Risk analysis after approval in CUP
Hi,
Can it be possible? CUP to do automatic risk analysis after the request is approved by the role approvers. If there are no risks, roles will get provisioned. If risks exist based on the risk ID to have the request forwarded to the risk owner where the mitigation control, monitor details are entered.
Please provide your inputs.
Thanks
R R
Not a good idea, generally.
What you can do is have the risk analysis performed automatically on request submission. The approvers would see the risks, but you can allow them to ignore them and have a detour on the last approval step.
This has a few quirks:
- if your last approval is a role approver, i.e. there may be a split approval to several people, the detour is tricky.
- if one of the approvers changes something in the request, the risk analysis is invalid.
I would also question the general idea - usually in case of risks, one of the approvers should also take action. If all they do is approve, get them out of the way.
Unfortunately there is no step that says "automatic risk analysis, no manual approval required". That's an enhancement I would also welcome.
Frank.
Similar Messages
-
Use of Risk Analysis Webservice without installing CUP
1)Can we use Risk Analysis (SAPGRC_AC_IDM_RISKANALYSIS) webservice without installing CUP.
2)This webservice requires request id , which we will not have untlil we create a request in CUP.Besides request id, it has user id and system id as input field.
Is there a way or any other web service available, which accepts some other fields like role (particularly), analsysis type,etc, and then return us analysis data.I have written a lengthy piece on why it is a good idea to use CUP here:
Re: Integrating inbuilt Access Management application with RAR
Frank. -
ERM & CUP: Risk Analysis Error
Hello everyone,
Will someone please urgently help us with this issue? Any suggestions are greatly appreciated! : )
We are on AC v5.3 SP 8. In RAR, we are able to run a Risk Analysis both in the foreground and background across all users and roles. However, when we try to run a Risk Analysis in ERM or CUP, we get an error saying that the "Risk Analysis Failed". The other strange thing is that the error does occur for every role in ERM--just most of them. Also, the ERM management dashboard reflects the correct number of roles in the SAP back-end system, but it says that there are 0 risk violations, which is incorrect.
I have checked that the connectors into RAR successfully connect. I have confirmed the servers. I have re-run all of the background jobs in RAR, ERM and CUP, but nothing seems to be working.
Is there anybody that can please help us?
Thank you!
JohonnaHello Amol,
Thank you for your suggestions. I have confirmed that the connectors, etc. are correct. Here are some of the error logs u2026 any ideas?
Thank you!
Johonna
95 12/15/09 12:20:51 PM Running Risk anaysis for role ZAU:FF_VFAT_ADMINISTRATOR failed
95 12/15/09 12:21:21 PM Running Risk anaysis for role ZAU:FF_VFAT_ROLE_ADMINISTRATOR failed
95 12/15/09 12:21:43 PM Running Risk anaysis for role ZAU:FF_VFAT_ROLE_CONTROLLER failed
95 12/15/09 12:23:13 PM Running Risk anaysis for role ZAU:FI_AA_CLERK_AGN failed
95 12/15/09 12:26:07 PM Running Risk anaysis for role ZAU:FI_AA_CLERK_GFA successful
2009-12-15 14:36:17,889 [Thread-7999] ERROR Risk Analysis failed
java.lang.Throwable: Risk Analysis failed at com.virsa.re.bo.impl.RiskAnalysisBO.performObjLvlRiskAnalysis(RiskAnalysisBO.java:733)
at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysis(RiskAnalysisBO.java:234)
at com.virsa.re.backgroundjobs.RiskAnalysis.execute(RiskAnalysis.java:73)
at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
at java.util.TimerThread.mainLoop(Timer.java:432)
at java.util.TimerThread.run(Timer.java:382)
2009-12-15 14:36:24,811 [Thread-7999] ERROR Risk Analysis failed for sytem: 'PRD'; Return Message: 'Risk Analysis failed'
2009-12-15 14:36:24,811 [Thread-7999] ERROR com.virsa.core.service.ServiceException: Risk Analysis failed
java.lang.Throwable: Risk Analysis failed
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getTranViolations(RiskAnalysisEJBDAO.java:331)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingTransactions(RiskAnalysisEJBDAO.java:171)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingTransactions(RiskAnalysisEJBDAO.java:205)
