with a composite role.
Whenever we add the composite role to a user master; a profile appears for each of the single roles (which is normal) BUT we also get a profile for the composite role.
We verified in the table AGR_1016 and found that there is a profile asocited to the composite role.
We tried the clean-up option of the transaction PFUD which did not work in our case.
We were thinking that may be the role was firstly created as a single role with its profile; and then it mayhave been changed to a composite role without deleteing its profile. Is it possible ?
Any answer is most welcome!
Thanks & Reagards

> We were thinking that may be the role was firstly created as a single role with its profile; and then it mayhave been changed to a composite role without deleteing its profile. Is it possible ?
Sounds to me as if there has been an import of a composite role overwriting a single role with the same name. The pfcg import facility has very few checks in them so something unwantend could have happened. I think it is not possible to change a role from single to composite with the PFCG or other tools. What does table AGR_PROF say about this role?
I would suggest to copy the composite to a new name (without copying the singles) and see how that looks. If it is OK you can delete the corrupted role, check wether it is completely gone and copy the new role back to it's original name.

While transporting a role getting issue - Role type is undetermined

Hi
While trying to transport a single role getting the below error :
Role type is undetermined.
Can somebody help?
Regards
Saurabh

Saurabh,
I faced something pretty much similar and snote:: "770358 - PFCG: Role copy fails due to data inconsistency" worked perfectly for me.
Snote describes quite nicely about the root cause.
Please note this error might come up when you try to copy this role, perform pfud as wel.
Thanks,
Brahmeshwar

Get child users of composite role

Hello
There is FM (ESS_USERS_OF_ROLE_GET ) which bring all user of roles but what i want it's more complicated
IF there is composite role i want to get all the user that in the roles under the composite role .
Let say i have composite role with two roles inside (in the role tree ) .
Composite role
user1"this is the users of the composite role
user2
user3
Role number 1
user4
user7
user9
Role number 2
user 8
user 5
user7
user6
What i want is to get all the users of the composite role and the child role (which is parent ) .
which is .
users 1 - 9.
I read some previous post on this issue in the forum but what I need is to use just this FM without access to the DB
table such as T_AGR_AGRS and COLL_ACTGROUPS_GET_ACTGROUPS ,
What i need to do is recursive call on the FM ESS_USERS_OF_ROLE_GET .
Regards
Joy
Edited by: Joy Stpr on Aug 23, 2009 8:50 AM

Hello Joy,
How is it possible to use just function module ESS_USERS_OF_ROLE_GET to get data without DB access?
I mean this function module takes input as Simple/Composite ROLE so you have to have some list maintained
which will be input for this function module.
I think you can load composite and simple role in table and loop at it to make calls to function module ESS_USERS_OF_ROLE_GET to get users for compsite/simple roles.
Some input has to be there, That's what I feel.
Check if this helps!
Thanks,
Augustin.

Stopping user compare when saving composite roles in 4.6c basis pack 25?

One of the environments I look after is a 4.6c system with basis pack 25 they cant upgrade as it breaks a great deal of very heavy customisation in that system.
We have encountered an issue with the saving of composite roles in that system - when a role is saved we must sit through a very long period of user distribution in role XXX while the system performs a user compare of every singular role in that composite role. This is very painful as it can take nearly half an hour simply to save the composite role we then need to rebuild the menu and compress it (we use the composite roles menu structure). The odd thing is that this behaviour wasnt apparent for many years it suddenly started happening about 2-3 years ago to a previous administrator but he wasnt aware of any changes going through, it just began to force these lengthy compares on him when saving composites.
Ive tried in vain to disable this forced compare on every save Ive tried the PRGN_CUST modifications including adding the lines AUTO_USERCOMPARE with a value of NO and USRCOMPARE_PFUD with a value of YES to try and stop the profile generator from doing this but to no avail. Unless these settings need a restart of the system to take effect (do they?) Im at a loss to find any other options.
The menu setting in the profile generator of automatic user master adjustment when saving role is switched off though setting auto_usercompare seems to have broken the ability to bring up the settings: role maintenance dialogue box anyway.
We have a very large number of roles to modify and would be grateful if anyone could offer any advice here.
Thanks
DT

the problem with your issue is that none of use can reproduce that phenomenon, since none of use has that combination of primal release/support package level at hand any longer (at least i think so). so there's only two options left to you:
first: update this special application until the problem goes away - do so by adding note after note on the very subject, like the one i mentioned plus [905924|https://websmp130.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=905924&nlang=EN&smpsrv=https%3a%2f%2fwebsmp107%2esap-ag%2ede] plus [662484|https://websmp130.sap-ag.de/sap(bD1kZSZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=662484&nlang=EN&smpsrv=https%3a%2f%2fwebsmp107%2esap-ag%2ede] and stop only when you hit one that is not implementable using SNOTE but only by implementing a support-package -> this will obviously be the point where you're stuck then.
(and yes - for the sake of rob burbank: there are several other ways to implement corrections aside from SNOTE).
second: open a call with SAP. mind you, this might become a lenghty one since they will also give you note after note ...
as i said, i'm pretty sure no one in here can help you doing a proper analysis anymore (but maybe i'm wrong).
anyone - any other (better) suggestions?

