RARs' criteria for analyzing roles in ECC backend system?

Hi All,
I'm working on setting up a prototype of Access Control 5.3. In RAR I notice the analyzis of roles is not done for all roles.
I have taken note 1179717 into consideration, and also performed mass user compare. But not all roles are analyzed yet.
Some of the roles are not tied to a profile, but it seems RAR does not segregate on this.
Does anyone have a list of criteria RAR uses when looking at what roles to analyze?
Thanks in advance,
Leif Nilsson

Hello Leif,
You can find SAP Notes only on SAP Service Marketplace
https://websmp103.sap-ag.de/notes
You cannot directly compare the numbers of RAR with the roles you want to analyze, without following the below steps completed successfully.
1- Connect the SAP backend system to Risk Analysis and Remediation and complete all post-install activities.
2- First you have to run the report RHAUTUPD_NEW in your backend system.
3- Select all roles, select 'Perform User Master Comparison', but check only "cleanups" from the 'editing types'.
4- Now execute the report.
5- When finished re-run a full user, role, profile synchronization for this SAP backend system in Risk Analysis and Remediation.
There are two types of synchronization, Full and Incremental:
6- Select Full synchronization
7- Perform Batch Risk Analysis. This is the core function of RAR.  By performing a batch risk analysis, the security of the users/roles/profiles are compared against the Segregation of Duties rules to identify possible conflicts. It then makes a call to the back-end system to retrieve the authorization assigned to each of these user/roles/profiles.  It then performs the analysis against the rules in the front-end.
8- Run Management Reports. Running this piece of the job is what ultimately updates the numbers you see on the Management Report and table virsa_cc_prmvl is updated.
9-  You will get the list of total Number of Violations , the Violation count by Risk and  Violation Count by Permission
Now you are ready to compare the numbers in the following way, seen below.
10- Log on to your SAP backend system and use transaction SE11 to identify single roles with profiles from table AGR_1016, but note that roles having multiple profiles appear multiple times in this table.Count the number of distinct roles in table AGR_1016.
11- Now, only count those distinct roles in AGR_1016 that have also an entry in AGR_DEFINE. You can do this with a small custom report or with Excell.
12- In your SAP backend System use transaction SE11 to count the number of profile in table USR10 having the flag 'AKTPS' set to 'A'. Each profile appears only once in this table.
This number should match the number on profiles synchronized in Risk Analysis and Remediation.
Thanks,
Mohi

Similar Messages

  • Implementing SAP EP as a Central Portal for mulitple R/3 ECC Backends

    Hello
    We are trying to implement an Incident / Occurrence Management Solution for a Company with 6 different subsidiaries who run their own SAP ECC Backends which are geographically located in different parts of the country.
    The idea is to implement a central SAP Enterprise Portal for these different subsidiaries and we would like to know if anyone has done anything similar before. So the idea is that anyone from these 6 different geographically locations can log an incident on the central portal and the data will be then updated on their own divisional ECC Backend.
    Currently the SAP ECC Backends are based on ERP2005.
    The Company itself has an Central Active Directory solution in place and single sign on could be used for authentication. All the subsidiaries already use the central Active Directory for authentication.
    Could anyone please let us know whether they have done something similar or have any reasons why this cannot be done and some potential issues that could arise for implementing a solution like this.
    Some potential issues could be:
    System aliasing
    Network connectivity, bandwidth, availability issues
    Patch alignment etc…
    Would there be other issues that one would consider?
    Thank you kindly.

    Hi,
    I dont see any issues with such a landscape. You can have content for each of this location based of the systems they access.
    As u have said bandwidth, network issues and roles assignment would be concerns as they would be in a single ecc backend connected portal
    Regards
    Jayesh

  • Configurations needed for distributing central contract to backend system

    Dear Gurus,
    I have configured central contract and getting approved in the local SRM system. Now, I need to distribute the central contract to the backend system. I have already get the PI interfaces configured using the integration scenario Central contract management.
    Now, I assign the backend POrg as well as the target values for the backend contract and try to release the central contract. The central contract is getting released. However, no contract is getting created in the backend system.
    I donot see any XML messages generated in the SRM system (SXMB_MONI).
    Do I need to maintain some settings in the SRM system to enable the distribution of contract to the backend system?
    Thansk and regards,
    Ranjan

    Hi,
    When one creates Local Contract; there is one option named 'Distribute' on contract screen.On drop down; one mention back end system. After clicking on it; contract has been created in ECC.
    If contract is not getting generated in back end; refer SAP Note: 609222.
    Check whether you find any error/information message in Txn BBP_CTR_MON.
    SRM Settings:
    1. Implement BBP_DETERMINE_LOGSYS: Determines whether contract is to be created in SRM or ECC.
    2. Assign transaction type to attribute CT_PROC_TY in Org Structure.
    3. Check whether have maintained message type BLAREL, COND_A, BLAORD.
    4. Assign role SAP_BBP_STAL_START_PURCHASER to process contracts.
    Helpful SAP Notes: 641919, 646903
    Regards,
    yaniVy
    reward if helps