at com.virsa.re.bo.impl.RiskAnalysisBO.performTranLvlRiskAnalysis(RiskAnalysisBO.java:483)
at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysis(RiskAnalysisBO.java:229)
at com.virsa.re.backgroundjobs.RiskAnalysis.execute(RiskAnalysis.java:73)
at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
at java.util.TimerThread.mainLoop(Timer.java:432)
at java.util.TimerThread.run(Timer.java:382)
2009-12-15 14:36:34,561 [Thread-7999] ERROR Risk Analysis failed for sytem: 'PRD'; Return Message: 'Risk Analysis failed'
2009-12-15 14:36:34,561 [Thread-7999] ERROR com.virsa.core.service.ServiceException: Risk Analysis failed
java.lang.Throwable: Risk Analysis failed
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getObjViolations(RiskAnalysisEJBDAO.java:812)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingObjects(RiskAnalysisEJBDAO.java:596)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingObjects(RiskAnalysisEJBDAO.java:633)
at com.virsa.re.bo.impl.RiskAnalysisBO.performObjLvlRiskAnalysis(RiskAnalysisBO.java:693)
at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysis(RiskAnalysisBO.java:234)
at com.virsa.re.backgroundjobs.RiskAnalysis.execute(RiskAnalysis.java:73)
at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
at java.util.TimerThread.mainLoop(Timer.java:432)
at java.util.TimerThread.run(Timer.java:382)
2009-12-15 14:36:34,561 [Thread-7999] ERROR Risk Analysis failed
java.lang.Throwable: Risk Analysis failed
at com.virsa.re.bo.impl.RiskAnalysisBO.performObjLvlRiskAnalysis(RiskAnalysisBO.java:733)
at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysis(RiskAnalysisBO.java:234)
at com.virsa.re.backgroundjobs.RiskAnalysis.execute(RiskAnalysis.java:73)
at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
at java.util.TimerThread.mainLoop(Timer.java:432)
at java.util.TimerThread.run(Timer.java:382)
2009-12-15 14:36:42,218 [Thread-7999] ERROR Risk Analysis failed for sytem: 'PRD'; Return Message: 'Risk Analysis failed'
2009-12-15 14:36:42,218 [Thread-7999] ERROR com.virsa.core.service.ServiceException: Risk Analysis failed
java.lang.Throwable: Risk Analysis failed
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getTranViolations(RiskAnalysisEJBDAO.java:331)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingTransactions(RiskAnalysisEJBDAO.java:171)
at com.virsa.re.service.sap.dao.RiskAnalysisEJBDAO.getConflictingTransactions(RiskAnalysisEJBDAO.java:205)
at com.virsa.re.bo.impl.RiskAnalysisBO.performTranLvlRiskAnalysis(RiskAnalysisBO.java:483)
at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysis(RiskAnalysisBO.java:229)
at com.virsa.re.backgroundjobs.RiskAnalysis.execute(RiskAnalysis.java:73)
at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)
at java.util.TimerThread.mainLoop(Timer.java:432)
at java.util.TimerThread.run(Timer.java:382) -
Risk Analysis not performed when using IDM WS
Hi ,
We are using the SAP delivered IDM WebService for submitting Access requests to CUP 5.3 SP8 Patch1.
We have defined the properties:
1. Perform Risk Analysis on Request Submission - YES
2. Risk Analysis Mandatory (approval stage) - YES, When Access Changed
3. Approve Request Despite Risks - NO
(This setting will enable the approver to approve the access request without performing a Risk Analysis, if the initial risk analysis doesn't identify any risk with the access request. But if there are risks, the approver need to mitigate the same before he can approve it.)
But we have found out that when submitting a request through the SAP Delivered IDM WS -'SAPGRC_AC_IDM_SUBMITREQUEST', the system DOESN'T perform RA during request submission. But when the request is submitted directly in CUP, it does.
We've referred the Note:1168508 where it's mentioned that this issue is being fixed with SP7 Patch 1. But we are already on SP8.
The Note says:
"The following issues are resolved as part of Support Package 7 Patch 1:"
and the last bullet point states that:
"While submitting a CUP Request from web service, if the flag for Risk Analysis on submission is set not performing the Risk Analysis on submission."
This feature was not working before and hence thought SAP has fixed it as mentioned in the Note. Has anybody suceeeded in getting this feature working???