Reg :Composite role

Hai..       how to create a composite role..and how to assign for perticular user..? am created composite role for ABAP.and assigned to user these roles.when i compare to user comparision the system shows these roles are does not exist for ABAP.
          I assained exist roles. ( sap providing single roles ).
     i could not find out where i do wrong..plz provides solutions for this one.and provide any documentation r step by step procedure.
Thanks and Regards.
MANNY

Hi
Create the role in PFCG, then assign the roles from the copymenus i.e from roles, assign the authorization data, mention the users to get effected and do comparision.
So that composite role is assigned, before that check that whether the single roles are existing or not, and having right access or not.
Check the ROLE_PFCG_DEPENDENCY is scheduled or not.
Regards
Bhaskar.
Edited by: bhaskar1818 on Jun 5, 2008 3:03 PM

Translations in composite role

I created single roles, translated in 3 languages (EN / FR / ZH).
When I assign these roles to users, the menu appears in the logon language of the user.
I wish to create composite roles from my single roles.
When I create my composite role in EN, only English is included in the translations.
If I log in FR and reread the menu (PFCG), I have in this case translations EN and FR but not ZH.
If I try the same manipulation in Chinese, I have the menu in EN and ZH but not in FR...
How do I keep all the existing translations in single roles when I create my composite roles?
Thanks a lot !

Yes!
I maintained those blithering menus for 3 years until another chap (hi Martin) found it didn't need it in BW
Just add singles and save - avoid that read menu from etc at all costs
Cheers
David
Edited by: David Berry on Nov 3, 2010 6:48 PM

SIngle riole that belong to composite role with user

HI,
There is option when user are belong to single role and also belong to composite roles (that include the single role ) ?
BR
Nina

There is option when user are belong to single role and also belong to composite roles (that include the single role ) ?
SIngle role is created by pfcg where you assign the role name n safe it as single role n then after t codes been provided the user has been assigned accordingly
Composite role is same just it contains many roleson to one and similarly the user has been assigned
Thx
Mysterious

ERM / composite role gener. / Function parameter "Authority_check" unknown

Dear All GRC AC Women and Men,
I have a problem to generate a composite role with sap grc ac erm. My GRC version is a 5.3 sp5
For single roles, it s ok.
For composite roles, I to a first generation in GRC AC ERM . The error message is: "Function parameter "AUTHORITY_CHECK" is unknown."
The role is generated in the back-end and the status in GRC AC ERM is "in progress" (Yellow colour).
I do a second generation in GRC AC ERM, and the status is "done" (green colour); the role is generated one more time in the back-end.
The message error in ERM logs is:
"2010-03-18 15:48:48,393 [Thread-140] ERROR com.sap.mw.jco.JCO$Exception: (104) RFC_ERROR_SYSTEM_FAILURE: Function parameter "AUTHORITY_CHECK" is unknown.
java.lang.Throwable: Function parameter "AUTHORITY_CHECK" is unknown.
     at com.sap.mw.jco.MiddlewareJRfc.generateJCoException(MiddlewareJRfc.java:516)
     at com.sap.mw.jco.MiddlewareJRfc$Client.execute(MiddlewareJRfc.java:1514)
     at com.sap.mw.jco.JCO$Client.execute(JCO.java:3980)
     at com.sap.mw.jco.JCO$Client.execute(JCO.java:3417)
     at com.virsa.re.service.sap.dao.GenerateRoleDAO.generateRole(GenerateRoleDAO.java:564)
     at com.virsa.re.bo.impl.GenerateRoleBO.generateRoleAsBackGroundOnMultipleSystems(GenerateRoleBO.java:484)
     at com.virsa.re.backgroundjobs.RiskAnalysisAndRoleGeneration.execute(RiskAnalysisAndRoleGeneration.java:238)
     at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
     at java.util.TimerThread.mainLoop(Timer.java:432)
     at java.util.TimerThread.run(Timer.java:382)"
Do you know the origine of this problem? I am "quite" sure that it is not a back-end problem like authorisations missing for the user rfc (used in Jco).
Best Regards,
Ronan.