  • Workprotect feature for R/3 or SEM backend systems

    Hi All,
    I think the workprotect mode within the portal can be used only for CRM backend systems...
    We have R/3 transaction iViews and SEM transaction iViews written in BSP's and want to implement workprotect feature for all these transaction iViews...
    I would appreciate if anyone of you can post the sample piece of code to implement this feature.
    Thank you
    Som

    Hi,
    Workprotect mode is a feature of the portal framework which can be used via javascript API by the applications which are running in the portal. This javascript API is the EPCM file.
    If you want to use the workprotect mode of the portal you have to define a variable in your javascript which will hold the status of the dirtyFlag.
    var dirtyFlag = false;
    Take care that the variable will not be disappear with the next roundtrip.
    Now tell the portal that you will take part of the workprotect mode by subscribing to a special event of the portal.
    epcm.subscribeEventReliable("urn:com.sapportals.portal:workprotect","inquiryProtection",window,"my_protectionHandler");
    Now define a javascript function:
    function my_protectionHandler( event ){
        return dirtyFlag;
    What will happen:
    You have subscribed to an portal event which will be thrown when the user will navigate. In order that the portal knows which javascript function it must call to the your dirtyFlag you tell him the name of your function, ie. my_protectionHandler.
    The only thing is now that you have to set the dirtyFlag depending on your business.
    This is the workprotect function for portals since 6.0.
    Hope this brief explanation will helps. 
    with best regards
    Aiga

  • New transactions for BW in SAP ECC source system

    Hi experts,
    I need to know if in SAP ECC 6.0 there is someones transactions news or changed for datasources manages.
    For example:
    For create/Modify generic datasource
    Activate LIS* datasources
    rsa5 Functionality because the hierarchy has differents name; before the hierarchy began with SAP hierarchy, now is Not connected... 
    Any information about with ECC 6.0 and integration with BI 7: transactions list and migration I will receive very good.
    Thank you very much.
    Regards,
    Jeysi Ascanio

    Basically, the same transactions are used.  I don´t see a different treatment until now.

  • Limit PO price changes are not replicated to ECC backend

    Hi all,
    SRM 5.0 ECS SP13.
    When I change the value(increase/decrease) in limt PO which is already created(PO is changed for first time) and order the PO,under Overview screen.,the PO total value(at header level) shows the correct changed /new value while at the Item level,the Net price is shown as the old value!However when I go and check the item details,the  field "VALUE" and "EXPECTED VALUE" have the changed/new value.
    Because of the above issue,the PO changes are not replicated to ECC backend system.When I tested the BAPI BAPI_PO_CHANGE1 with the test data,there is no error mesasge in ECC backend system.
    After this,when I change the PO for second time(again value increase/descrease),the total value and net price is shown correctly in SRM and changes are also replicated to ECC backend system!
    I have also checked the cong for SPOOLPARAMETERS under Set Control Parameters and eveything is set correctly as shown below
    SPOOL_JOB_USER     User that execueds spool job.     CUA_ADMIN
    SPOOL_LEAD_INTERVAL     intervall by which the retrytime incr.     60
    SPOOL_MAX_RETRY     Max. number of retrys for writing BAPIS     10
    Can someone throw some pointers how to resolve the above issue.
    Thanks in advance.

    Hi
    can you recreate the same issue
    are you saying that
    1. create a limit po for 100 USD and replicated to ECC AS 100 USD total value.
    2 . now update the PO in SRM 150 USD and it was not replicated to ECC ?
    or
    1. limit sc
    2. Limit PO
    3. update not reached ECC.
    Note 1284361 - Limits not transferred to backend purchase order
    Symptom
    Extended classic scenario.
    You have ordered a purchase order with more than one hierarchy item containing a limit.The purchase order is created or updated in the backend system without errors but the limits are missing in the backend purchase order.

  • Item Cat B line item converting to an Item cat D in  ECC Backend PO why?