Thanks & Regards,
AnilYes Dries, we have tried both and we happen to see some exceptions on request submission thru WS.
But the request is still getting created. I've an open tkt with SAP to follow it up..I'll update once i get this fixed.
Exception Details:
Exception during EJB call, Ignoring and trying Webservice Call [EXCEPTION] com.virsa.ae.service.ServiceException: Exception in getting the results from the EJB service : com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/w...
Full Message Text
Exception during EJB call, Ignoring and trying Webservice Call
com.virsa.ae.service.ServiceException: Exception in getting the results from the EJB service : com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:294)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:418)....
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by: java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:304)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:276)
... 44 more
Thx,
Anil -
AC 5.3 RAR - combined risk analysis reports for regular auth. and SPM auth.
Dear All,
we have users that have regular day-today authorization and also FF authorization.
Does the Batch Risk Analysis takes into account both authorizations when doing the risk analysis for those users ? will we see it in the reports ?
Thanks
Yuditok, so basically the answer is no, in the RAR components we do not have risk analysis for the combinations of the roles assigned to the user and to his FF ID.
in that case, at what stage does the system checks for those combined risks ?
is it checked when we manage the risk analysis phase in the CUP request that is asking to assign the FF ID to the user ?
thanks
Yudit -
GRC AC 10.1 - Risk Analysis: No rules were selected
Hi All,
I'm currently configuring the ARA module in GRC AC 10.1, and an facing this issue. When I run my User Analysis, its throwing an error message "No rules were selected'.
As per your suggestions from discussions, i double checked all the below activities
Activate the BC sets
Run Sync Jobs
Run Batch Risk Analysis
After all this I found that the functions are not mapped to the logical groups(Back-end Systems) I have defined. Can you please let me know how to make sure you have correct back end system(logical Group) updated for the functions in the setup? Doesn't the configurations Connector/Connector Groups etc already mapped the functions to the back-end system? It would be a hell of work to do all the system mapping on function level manually.Hi Narsimha
You need to map your connectors to the logical systems that are used in the function definitions
Look at your integration framework Setup in the IMG.
Governance, Risk and Compliance > Common Component Settings > Integration Framework > Maintain Connectors and Connection Types
Also, for 10.1 there was an issue with logical systems. It may be that your configuration is correct: Re: GRC 10.0 SP14 - Poblems when generating rules for logical systems
Regards
Colleen -
GRC AC 10.0 Mass risk analysis vs. Role level analysis
Hello GRC experts,
I urgently need your advice on the issue with deactivated permission objects which are identified as risks in the mass role analysis.
For example, in one role we have deactivated the permission object: S_ARCHIVE, and there are No activities maintained.
But in the mass role risk analysis and in the CUP request this object S_ARCHIVE with the ACTVT 01 is displayed as risk. As you can see in the screenshot, there are no activites maintained at all. We have created the MSMP workflow where all CUP requests with risks should go the the Security Stage. Now we have the situation that even though our roles are clean, they are forwared to the Security stage. It is a huge problem, because our security stage has no even more to to, than before using GRC! Because the dectivated objects are identified as risks.
Please advise me, how to solve the problem. Did I missed some config parameters or is it a well known problem?
We are on SP14, AC 10.0.
At the single role level there are no risks displayed.
Thanks in advance,
regards
SabrinaHi Sabrina,
check note
http://service.sap.com/sap/support/notes/2036645
Please let me know if it works.
Regards,
Alessandro -
Access Enforcer Risk Analysis question
Hello All.
We are receiving an error message in an AE request. We are receiving the following error in Access Enforcer 'Mitigation control ZM030 could not be saved for user XXXX - Exception from the service: ERROR: This user is already mitigated for this risk' when doing the final approval on some requests.
Request #1 approved without error but when I did Request #2 received error message. I tried it again, same error, but the tick boxes are grey instead of green.
In all cases the roles were added to the user's account, but now AE request 1 and 2 cannot be removed from the listing.Ankur,
this can happen under different circumstances - say 1 of 3 systems to provision to is down. You will get an error message and the request is not closing, although provisioned to the other 2.
Jonathan,
for this request that is still open, can you remove the mitigation? And then re-run Risk Analysis and approve again.
From version 5.3 you cannot create multiple concurrent requests for the same user, this will prevent your exact error.
