Role creation other than PFCG??

Hi SAPians,
Can we create roles manually on R/3 4.7EE!!!? Not from PFCG. any other way??
If yes what is the way? If no why?
Thanks.
Useful answers will be given points.

HI,
>Can we create roles manually on R/3 4.7EE!!!? Not from PFCG. any other way??
>If yes what is the way?
You could trace PFCG and make all table entries which normally made by PFCG.
Why would you do that?
Regards
Bernd

Similar Messages

Printing different role name other than role property name

Hi,
we have one program it gives all the roles,workset,iviews according to the PCD names and locations.
Now for few roles localization property is there ,so due to this the name user see on the tab and the name we mentioned in the role property is differnt.
our program printing the role name what we given in the role property.
but i need the name what user seeing.
now i don't want to change my role property . but i need to print the role name what user will see.
let me know how i can achieve this.
Thanks
Surya

Is it a customer app? If so, the program needs to use the appropriate method that reads the language specific role name. Ask your programmer to use the correct method...

Creation of role using T-code PFCG in R/3

Hi Experts,
I have created a Role using PFCG inorder to give acess only to three T-codes(PZ09. PZ80,PZ88).
so i have created a role intially using PFCG and incorporated PZ09 tcode in it and assigend the Role to users in R/3. it is displaying the TCode(PZ09) in Portal.
Now again i have added PZ80 & PZ88 to the same Role in R/3, but now i am getting an error:
Infotype 0000 does not exist.
but whereas when i assign SAP_ALL they(PZ88 & PZ 80) are working fine.
Is they anything i can do so that i can avoid assigning SAP_ALL Profile to the users and eliminate the Error "Infotype 0000 does not exist.
Thanks Inadvance,
Regards,
Siva

Hi,
Thanks for your reply,
Creation of role using T-code PFCG in R/3
The above link has solved my issue, Thank you!
Regards,
Siva

Program for PFCG Role Creation

Hi Guys,
I have a requirement for creating a program that will automate the Role Creation (Transaction PFCG)
I have the following Questions.
Is it Really possible via Program.
The expectation is in selection screen user will give the Standard and Derived Role after execution he expect the role to be created.
If anybody have experience in the same scenario kindly share me.
Regards,
Vijay.

Try with PFCG_START_PFCG
G. Lakshmipathi

Role creation: SAP ALL with SU01 and PFCG in display only

hi all,
I am looking for the easiest way to create a "sap all " like role with SU01 and PFCG in display only.
i found several solutions, which sound very complicated.
Thank you in advance,
Julien

Hi,
As per your query there is not profile of SAP to give display authorisation, for this you have to create new profile on module wise and assign to user.
Anil

Role Creation in CUP 5.3

Hello,
I'm trying to understand the concept of what is called "role creation" in Compliant User Provisioning.
My understanding is that the "create role" option in CUP (configuration>Roles>Create Role) means simply adding the "attributes" such as a business process, functional area, system, or company, to the SAP roles that you imported into CUP.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
Please tell me if I'm wrong.
HM

HM,
The create role option in CUP is mainly for legacy/non-cup supported systems. This way you can follow the standard workflow process for LDAP/Windows/legacy system. In this user provisioning and role assignment will not be done through CUP and will be manual. This is very important for some companies as they want user to go through same process if they want to get access to any system and not only ERP system.
The below statement is wrong.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
If you don't have ERM then you will have to use PFCG. Once you have CUP, you don't have to use SU01.
Regards,
Alpesh

How to raise role creation/modification request in AC 10

We are implementing AC10. I have issue more related to the process followed than technical. Please suggest from your experience.
We found that we can raise the request for new user account, role assignment to user, etc in Acess Request(formerly CUP), but we cannot raise the request for role creation, role modification. This is directly done in Role management. My question is, how the security admin will recieve the requests for creating or maintaining the roles. Is it necessary to use ticketing tool for users to raise the request for role creation and modification.
Thanks everyone for your valuable solutions.

Dear Ashish,
Whatever you have mentioned is correct to have the common platform for every request, either for user creation or role creation.
But what we decided earlier, that the end users can raise the request in CUP directly, rather than involving security admin. But after realizing that there is no request type for role creation, I think we have to use our ticketing tool as a common platform.
Request will come to security admin from the ticketing tool and than he will create the request in CUP, thereafter it will follow the approval workflow. Only problem I see in this, it goes to the manager twice, once in ticketing tool and than through CUP workflow. i think we need to take out the manager stage from the workflow.

