Role Import in CUP

Hi
There are two options of choosing the source system for role import in CUP
1. Back end system
2. ERM
I am facing problems in importing roles in CUP from ERM. The system shows a successful import but the number of roles imported are Zero. However if I choose the Backend system as source system, the roles get imported in CUP.
can someone help me with this issue. I want to import roles from ERM because roles imported from ERM will have all the role attributes like Business process, Sub business process, functional area etc which are not available if we import roles from backend.
Regards,
Nitin

Hi Sahad,
Did you look at CUP logs? Is ERM and CUP installed on same server? Have you configured Business process and sub process exactly same as in ERM?
There are 2 ways to upload roles into CUP using spreadsheet:
1) Cumbersome method, if you don't have roles maintained in Excel: You can get R/3 roles via SUIM or some other method and manipulate them to match the role import template of CUP
2) Easy method : Import all the necessary roles into CUP via Backend. Once you have all the roles in CUP, go to 'Search Roles'. Click on 'Search' button without providing any search criteria. This will return all the roles available in CUP. Now, click on Export button. CUP will export all the roles into Excel spreadsheet in the format which CUP understands. Now, delete all the roles from CUP and play with the spreadsheet to manipulate other parameters like role approvers, systems, business process etc and upload that spreadsheet into CUP.
Both these methods require some manual work.
Regards,
Alpesh

Similar Messages

Description issue: Role Import in CUP from ERM

Hi All
While importing roles from ERM in CUP, the description column shows some numeric values in some strange sequence (like 0,1,10,100,1000,1001,1002,1003, and so on). In ERM, roles were uploaded from backend using Mass role Import and Role description are properly available there. For the roles created in ERM itself, correct description is available, when imported in CUP.
Not able to understand this....Please suggest
Thanks
Abhijeet

Hi Abhijeet,
I have found out the cause of this issue.
This issue is coming for those roles which doesn't have detailed description in ERM.
In ERM you can see role name, Role description and also role detailed description.
If the role's detailed description is null in ERM then after importing that role into CUP the description of that particular role will become four digit numeric character. So, We can't say it is a bug because the program is witten like this.
You can see this detailed description in role in the backend ECC system using pfcg.
I hope you understand the point what I wanted to say.
Thanks,
Sudip

Role Creation in CUP 5.3

Hello,
I'm trying to understand the concept of what is called "role creation" in Compliant User Provisioning.
My understanding is that the "create role" option in CUP (configuration>Roles>Create Role) means simply adding the "attributes" such as a business process, functional area, system, or company, to the SAP roles that you imported into CUP.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
Please tell me if I'm wrong.
HM

HM,
The create role option in CUP is mainly for legacy/non-cup supported systems. This way you can follow the standard workflow process for LDAP/Windows/legacy system. In this user provisioning and role assignment will not be done through CUP and will be manual. This is very important for some companies as they want user to go through same process if they want to get access to any system and not only ERP system.
The below statement is wrong.
It seems that, with CUP, once you have imported SAP roles and "adjusted" them (adding attributes), you are no longer operating PFCG and SU01 in the SAP backend system. From this point on, everything is done in CUP (provisioning) and ERM (creating additional roles).
If you don't have ERM then you will have to use PFCG. Once you have CUP, you don't have to use SU01.
Regards,
Alpesh

Create Role Option in CUP 5.3

HI,
I would like to know the use of Create Role option in CUP.
We have this option Configuration -> Roles -> Create Role.
As we know we import roles form either SAP back-end system or ERM.
In this case what is the use of Create Role option.
Thanks in advance

Hi ammu,
This is just an option in case you need it. Roles created in CUP are just in CUP, not in the back-end. Remember that CUP can be used for non-SAP systems also, in this case the option to create roles in CUP is important. If you just use CUP with "ABAP-based" back-end systems you shouldn't create roles in CUP directly, you usually perform a sync or import form back-end or ERM.
Cheers,
Diego.

Mass role deletion in CUP 5.3

Hi all,
in our CUP 5.3 system someone has unintendedly imported all roles and profiles from the backend system (about 4000 roles).
How can we delete those roles from CUP without having to delete it from the frontend, which will take ages.
Is there any way or database script to safely remove the roles?
They can be determined by either role approver or last reaffirm date.
Thanks
Daniela

That's why I tell my customers
"Whatever you want to do in Role Import - ALWAYS klick on "from file" first. No Exceptions. Never!"
You're out of luck, there is no delete script. You can ask support for the DB ER document, but you'll have to do DB manipulations on your own risk, I'm afraid...
Frank.

