Role deletion in CUP

Hi Experts,
Please help us out.
We had some test roles created in ERM, imported to CUP and tested by User Assignment. Now we want to clean the roles before role upload. We have deleted all roles in ERM but in CUP it is giving error-
" Cannot delete since referred by request."
We have archived all kind of requests but we are still getting the error. Please suggest.
Thanks & Regards,
Sabita

Hi All,
I found the option to enable/disable the role or to set the Role validity date . It's available as tick mark icon along with the + and - icons on the System tab when the role is selected for change. I just missed this button as i expected this property of the role either in the information section or in some of the tabs :(.Anyways, happy to find it now
Cheers,
Anil

Similar Messages

  • Mass role deletion in CUP 5.3

    Hi all,
    in our CUP 5.3 system someone has unintendedly imported all roles and profiles from the backend system (about 4000 roles).
    How can we delete those roles from CUP without having to delete it from the frontend, which will take ages.
    Is there any way or database script to safely remove the roles?
    They can be determined by either role approver or last reaffirm date.
    Thanks
    Daniela

    That's why I tell my customers
    "Whatever you want to do in Role Import - ALWAYS klick on "from file" first. No Exceptions. Never!"
    You're out of luck, there is no delete script. You can ask support for the DB ER document, but you'll have to do DB manipulations on your own risk, I'm afraid...
    Frank.

  • Deletion of mass roles from GRC CUP 5.3

    Dear All,
    I have requirement to delete 1000 roles from GRC CUP 5.3.
    I can see option to delete the roles individually under "search role" option but I am not able to find option to delete mass roles.
    Please advice.
    Regards
    Trinadh Bokka

    Hello Trinadh,
    It is not possible to delete all the roles at once through the User Interface. However, you can select a lot of roles at the same time by searching for a role pattern. For example, retrieve all roles starting with Z*:
    Hope it helps,
    Fernando

  • Role Import in CUP

    Hi
    There are two options of choosing the source system for role import in CUP
    1. Back end system
    2. ERM
    I am facing problems in importing roles in CUP from ERM. The system shows a successful import but the number of roles imported are Zero. However if I choose the Backend system as source system, the roles get imported in CUP.
    can someone help me with this issue. I want to import roles from ERM because roles imported from ERM will have all the role attributes like Business process, Sub business process, functional area etc which are not available if we import roles from backend.
    Regards,
    Nitin

    Hi Sahad,
       Did you look at CUP logs? Is ERM and CUP installed on same server? Have you configured Business process and sub process exactly same as in ERM?
    There are 2 ways to upload roles into CUP using spreadsheet:
    1) Cumbersome method, if you don't have roles maintained in Excel: You can get R/3 roles via SUIM or some other method and manipulate them to match the role import template of CUP
    2) Easy method : Import all the necessary roles into CUP via Backend. Once you have all the roles in CUP, go to 'Search Roles'. Click on 'Search' button without providing any search criteria. This will return all the roles available in CUP. Now, click on Export button. CUP will export all the roles into Excel spreadsheet in the format which CUP understands. Now, delete all the roles from CUP and play with the spreadsheet to manipulate other parameters like role approvers, systems, business process etc and upload that spreadsheet into CUP.
    Both these methods require some manual work.
    Regards,
    Alpesh

  • GRC AC 10.0: Info about rejected roles in the CUP Email

    Hello all,
    the GRC componetent CUP seems to be technically mature in comparison to Role Management component, but there is one thing where I am not sure, is it an error or did I miss some config parameters:
    When the CUP Request ist closed, the user gets an email (Template ID: GRAC_AR_CLOSE). Not all of the roles were approved, some of the roles were rejected. But the user gets an email where only the approved roles are listed:
    We would like to inform the user about the status of all roles in the CUP requests: which roles were approved and which roles were rejected. Is it possible to configure in MSMP Workflow?
    Right now we have the following setting:
    Thanks,
    regards Sabrina

    Hi Sabrina,
    To notify the requester for the roles which got rejected, you can try with Email notification template: GRAC_MSMP_ERM_REJECTED for the for the message class.
    You can create custom version of this template. For more understanding on how to customize the Email notification template, you can refer to: http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/605077fc-3577-2e10-e1a6-a743514d4eb3?QuickLink=index&…
    Hope this helps, Let us know if you face any issues.
    Regards,
    Ameet

  • Administrator Role Deleted in Portal???