    Iam working on an SRM 5.0 system deployed in extended Classic scenario, connecting to an ECC backend system
    Am creating a Limits shopping cart line item and select the "Invoice only" option. When the PO line item is transferred to the ECC back-end the item category is showing D.
    Why is this happening and how can I get the backend PO "Invoice only" line item to correctly show as an item category B?
    Thanks

    Hi,
    Also please read the following threads :
    https://forums.sdn.sap.com/click.jspa?searchID=4094247&messageID=2863658
    https://forums.sdn.sap.com/click.jspa?searchID=4094247&messageID=2903873
    https://forums.sdn.sap.com/click.jspa?searchID=4094247&messageID=2806423
    Kind regards,
    Yann

  • Are one time vendors supported in SRM ( replicated from ECC backend to SRM)

    Dear All,
    I have noticed in various past posts that one-time vendors are not supported in SRM.
    Is this still the case fo SRM 5.0 and ECC 6 backend set?
    Why is it that one time vendors cannot be replicated to SRM?
    If we create a one time venor manually in SRM, can we use this vendor in shopping carts/POs?
    Thanks

    Hi
    As far as I know, Yes correct.. one time vendors are not supported in SRM.
    It's functionality of R/3 and ECC Backend systems only.
    Contract vendors / Purchase Info-records related vendors are still supported in SRM.
    Hope this will help.
    Regards
    - Atul

  • Different approvers for 2 roles of the same name in 2 different systems

    Hi experts,
    in our SAP landscape we have roles of the same name in different systems. I couldn't find any possibility to select different approvers for these two roles in GRC 5.3 SP08.
    For example role XYZ exists in system P1 and P2. In P1 I want to select only person A as role approver, in system P2 only person B.
    Is there any chance to select an approver for a combination role and system?
    Thanks,
    Manuel

    Hi Manuel,
    Yes. You can create a custom approver determinator. Go to CUP>>Configuration>>Workflow>>Custom approver determinators. Chose create new.
    CAD type: Attribute
    Workflow type: Access Enforcer
    Select your attributes and save.
    Go back. Select your new approver determinator in change mode.
    Click on the Approve button.
    Create logic between the attributes and approvers.
    Modify your role approval stage. Select your new custom approver determinator.
    Regards,
    Vit

  • Triggering file sender process from backend system

    Hi,
    We have implemented a file transfer using SAP PI to move a file from one of our business partner's FTP server to our SAP ECC backend system.
    The integration scenario is file sender (using the SFTP protocol) to proxy receiver with an asynchronous service interface.
    The file contains payment information which we wish to pull into our SAP ECC system once daily.
    The scenario is currently working using the Runtime Workbench Availability Time Planning option which is set to activate the file sender communication channel accordingly.
    To aid testing and to permit adhoc processing of the interface (let's say if there are additional payment runs required after the scheduled run) we'd like to be able to trigger the interface at the user side from the SAP ECC system.
    As they don't have access to SAP PI the most appropriate solution would seem to be an ABAP program in SAP ECC that calls an outbound proxy that could link to the file sender mentioned above.
    What options are there for creating this integration - can we implement BPM or is there an alternative?
    As I've no experience of this type of scenario any blogs or example configuration would be useful.
    Thanks,
    Malcolm

    You can control the CCs externally.
    http://help.sap.com/saphelp_nwpi711/helpdata/en/45/0c86aab4d14dece10000000a11466f/frameset.htm
    The users will need the two roles mentioned there. You can just create 2 links (one for start, one for stop) and add as favorites in the user's browser. Or if you have portal you could encapsulate this so the links are transparent to the user (also, the roles would be added just to the technical user, not the end user, and the user mapping would be handled in portal layer).
    BR,
    Henrique.

  • Facilitate distribution of config data in the backend system

    Hi
    We are in the process of upgrading our backend systems to version 7.02. During test with PI we find that we now have to provide Logon Data towards the backend systems for our Business System comm. component in PI.
    Saphelp [http://help.sap.com/saphelp_nwpi711/helpdata/en/48/cfd1d49bf23e49e10000000a421937/content.htm] says: Use a service user with composite role SAP_XI_ID_SERV_USER_MAIN.
    Problem is that our role-team does not find this particular role in the backend system.
    What is the experience with this? Is it possible to use another user (e.g. system user)? Is it mandatory to provide "Configuration URL" in the SLD for this?
    Thank you
    regards Ole

    We need a separate web server and database server. All the content must be in the database. It looks like RoboHelp Server might not be the right architecture.
    Web Server > XSLT
                                            > Client Web Page XSLT/XML
    Database Server > XML
    ~J

  • Hide backend system from internet

    Hi Experts,
    i've got a question and would be really satisfied to get an clear answer...
    Is it really possible to hide my ECC backend systems (host, domain, port and servicepath!)  complete using an webdispatcher or reverse proxy? We have the task to publish an webdynpro abap ICM service to the internet and want to mask the backend systems.
    From my state of knowledge the portal itself isn't able to cover the backend request by its own. Always the client gets the url of the ICM service back. Even if we would use an WD or an Apache reverse proxy, the service name is visible on the internet.
    Is this right or is there an another possibility?
    regards,
    thomas