Role deletion in CUP

Hi Experts,
Please help us out.
We had some test roles created in ERM, imported to CUP and tested by User Assignment. Now we want to clean the roles before role upload. We have deleted all roles in ERM but in CUP it is giving error-
" Cannot delete since referred by request."
We have archived all kind of requests but we are still getting the error. Please suggest.
Thanks & Regards,
Sabita

Hi All,
I found the option to enable/disable the role or to set the Role validity date . It's available as tick mark icon along with the + and - icons on the System tab when the role is selected for change. I just missed this button as i expected this property of the role either in the information section or in some of the tabs :(.Anyways, happy to find it now
Cheers,
Anil

Error when updating through "Role import"

Hi all
I get this error when I update through Home > Authentication > SAP > Role Import:
"An error occurred while communicating with the CMS.
The following error message was returned:
Error occurred in CSAPSecHttpRolePage::OnCommitRoles. Return value = -2147213817 (0x80041e07)j Failed to commit objects to server : Duplicate object name in the same folder."
Does this mean that I have duplicate users or groups? If this is the case, how come I get the error even if I remove all roles, update, and then add a role and update again? Then everything should have been cleared?
And the funny part is that the import of users seems to work, because I can log on to the InfoView using SAP authentication... But I don't like this error, and would like to get rid of it.
Best regards,
Martin Søgaard

Hi Sogaard,
when you remove all roles can you verify that all the user groups and users are being removed from the system ?
after removing the roles could you also delete the entitlement system and re-create it ?
Ingo

Problem with Role import in GRC 10.0

Dear GRC Gurus,
I want to import roles from backend to GRC 10.0 system. for this I am using NWBC.
In NWBC --> Access Management --> Mass Role Maintenance --> Role Import --> in this age below OPtions are selected:
Role Selection --> Technical Role
Import Source: Role Attribute Source: User Input, Role Authorization Source: Backend System
Definition Criteria:Application Type: SAP, Landscape: nothing is shown in the dropdown, Source System: nothing is shown in the dropdown
Without Defining Landscape and Source system I cannot proceed further
Please advise why the system is not showing up the values in the dropdown.
I have maintained role status as production in SPRO.
I appreciate your help.
Thanks,
Swathi

Hi,
Sabita is correct.
Here is the link to the documentation
SAP Access Control 10.0
Simon

GRC AC 10.0: Info about rejected roles in the CUP Email

Hello all,
the GRC componetent CUP seems to be technically mature in comparison to Role Management component, but there is one thing where I am not sure, is it an error or did I miss some config parameters:
When the CUP Request ist closed, the user gets an email (Template ID: GRAC_AR_CLOSE). Not all of the roles were approved, some of the roles were rejected. But the user gets an email where only the approved roles are listed:
We would like to inform the user about the status of all roles in the CUP requests: which roles were approved and which roles were rejected. Is it possible to configure in MSMP Workflow?
Right now we have the following setting:
Thanks,
regards Sabrina

Hi Sabrina,
To notify the requester for the roles which got rejected, you can try with Email notification template: GRAC_MSMP_ERM_REJECTED for the for the message class.
You can create custom version of this template. For more understanding on how to customize the Email notification template, you can refer to: http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/605077fc-3577-2e10-e1a6-a743514d4eb3?QuickLink=index&…
Hope this helps, Let us know if you face any issues.
Regards,
Ameet