    Hi all,
    Accidentally administrator role deleted in UME.When i login j2ee_admin i deleted administrator role in UME what i do Now  plz tell me. How i found administrator role ???.Because sap predefined administrator role to j2ee_admin So i am not able to working in portal in UME all button is disabled.
    Help me Plz
    Thanks & Regards
    Kumar
    Message was edited by:
            Kumar

    Hello,
    May be you cud try out this:
    First of all give the user (J2ee_Admin) SAP_J2EE_Admin group.
    Now login to the usera administration of J2EE using the User with SAP_J2EE_Admin group.
    Next go to useradministration and then give the user (Self) different admin roles
    such as super admin, system admin, content admin etc.
    Hope this helps you.
    Regards,

  • Administrator Role deleted ???

    Hi all,
    Accidentally administrator role deleted in UME.When i login j2ee_admin i deleted administrator role in ume what i do Now i am login via j2ee_admin it gives error what i do plz tell me. How i found administrator role ???
    Help me Plz
    Thanks
    Kumar

    Hi Kumar:
    For all the non UME Roles content in Portal has some action. So I guess for Administrator Role should have an action pertaining to its admin responsibilities. Try to Create Role under Identity Management and assign the action equivalent to it.
    Goto:
    User Admin >  Identity Mgmt > Role > Create User > Give Name > Assign Action.
    Note: I'm currently not at EP server for few days, plz check the option said above and I hope they might work for you.
    If my guess is correct, you can get the Action for already existing Administrator Role from other EP Server in your organization.
    Tnx,
    Munna SAP

  • Role Creation in CUP 5.3

    Hello,
    I'm trying to understand the concept of what is called "role creation" in Compliant User Provisioning.
    My understanding is that the "create role" option in CUP (configuration>Roles>Create Role) means simply adding the "attributes" such as a business process, functional area, system, or company, to the SAP roles that you imported into CUP.  
    It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
    Please tell me if I'm wrong.
    HM

    HM,
      The create role option in CUP is mainly for legacy/non-cup supported systems. This way you can follow the standard workflow process for LDAP/Windows/legacy system. In this user provisioning and role assignment will not be done through CUP and will be manual. This is very important for some companies as they want user to go through same process if they want to get access to any system and not only ERP system.
    The below statement is wrong.
    It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
    If you don't have ERM then you will have to use PFCG. Once you have CUP, you don't have to use SU01.
    Regards,
    Alpesh

  • Business Role to System/Technical Role Mapping in CUP

    All,
    In our design of CUP we are having end-users logon and choose their "business role" and having CUP select the system/tecnhical roles. For example, we want an AP Clerk to be able to logon and choose "AP Clerk" and have role A, B & C from ECC selected and role D from BI.
    Is this type of design possible in CUP 5.3 or are we extending into IDM functionality (which we do not have). Has anyone had experience in type of design? What are your recommendations?
    Thank you,
    Grace Rae

    Grace,
    I assume you are looking for Job/Position roles roles but for SAP systems. Fortunately, CUP provides the flexibility to implement RBAC concept for both SAP & Non SAP systems.
    In this case, catch would be your blueprinting which depends on various parameters like u2013 How sound your authorization concept is placed in all the managed systems (R3, BI, non  sap etc), Approval criteria, organizational operational view etc. Concern is that we may run into other issues of violations, risk analysis, approvals etc if we donu2019t plan diligently
    Alpeshu2019s hint would be really helpful in terms of implementing this requirement.
    Thanks
    Qalid

  • Create Role Option in CUP 5.3

    HI,
    I would like to know the use of Create Role option in CUP.
    We have this option Configuration -> Roles -> Create Role.
    As we know we import roles form either SAP back-end system or ERM.
    In this case what is the use of Create Role option.
    Thanks in advance

    Hi ammu,
    This is just an option in case you need it. Roles created in CUP are just in CUP, not in the back-end. Remember that CUP can be used for non-SAP systems also, in this case the option to create roles in CUP is important. If you just use CUP with "ABAP-based" back-end systems you shouldn't create roles in CUP directly, you usually perform a sync or import form back-end or ERM.
    Cheers,
    Diego.

  • Mass Role Deletion Transport to ECC6

    Hi,
    Prior to transporting a mass role deletion through to the PRD ECC6 system, is it recommended to end date the majority of position to role relationships? End dating may maintain some visability of previous role assignments... Or is it safe to send it through and be confident that all the relationships will be removed as well as UMR based assignments?
    Any recommendations on this topics?
    Kind Regards
    Nathan

    Hi,
    Delete the roles through transports. but if you are concerning about the UMR history and end date for the roles. If so.. make sure there are no active assignments to the users.then there is no requirement for end date. in my idea generally UMR history will be there for deleted users and their assignments...as text.
    ~Praveen.