GRC AC Request Role Creation

Hello all,
I noticed that by default GRC AC doesn´t have a Request Type for Role Creation. Normally how this is done? I mean, if someone realizes that a new role is necessary, how can this person report the need for a new role creation? What are my option here?
Regards,
SAP Legend

Hi SAP Legend,
You can not request a new role to be created via an Access Request workflow. You still need a business governance strategy where someone has to raise a request outside of the GRC system for the new roles through the right channels deemed fit in your company to get the new role made. Maybe you have a support ticketing system in place or some SAP security department you can raise the formal requests to.
The BRM Role creation/maintenance workflow runs separately from the Access Request workflow. Further more, the definition and creation process of roles via GRC should only involve and be used by Business Process Owners/Role Owners and the Authorisation security team only, i.e. not general end users.
A role build methodology will have to be set up and then the underlying approval workflows (based in MSMP technology also, like the AR workflow).
Once the role has been built (either via back end PFCG) or via GRC using the BRM methodology and approval flows, the role will be available to the end user to request via AR.
Hope that helps.

How do i use my fingerprint for uses other than login? (email, web forums, etc)

I was wondering, is there a way to use your fingerprint in place of a password for other uses other than logging into windows? Some uses would be internet email {specifically gmail), logging into web forums (like this one). Maybe (this is probably hopeful thinking) configure your fingerprint to includepersonal data when filling out forums such as address, DOB, phone number, etc. I will be using Firefox almost exclusively, but if theres a solution for IE i'll listen too.
T61 15.4" T9300 (2.5GHz 6MB L2) Windows 7 Professional x64 4GB Memory, NVidia Quadro NVS 140M

ThinkVantage Client Security Solution includes Password Manager which is close to what you are after I think. It works with IE, Firefox and standard application dialogs too.
I was previously employed by Lenovo but have no formal role on this forum.
I am here on my own time because I like fooling with PCs, especially Lenovo ones. ALL my posts are purely my personal opinion.

Provisoning users from OIM to OID having org other than xellerate users

Hi,
when i provision a user belonging to default Xellerate Users organization in OIM to OID, it is done.
what changes do i need to do if a want to provision a user in any other organization say 'MyCompany' to OID user
(it gives naming exception error when i try doing so)

let me explain what I am trying to acheive.
I create a user using flat file reconciliation such that the user is created in organization say 'XYZ'. Also I've created a group say XYZmember (membership rule is organization name=XYZ)
I created an access policy such that whenever a user who is a member of XYZmember group(means organization name is XYZ)is created in OIM the user gets provisioned to OID and will be assigned an OID role say role1.
Now when i create a user with XYZ as organization,he becomes a member of XYZmember group.... according to access policy he should be provisioned to OID user and assigned role1
But it gives naming exception error.
i want to know if i create a user in some org other than xellerate users will it get provisioned to OID? and HOW?

Is there any other way to achieve per user call forward restriction other than to create multiple voice policies?

Hello,
We mentioned the environment details below:
Environment
In our PBX environment, currently a user can forward calls to any local (within a region) internal extension. But for external PSTN call forwarding, a user needs to send a request and be approved by their manager. And the forwarding restriction
is applied such that user is only allowed to forward to that particular PSTN number - to prevent toll fraud.
Moving forward to Lync, using voice policy's call forwarding and simultaneous ring PSTN usages, I can set it to allow forward and simultaneous ring to custom PSTN usage and a custom route that will only send calls to these pre-approved
external numbers.
Outcome
But in such a scenario,
sSince all the custom external allowed numbers will have to be put into a single Route match table, User A will be able to successfully
set up call forward to User B's number. (if they come to know about it somehow, that is)
rü
Route matching list will be very long due to the number of users per hubsite that has call forwarding enabled.
Questions
Is there any other way to achieve per user call forward restriction other than to create multiple voice policies ? MSPL may be ?
2. Is there a limit in the number of entries you can have on the Route pattern matching regex expression ?
Please advise. MANY THANKS.

1) I think multiple policies may be your best bet, though it's not a fun one to manage, I agree. MSPL could do it, but it would be more complex to maintain in the end. Even gateways have limitations on routes.
2) I'm not aware of a limit, though I'm not saying there's isn't one. But if you hit it, you could move to a second usage/route combo.
I'd suggest building out some PowerShell usage/route creation/organization script for this so it's not something that would need to be maintained within the GUI.
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
SWC Unified Communications
This forum post is based upon my personal experience and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Request Number is not generated for BRM "new" role creation

Hello Gurus,
I have configured BRM in SAP GRC AC 10, along with the workflow .
I have selected the following methodology
Define Role --> Maintain Auth >Analyze & Access Risk>Request Approval>Generate Roles>Maintain Test Cases
Role name : Y_TEST_BRM_FUNCTIONALITY
So i do the following steps and assign
1) Role approver as Mr. ABC & Alternate approver as Mr. QRS
2) Assign the Required transactions and do the RAR i.e i am done till step 3 of methodology
When i click "Initiate Approval request"
The approval triggers , and goes to the 1st stage as configured in MSMP
1) Power User Approval .
Here the Power User : EFG , open his workflow and see the request as
Role approval required for role Y_TEST_BRM_FUNCTIONALITY
The approver approves the request and then the request all together vanishes.
Unfortunately i am not able to search the request for that role from NWBC -->Search request by
Process Id : Role Approver Workflow
It gives blank !!
Hence neither i am able to find the request no able to do any debugging of it using
GRFNMW_DBGMONITOR_WD
Please note that the Request Id is created for any request in CUP.
Is it that i have to create a number range for BRM request ??
If so will you please let me know the object