Regards
Daniela -
Risk Mitigation approval in CUP
Hi All
I am trying to mitigate a role for a specified risk. The workflow gets successfully trigerred from RAR and is shown to the approver in CUP. However when the approver tries to approve the request in CUP, system shows an error "Error Processing your request, Request no.__ in stage: CC_MITOBJ"
Can someone help me out in resolving this.
Thanks
NitinHi,
I am not getting the link to Mitigate the riks for the Roles requested from CUP. when I am trying to select the risk to mitigate after the Risk Analysis is done from RAR and the report is fetch to CUP no links are showing. It shows error on the screen "Correct the following errors: Select a risk."
The message "Error on page" shows in the bottom left corner of the browser. I can not go any further to mitigate the risk.
The soluition was put to import the AE_init_append_data.xml as instructed n the A 5.3 installation guide. This file contains lines for background color that ar enecessary for display of the Risk. each support package of 5.3 has this file and is delivered in the .SAR file, and this should always be updated if delivered.
I have tried this and still falling to Mitigate the risk as the problem remains. May I know if you have some other solution or if you can provide me with the correct and update file for above request.
Thanks,
Abhimanyu -
GRC 5.3: CUP asks to perform risk analysis even when there are no risks in request
Hi All,
We recently upgraded from GRC 5.3 SP13 to SP22.
The one issue which we are facing after upgrade is that now CUP is forcing approvers to do Risk Analysis, even when there are no risks in the CUP Request, that is Risk Tab is Green.
Previously approvers were able to approve requests without doing risk analysis, if there were no risks in the request.
CUP used to force them to do risk analysis only when there were risks associated with requests.
But now, it is forcing approvers to perform risk analysis, even if there are no risks, i.e. approvers are not able to approve requests without any risks without doing risk analysis.
Please advise.
Thanks
AditiHi,
Can you check if any change is made in Configuration -> Workflow -> Stage -> Approvers
Regards,
Claudio -
CUP : RISK ANALYSIS FAILED for Multi systems
Greetings,
Risk Analysis through CUP is failing on a request containing multi system access.
There are 2 systems requested on the same CUP request form. At the stage of Risk analysis is to be performed the risk analysis errors out as the risk analysis is performed on the entire request across both the systems, After the receiving the error when an individual system is selected the RA is performed with out any failure on both the systems independent of each other
I have check already check the below and they seem working fine without any issue
1. The admin passwords have been checked in both the systems (backend) as well as in the UME.
2. The risk analysis web service works as expected and there is no failure.
3. The connectors have the same name both in CUP & RAR no difference
4. SAPJCO connectors are appropriately setup in the SLD for both the systems and they work when tested out.
5. The URI is setup correct and no issue identified there.
6. Both the systems request have the same stage/path and the custom approver determination appropriately setup
When the approver tries to approve the request Risk analysis is setup as a mandatory task and when the RA is performed the system takes the default "ALL" and errors out, when you choose a specific system and perform you get the required results without any failure. Below is the java dump for the error.
Please let me know if I have missed anything?
Line: -
2011-03-09 10:16:11,264 [SAPEngine_Application_Thread[impl:3]_28] ERROR java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
2011-03-09 10:16:11,278 [SAPEngine_Application_Thread[impl:3]_28] ERROR Exception during EJB call, Ignoring and trying Webservice Call
com.virsa.ae.service.ServiceException: Exception in getting the results from the EJB service : com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:295)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
... 28 more
2011-03-09 10:19:32,401 [SAPEngine_Application_Thread[impl:3]_28] ERROR com.virsa.ae.core.BOException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
com.virsa.ae.core.BOException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:199)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
com.virsa.ae.service.ServiceException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.determineRisks(RiskAnalysisWS53DAO.java:587)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:119)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
... 24 more
Edited by: Angara Rao on Mar 9, 2011 5:15 PMGreetings,
Risk Analysis through CUP is failing on a request containing multi system access.