Hi Ronan,
This is an issue identified and resolved in SP07.
Please refere to Note # 1290039 if you don't want to upgrade to SP07.
Best Regards,
Sirish Gullapalli.

Not able to assign Composite Role to Position

Hello All,
I am facing following problems.
1) The user is Not able to see Create Report Links, when i checked the Composite Role in PFCG i found that the in USER Tab Organizational Tab was yellow, i did Indirect Reconcillatin in Organizational Tab and then it went GREEN, then i did User Comparision.
I got this Message
"You do not need to perform Prfile Comparision for role " Role Name".
and the Position was removed.
2) Now i am Trying to assing the Role to Position, i am not even able to assign it and the User id is not coming under User id list.
Please suggest.
Thanks,
CB

@Point#1: It could be that user master is already compared for your composite role and no further comparison is required. To double check you might just run the comparison again via tcode PFUD or report RHAUTUPD_NEW
@Point#2: For indirect assigment to position make sure organization management is active in your system (the switch HR_ORG_ACTIVE is set in the table PRGN_CUST to YES).
Thanks
Sandipan

Identifying Duplicate Roles and Traching Composite Role Assigned to the Use

Dear Friends,
I am novice to this website even after browsing for past 3 months. This website is so useful and huge with so many forums. I am lost many times where to post this questions. there is not a single SAP Security Forum or Basis/Security related forum. Can anyone direct me to the right forum or if there is no Security Forums, can anyone direct me how to start new Forum so that all security related discussions and knowledge sharing takes place. I am requesting the Moderators of this website to direct me to the right forums.
we have around 2000 users in Production. We assign Composite roles and single roles to all users. Sometime we use SECATT or LSMW to update User Master Data to Assign some Roles that are ALREADY assigned to the users. I have 2 questions. If there any way to clean up this mess. I mean Identifying all users who have these Duplicate Roles with Different Validity Dates. I am sure SUIM can not help me as I research a lot on this. I appreciate if anyone can direct me with some solution in this cleanup process. I mean some SQL or SAP Query will help me i guess. Any suggestions are greatly appreciated.
My Second Question is Tracking Composite Role/User Assignment Changes. We had assigned some Composite roles to the user 3 months ago and deleted last week. when i check SUIM change documents, It does not show Composite Role history. It is Displaying all single roles that are assigned and deleted later. BUT It never showed any information on Composite Role Additions or Deletions in User Change Documents. I hope SUIM is not going to help. I still need to go to many places or write any Good SQL and execute them.
Is anyone had written this Utility SQL programs for cleanup of roles/users in the SAP. Is there any way to check or debug this issue, going to see any tables that monitor these changes. I appreciate if can one can share this knowledge to resolving this issues.
any ideas and suggestions are welcome.
Thanks
Kumar

Satish,
Please post this in the SAP NetWeaver Administrator Forum and close this thread here.
SAP NetWeaver Administrator
Regards,
Ravi

FM Assigning of Single Roles to Composite Roles

Hello everybody,
I spend the whole day to a find a solution using any source I know and I couldn't find an solution. So sorry if this question has been asked before.
My Question is:
Can you tell me a Function Module which assigns/removes a Single PFCG Role to a Composite PFCG Role.
Regards Max

Hi,
You can add the as many single roles but you cannot add the Composite Roles in Composite Role.

Reg: Change date of Composite role

Hi,
I just need to find out if one of the composite roles in 2 different systems are the same.
Please let me know how to do this.
Regards,

Hi,
If you go to SUIMComparisons Roles and provide the roles (here you can have option of Single as well as Composite Roles) you will get a cumulative list of all the roles which these both roles consists of.
If any role is available in both the composite roles, it will have u201CGreenu201D cube in both the columns and if not then a u201CRedu201D start will be shown.
As logically composite roles are just group of single roles to understand the real comparison you need to compare the single roles which are part of these composite roles.
Please let me know for any issues,
<removed_by_moderator>
Regards
Suhas
Edited by: Julius Bussche on Nov 10, 2009 3:03 PM

ECATT pcfg role copy

Hello experts,
I am new with ECATT. A script has been setup to copy pfcg roles by use of external variants (upload file). The execution failes. First role copy is ok, but the second role fails because the target role name will remain the same as in the first line. "the script does not jump to the next line".
Any quick help is appreciated.
Bruno Lauper

Hi Gilles,
Finally I have found the reason, very tricky. On creating the script the pfcg command "copy role" has to be recorded. After executing the "copy role command" the target role name remains in the entry field. This field must be deliberately deleted before closing the recording.
With this additional step the script run perfectly.
Regards
Bruno

PFCG composite role copy issue

Similar Messages

Maybe you are looking for