Hello All,
I was wrong in posting the cause of problem.
Please note no "Request number" is generated for Role creation Request.
The problem was i was unable to search the Role Request approval status from "Search Request" via Process Id
It got resolved via SAP note 1643539 : UAM: Search Request not returning result for some Process Id.
My Issues is Resolved.
Thank You.
Regards,
Victor

BRM-No Role Creation

Hi gurus,
I have just upgraded my GRC 10.0 to SP18 and when I access to create a new role in the NWBC, the button is in grey, I mean, I can not start the creation of it. However, I can modify the roles without problems.
Any idea of what can be happening?
Thanks,
Regards,

Hello All,
I was wrong in posting the cause of problem.
Please note no "Request number" is generated for Role creation Request.
The problem was i was unable to search the Role Request approval status from "Search Request" via Process Id
It got resolved via SAP note 1643539 : UAM: Search Request not returning result for some Process Id.
My Issues is Resolved.
Thank You.
Regards,
Victor

How to see the Table Names & Field Names by other than F1 help

Hi Experts
   How to see the Table Names & Field Names by other than F1 help, & How to see the List of MM Table Names.
Rgds

The only option to see the active table/ field name is through F1 --> Technical Information. Apart from this, you can use any 3rd part application like GUIex (INbuilt in SAP ECC 6.0 ... can be activated by clicking on the tri-color button on the top right), but you need technical knowledge to understand the information. As far consolidated list of MM tables is concerned, SAP don;t provide you the same at one place, it experience and knowledge which help you in this regard. For your immediate reference MM tables are as under :
EBAN - Purchase Requisition
EBKN - Purchase Requisition Account Assignment
EBUB   - Index for Stock Transport Requisitions for Materi
EINA    - Purchasing Info Record: General Data
EINE     - Purchasing Info Record: Purchasing Organization D
EIPA     - Order Price History: Info Record
EKAB   - Release Documentation
EKAN   - Vendor Address: Purchasing Document
EKBE    - History per Purchasing Document
EKBEH - Removed PO History Records
EKBZ    - History per Purchasing Document: Delivery Costs
EKBZH - History per Purchasing Document: Delivery Costs
EKEH    - Scheduling Agreement Release Documentation
EKEK    - Header Data for Scheduling Agreement Releases
EKES     - Vendor Confirmations
EKET     - Scheduling Agreement Schedule Lines
EKETH   - Scheduling Agreement Schedules: History Tables
EKKI      - Purchasing Condition Index
EKKN    - Account Assignment in Purchasing Document
EKKO    - Purchasing Document Header
EKPA     - Partner Roles in Purchasing
EKPB     - "Material Provided" Item in Purchasing Document
EKPO    - Purchasing Document Item
EKPV    - Shipping-Specific Data on Stock Tfr. for Purch. D
EKRS    - ERS Procedure: Goods (Merchandise) Movements to b
EKUB    - Index for Stock Transport Orders for Material
EORD    - Purchasing Source List
EQUK    - Quota File: Header

Idm-Vaau Rbac role creations and mapping

Hi All,
I'm working on the integration between Idm and Vaau's Rbacx (role based access control) tool for role creation and provisioning...I've imported the spml.xml and SPMLGetObjectsform.xml into Idm for the SPML calls between Rbacx and Idm.
The challenge I'm facing is mapping the attributes of Rbacx roles to enable the attributes to be populated in Idm...I'm able to export roles into Idm, but they are not populating with any attributes eg. resource type, resource attribute etc. I'm uncertain as to where I have to map these properties and do any customization for this to work. I would appreciate if anyone who has worked on this or know how to do this, to pls give me some pointers/share your experience. I don't have any documentation to refer to and am doing everything on trial and error basis.
Any help is greatly appreciated!
Thank you.

Hi newbie,
Were you able to solve this issue? I am facing the same problem while assigning resource attributes for a created role using a custom workflow.
This is where I set the resource attributes in my workflow:
<Action id='1'>
<expression>
     <block trace='true'>
     <set><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].valueType</s><ref>ADGroupsValueType</ref></set>
     <set><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].requirement</s><ref>ADGroupsRequirement</ref></set>
     <append><ref>role</ref><s>assignedResources[AD].attributes[AD Groups].value</s><ref>ADGroupsValue</ref></append>
     </block>
</expression>
</Action>
where <ref>ADGroupsValue</ref> contains the attribute value.
thanks,
Lokesh

Role creation other than PFCG??

Similar Messages

Maybe you are looking for