There are 2 systems requested on the same CUP request form. At the stage of Risk analysis is to be performed the risk analysis errors out as the risk analysis is performed on the entire request across both the systems, After the receiving the error when an individual system is selected the RA is performed with out any failure on both the systems independent of each other
I have check already check the below and they seem working fine without any issue
1. The admin passwords have been checked in both the systems (backend) as well as in the UME.
2. The risk analysis web service works as expected and there is no failure.
3. The connectors have the same name both in CUP & RAR no difference
4. SAPJCO connectors are appropriately setup in the SLD for both the systems and they work when tested out.
5. The URI is setup correct and no issue identified there.
6. Both the systems request have the same stage/path and the custom approver determination appropriately setup
When the approver tries to approve the request Risk analysis is setup as a mandatory task and when the RA is performed the system takes the default "ALL" and errors out, when you choose a specific system and perform you get the required results without any failure. Below is the java dump for the error.
Please let me know if I have missed anything?
Line: -
2011-03-09 10:16:11,264 [SAPEngine_Application_Thread[impl:3]_28] ERROR java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
2011-03-09 10:16:11,278 [SAPEngine_Application_Thread[impl:3]_28] ERROR Exception during EJB call, Ignoring and trying Webservice Call
com.virsa.ae.service.ServiceException: Exception in getting the results from the EJB service : com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:295)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:419)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.determineRisks(RiskAnalysisEJB53DAO.java:527)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:103)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
java.lang.VerifyError: com/virsa/cc/xsys/ejb/RiskAnalysis.execRiskAnalysis(Lcom/virsa/cc/xsys/webservices/dto/WSRAInputParamDTO;)Lcom/virsa/cc/xsys/webservices/dto/RAResultDTO;
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.execRiskAnalysis(RiskAnalysisEJB53DAO.java:305)
at com.virsa.ae.service.sap.RiskAnalysisEJB53DAO.getViolations(RiskAnalysisEJB53DAO.java:277)
... 28 more
2011-03-09 10:19:32,401 [SAPEngine_Application_Thread[impl:3]_28] ERROR com.virsa.ae.core.BOException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
com.virsa.ae.core.BOException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:199)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1108)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:335)
at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:112)
at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:219)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
com.virsa.ae.service.ServiceException: EXCEPTION_FROM_THE_SERVICERisk Analysis failed
at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.determineRisks(RiskAnalysisWS53DAO.java:587)
at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:119)
at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)
... 24 more
Edited by: Angara Rao on Mar 9, 2011 5:15 PM -
Risk Analysis in CUP not working
Hello Experts, we are using GRC 5.3. In CUP, I am trying to approve Role Provisioning. One of the requirements is to run Risk Analsys (as it says 'Risk Analysis is Mandatory'). When I hit the 'Risk Analysis' button, the circle keep circling but, nothing seems to happen forever (no error message either). Can you guide me in the right direction? What could be the possible situation? And, where am I better off to start troubleshooting.
Thank you.Well, the problem seems to be that I am connecting from VPN. From my analysis, after I reboot the laptop, I am able to analyze risk for the first 3 or 4 requests and after that I can't do risk analysis for any more requests until I reboot my laptop. If I login to a remote server (say Virsa server), I seem to have no problem at all. i am able to continuoiusly run risk analysis for multiple requests. The problem seems to be VPN or my laptop.
-
CUP 5.3: risk analysis in workflow impossible due to web service performance?
Hello experts,
We are facing a huge challenge within a AC 5.3 implementation.
Here, AC has been used successfully with CUP and RAR for quite some time now. However, the RAR analysis has not yet been integrated into the CUP workflow. We would like to integrate the RAR analyis in CUP now.
Based on the existing role concept (that uses functional master roles and derived roles per company code, with ca. 30 company codes in place) and the shared service operations in some areas such as FI, there is a large number of users with many roles and consequently, many SoD risks (of course, they are all "repeat" risk per company code).
This leads to a long RAR analysis run time, but it's still acceptable. Analysis on permission level for such "power users" runs about 1 minute, on action level about 5-6 seconds.
However, the web service between RAR und CUP is a problem and cannot cope with our violations. We have currently set the threshold to 75000. In this case, the analysis + web service runs 1-2 minutes. However, we have some users with 200-300.000 violations. In this case, if we deactivate the threshold, we will experience a web service time-out eventually, even with analysis on action level because the amount of violations the web service has to process is the same (or even higher with some false positives).
We also have compensating controls in place for these power users, which will of course reduce the web service run-time considerably. However, this is not applicable to NEW user requests because for those, the compensating controls will be assigned only AFTER the risk analysis has taken place and the risk manager receives the workflow item.