    Thomas,
    I guess your understanding is true. When we use a WD or Apache RP, the initial URL for the client/users can be custom made but ultimately, to go fetch the application the
    (*host, domain, port and servicepath!*)
    is necessary.
    Regards,
    Sandeep Tudumu

  • Install GRC AC 5.3 RTAl in a backend system. (VIRSA) up on VIRSA 400_700

    Hi Supports,
    I want to install GRC AC 5.3 RTAl in a backend system. (VIRSA)
    Where we have below setups already. We have a NW 2004 server with GRC 5.3 Installed and SLD is configured. Now we need to install GRC AC 5.3  RTA in Backend systems, so that we connect the backend system with the GRC server (NW 2004).
    The backend system has ECC6.0 + Oralce 10g in AIX 5.3. This system is upgraded from 4.6c to ECC 6.0 recently.
    We have already VIRSA 400_700 release in this system. Now we need to install GRC AC 5.3 RTA upon this for configure newer version of VIRSA (GRC).
    Now here my quaries ??
    1) When we install GRC 5.3 RTA in this system then it over write the existing VIRSA 400_700 release or installed in separate ??
    2) We plan to take hole system backup before the installation. Including this we need to take backup of the existing VIRSA 400_700 release. Then what are the things i need to take backup and how ??  (tables of VIRSA backup only how ??)
    3)Any one have the RTA installation procedure please forward it ??
    4) After installation how can i sure that install is success or not ?? how can i check ??
    5) What are configuration settings for NW 2004 server and Backend system after installation require(Procedure) ??
    And i request to the guys to post the procedures/process is best way to share knowledge global.
    Advance thanks for your replies,
    Thanks & Regards,
    Jagadish

    Hi
    > 1) When we install GRC 5.3 RTA in this system then it over write the existing VIRSA 400_700 release or installed in separate ??
    > 2) We plan to take hole system backup before the installation. Including this we need to take backup of the existing VIRSA 400_700 release. Then what are the things i need to take backup and how ??  (tables of VIRSA backup only how ??)
    > 3)Any one have the RTA installation procedure please forward it ??
    > 4) After installation how can i sure that install is success or not ?? how can i check ??
    > 5) What are configuration settings for NW 2004 server and Backend system after installation require(Procedure) ??
    For GRC 5.3 check below SAP note
    1250521 GRC/Virsa Add-On Upgrade Best Practice
    SAP Note 1006083 - Virsa Access Control Suite- STMS to SAINT Migration
    Also check GRC upgrade guide.
    Thanks
    Sunny

  • Unable to distribute the MODEL to backend system in SRM 5.0

    Hello Experts,
    I have created distribution model " SRM_to_R3" in BD64, maintained message types BBPCO, BBPIV and MBGMCR
    Every time I try to Distribute this MODEL to back end system I get the following error in IDES system
    Target system T90CLNT090       Commnunication error occurred, error when opening an RFC connection
    RFC connections are
    T90CLNT090   - SRM to R3
    SRM_00_800   - R3 to SRM
    Systems got connected successfully and I can "Remote Logon" too......
    My query is why am not able to send or distribute the MODEL from SRM to ECC backend system ?
    How to get rid of the error and successfully distribute MODEL to backend system.........appreciate your help in this regard
    Rgds !
    SAP Novice

    Hi Zuljana,
    Kindly check if your partner profile is active. (Indicated by 'A')
    Sometimes if your partner profile is not active, you wont be able to distribute your model. Check the 'A' indicator
    Regards,
    Nikhil
    Edited by: Pbponikhil on Dec 21, 2010 4:11 PM

  • RAR: Best strategy for users/roles/profiles synchronization

    Hi all,
    Assuming that:
    1) we will be never interested about profiles risk analysis (just users and roles)
    2) roles risk analysis will be run first and after sometime (threee weeks) we will run it for users.
    and we will run batch risks analysis:
    Question 1) Is it possible to synchronize just roles and do it for users just when we want to execute risk analysis for them? Or is a best practice to synchronize always for users/roles and profiles eventhough risk analysis will not be done for all three?
    Question 2) If we execute just full sync and full risk analysis, users/roles or profiles deleted in backend between executions are also deleted from DB? or removal takes place only when executing incremental sync?
    Many thanks in advance. Best regards,
      Imanol

    Hi Imanol,
    Answer Q1: Yes, you can just select user and roles for the snych and risk analysis. Go to configuration-background jobs - shedule job. If you don't run risk analysis for profiles, you shouldn't sync and select them.
    Answer Q2: Both, the Full risk analysis will alwaly update your DB. I will recommend you, to do this job in some periodic times. The incremental sync job will as well update your DB, if anything changed in the backend system. Normally your are going to run your daily or weekly jobs with this selection.
    Thanks,
    Martin

Maybe you are looking for