  • Role Deletion

    Hi
    I would like to delete a role from the DEV system and then have the deletion moved to Q and then P system.
    I have gone through  http://help.sap.com/saphelp_nw04/helpdata/en/e4/15e48efd6c11d296430000e82de14a/frameset.htm
    This reads "If you want the deletion to be transported, place the role objects in a transport request before deleting. To delete the role in a system linked by RFC (like a component system in Workplace), choose Role ® Distribute deletion."
    I am not sure as to how this needs to be done. How does one place the role objects in a transport request?
    If you have had a role deleted and then transported it, let me know how you have done it.
    - ravi

    Auke's answer is the correct one. Assign the role to a transport request BEFORE deleting it; this is easily done from the main screen of PFCG (just click the transport button!). If you delete the role first, BEFORE assigning it to a transport, you won't be able to assign it to any transport...
    When the role is deleted from dev and the transport is subsequently released, the role will be deleted from the downstreams systems.
    You can, of course, also create mass transports with several roles for deletion, Only remember the basic step: put the roles in the transport first, then delete, then release.

  • RE: Default role config in CUP

    Dear Experts,
    I got a problem with default role configuration. Please help me in resolving the issue.
    I want to configure defaults for all request types like new account and change account as well. Also I what the option "Create if user does not exist" to YES.
    This means when ever change account workflow is executed for the existing users, default roles are getting assigned redundantly. is there any way to fix this problem.
    My solution is to schedule "PRGN_COMPRESS_TIMES" job so that system will delete all redundant roles. Please advise if there  is any other alternative. Client is insisting to have the option "Create if user does not exist"in Auto provisioning enabled.
    I appreciate your help.
    Thanks,
    Raj

    Hi
    Set the below parameters it never assign the role for change request.
    it is working in our system.
    CUP---->Configuration->Roles>Default Roles-->Request type = New Hire

  • Partner role delete

    Hi guy,
    I have the need that a partner role is not allowed in a special sales order.
    My first idea was to solve it with a partner schema.
    But that is not possible, 'cause of the following problem;
    If the sales order type XX, was created without a reference, the partner role is allowed.
    If the sales order type XX, was created with a reference to a sales order type XY it is also allowed.
    But it is not allowed, if the sales order type XX was created with a reference to a sales order type YY oder with a reference to sales order type XY, which was created with reference to type YY.
    =>As the role is allowed generally, but not if there is any reference to a special type, the schema don't work.
    So I would like to delete the partnerrole in a USEREXIT and send a mail or message to the user.
    Does someone know a suitable exit or badi ?
    Greatings Manuel

    Hi Rasheed,
    I tried USEREXIT_SAVE_DOCUMENT_PREPARE in MV45AFZZ (because the MOVE_FIELD_TO_VBAK AND MOVE_FIELD_TO_VBAP isn't processed after a change of partners).
    My coding:
    ...(check if partnerrole is forbidden)
    delete xvbpa with where parvw = 'ZZ'.
    When I debug the behaviour it is deleting the entry in xvbpa, but after saving the partnerrole does still exist.
    Where is my failure ??
    Greatings
    Manuel

  • Default Role configuration  in CUP

    Hi Experts,
    We are on GRC 5.3 SP9 and I am trying to assign  default roles based on the request type
    I want default roles to be assigned only for certain request type
    these are the parameters I have configured
    Consider default roles: YES
    Request Type: NEW Hire
    Default roles level: request
    user attributes: Company
    So I am forced to choose default role user Attribute Company.
    I was expecting that whenever a request is created for a new hire I wanted such and such role to be assigned by default!
    but now whenever  a company( for which i mapped the default roles) is selected its putting default roles in all the request types
    I would expect its only puts default roles for my request type NEW HIRE
    for the respective company !
    Any thought? I am missing something?
    Regards
    MK

    Hello Alpesh,
    SAP has come  back saying that the application is designed that way always works with the comibation of  user attributes
    to me its clearly user attributes are taking over the request type ( clearly ingorning ) i dont see a point why they have field in default role configuration  for request type ( Request type  might as well be simply CUP)
    they have asked me try with user attribute  as system  instead of company , looks like it works !
    I will give you more info
    Best Regards
    MK

Maybe you are looking for