Has anyone experienced this in the past and found a viable solution or work-around? We are basically short of options and considering dropping the project.
Note: An upgrade to 10.X is not (currently) a solution because this upgrade is scheduled and budgeted only for later.
Thanks a lot and best regards
PatrickAny opinions on this?
Cheers and thanks
Patrick -
SAP GRC AC 5.3 CUP Risk Analysis issue
Hi all,
I have assigned a new SoD Role to a user, who has been given previously other SoD Roles that were authorized to assingn, then I launched the Risk Analysis and it shows the risk between the previously SoD Roles, but I want to see the new posible risks between the new SoD Role and the others.
Is there any parameter into CUP to set up that controls the issue ? How must I do?
Thanks in advance.
Regards.Hi Chinmaya,
Firstly, thanks for your help and support.
According to the post, I mean when the user manager or approver, receives the request to assign one role to a user, the approver has to decide the needs of the user to use that role.
Then the approver can check (clicking on Risk Analysis button) the number of concflicts or criticals risk that the user could violate. The issue is when the approver launched the anaylisis and it shows same conflict risks that have been mitigated in the previously assignment. It may show the possible risks between the new role and the others, isn´t it?, or instead of the case ,that the oldest risks are showed. Must that risks showed as mitigated?
Thanks, regards. -
Did CUP risk analysis change with SP7?
Dear GRC experts,
I am pretty sure when we tested CUP 5.3 SP4 when doing risk analysis it would only show new risks caused by new roles selected in request (like Risks from Simulation Only YES in RAR). Exisitng risks for that user would not be shown.
Now with CUP 5.3 SP7 fix1 we get the existing risks shown as well not in any way related to the role(s) selected, which will be confusing to the role approvers. E.g. role request is display role, approver needs to run risk analysis and gets existing risks shown. He/she can not deselect roles to remove risks as only display role is in request. There might be no mitigating controls for those risks (creation of new mitigating controls is blocked). This would end up in requests with risks even though the requested role is not risk relevant, or even request gets stuck because no mitigatign control exists and config is set to do not allow approval of requests with risks.
Please confirm if indeed only new risks where shown in CUP risk analysis in previous support pack levels or rel. 5.2, or that I am mistaken and all risks where always shown at risk analysis in CUP.
Principally I think existing risks should be focus of GET CLEAN effort. Risk analysis in CUP should focus on preventing new risks at part of STAY CLEAN phase.Hi,
When we run Risk Analysis for the user, it will show the existing violations as well as the violation which are there with new roles also.
When we click on Risk Analysis under Simulation tab we can find Risk Violation details.
Here I have a doubt, how to deselect violation role while approving request. I m unable to find that option. Please advice.
Thanks & regards,
KKRao.
Edited by: KKRao_2020 on Oct 9, 2009 9:22 AM
Edited by: KKRao_2020 on Oct 9, 2009 9:27 AM
Maybe you are looking for
-
Won't boot up with external hard drive attached
Pavillion HPE h8-1360t, AMI 7.15 Bios, Windows 7 Home Premium x64 bit, consistently fails to boot with external USB hard drive attached (WD 500GB MyBook) attached. Have tried disabling the device in BIOS, htting f10 to apply the change and then sele
-
Same Apple ID for two different country accounts?
Is it possible to use just one Apple ID for two different iTunes accounts? I've recently located to Australia from the uk and want to run an iTunes Store account in each but with just one apple id and email address. Can it be done?
-
Need suggestion on making career decision
Dear Friends, Problem Background : Want to make the most of my previous SAP Technical Experience and work in a marketing role. Experience/Qualification: Bachelor of Technology (Computer Science) 4.5 years of experience in SAP ABAP HCM MBA in Marketi
-
Writing XML without doing text processing
Hello, In all examples I have when XML is written to a file the formatting is done my hand; That is, you have something like: System.out.print("<Tag attr= " + val + "/>"); In .NET, on the other hand, you can just save a DOM XML Document with one line
-
To add new Line Items in Accounting Document using BTE
Hi, We have a requirement to add new GL line items while doing PGI through VL02N. The requirement is as below. Please confirm, if we can use BTE 1120 for this and if yes, how to use it to add new line items. Orig line items: Item PK Acct No USD 001 9