ERM - Mass Role Import Error

I just upgraded to SP11 and am trying to mass import a few roles. It doesn't give me an error on the mass input screen, but it doesn't import the role, so I put DEBUG on and looked at the system logs. I created the download file as both ANSI and UTF-8 and neither is working. Here is the system log output:
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG
-- Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG recordHistory:0::true#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG -- End Request dump for Action Path is cnvMassRlImport.scrMassRlImport.loadMassRoleImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Current Module: |CFG| Conversation: |cnvSysLog| Screen: |scrSysLog|
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#loadMassRoleImport#
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Changing Conversation: FROM: cnvSysLog TO cnvMassRlImport
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearConversationRep :   : 0 entries cleared from conversation repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG com.virsa.framework.Context : clearScreenRep :   : 0 entries cleared from screen repositiory
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:26:51,160 [SAPEngine_Application_Thread[impl:3]_39] DEBUG forwarding to:/cfg_mass_role_import.jsp
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG
-- Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG -- End Request dump for Action Path is scrMassRlImport.importRoles
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#importRoles#
2010-03-23 11:27:09,316 [SAPEngine_Application_Thread[impl:3]_28] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:09,332 [SAPEngine_Application_Thread[impl:3]_28] DEBUG dirName-->E:\usr\sap\WMS\GRC\ROLEIMPORT\1269358029332
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG returnStatus###success
2010-03-23 11:27:09,347 [SAPEngine_Application_Thread[impl:3]_28] DEBUG forwarding to:/cfg_mass_role_import_status.jsp
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG
-- Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG -- End Request dump for Action Path is scrMassRlImport.generateRolesForeGround
2010-03-23 11:27:10,769 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Current Module: |CFG| Conversation: |cnvMassRlImport| Screen: |scrMassRlImport|
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Module#CFG#Conversation#cnvMassRlImport#Screen#scrMassRlImport#Action#generateRolesForeGround#
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG Handler found:class com.virsa.re.configuration.action.MassRoleImportAction
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) starts.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG In LockedObjBO.getLockedObjListByType(String objType) ends.....
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG GET_BUS_PROC ===== SELECT BP.BPROCID, BP.BPROCNAM, BL.BPROCDES FROM VT_RE_BPROC BP LEFT OUTER JOIN VT_RE_BPROCLNG BL ON(BP.BPROCID = BL.BPROCID AND BL.LNGID=?), VT_RE_BPSPASSOC BSP WHERE BP.BPROCID = BSP.BPROCID AND BSP.SUBPROCID =?
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG bprocName ===== HR00
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG keys.size():- 42
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1 cache statusid = 1 value = DEVELOPMENT Desc = Kehitys
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2 cache statusid = 2 value = PRODUCTION Desc = Produksjon
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 3 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 4 cache statusid = 1 value = DEVELOPMENT Desc = Development
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 5 cache statusid = 2 value = PRODUCTION Desc = �retim
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 6 cache statusid = 1 value = DEVELOPMENT Desc = Projektowanie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 7 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 8 cache statusid = 2 value = PRODUCTION Desc = Produ��o
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 9 cache statusid = 1 value = DEVELOPMENT Desc = Desarrollo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 10 cache statusid = 2 value = PRODUCTION Desc = Production
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 11 cache statusid = 2 value = PRODUCTION Desc = Produzione
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 12 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 13 cache statusid = 1 value = DEVELOPMENT Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 14 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 15 cache statusid = 1 value = DEVELOPMENT Desc = Udvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 16 cache statusid = 2 value = PRODUCTION Desc = Produkt�v
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 17 cache statusid = 1 value = DEVELOPMENT Desc = ??????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 18 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 19 cache statusid = 2 value = PRODUCTION Desc = Productie
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 20 cache statusid = 1 value = DEVELOPMENT Desc = Fejleszt�s
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 21 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 22 cache statusid = 1 value = DEVELOPMENT Desc = Desenvolvimento
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 23 cache statusid = 2 value = PRODUCTION Desc = ???
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 24 cache statusid = 1 value = DEVELOPMENT Desc = Ontwikkeling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 25 cache statusid = 2 value = PRODUCTION Desc = V�roba
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 26 cache statusid = 2 value = PRODUCTION Desc = ????????????
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 27 cache statusid = 1 value = DEVELOPMENT Desc = Sviluppo
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 28 cache statusid = 1 value = DEVELOPMENT Desc = Utveckling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 29 cache statusid = 2 value = PRODUCTION Desc = Tuotanto
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 30 cache statusid = 2 value = PRODUCTION Desc = Produkcja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 31 cache statusid = 1 value = DEVELOPMENT Desc = Utvikling
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 32 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 33 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 34 cache statusid = 1 value = DEVELOPMENT Desc = V�voj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 35 cache statusid = 2 value = PRODUCTION Desc = ??
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 36 cache statusid = 2 value = PRODUCTION Desc = Produktion
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 37 cache statusid = 2 value = PRODUCTION Desc = Proizvodnja
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 38 cache statusid = 1 value = DEVELOPMENT Desc = Entwicklung
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 39 cache statusid = 1 value = DEVELOPMENT Desc = Geli?tirme
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 40 cache statusid = 1 value = DEVELOPMENT Desc = Razvoj
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 41 cache statusid = 2 value = PRODUCTION Desc = Producci�n
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 42 cache statusid = 1 value = DEVELOPMENT Desc = D�veloppement
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 1RoleStatusName:- DEVELOPMENT
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG 2RoleStatusName:- PRODUCTION
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG MissingDescriptionHelperDAO.java@37:com.virsa.re.dao.MissingDescriptionHelperDAO.getMissingRoleDesc()missingLst.size(): 1
2010-03-23 11:27:10,785 [SAPEngine_Application_Thread[impl:3]_31] DEBUG startIndex: 0; endIdex: 1
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG RoleImportBO.java@1393:com.virsa.re.bo.impl.RoleImportBO.createRole()Creating Role:ZM:HR_PY_DEPT_SUPP_COMP profile:'Z:DEPTSUPP'
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11)
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] DEBUG InsIde getLastGenerateDate(3572,11) ResultSet and got an entry
2010-03-23 11:27:10,800 [SAPEngine_Application_Thread[impl:3]_31] ERROR Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
java.lang.Throwable: Cannot assign a java.lang.String object of length 389 to host variable 7 which has JDBC type VARCHAR(100).
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:85)
     at com.sap.sql.log.Syslog.createAndLogOpenSQLException(Syslog.java:124)
     at com.sap.sql.types.GenericResultColumn.checkLength(GenericResultColumn.java:212)
     at com.sap.sql.types.VarcharResultColumn.setString(VarcharResultColumn.java:63)
     at com.sap.sql.jdbc.common.CommonPreparedStatement.setString(CommonPreparedStatement.java:511)
     at com.sap.engine.services.dbpool.wrappers.PreparedStatementWrapper.setString(PreparedStatementWrapper.java:355)
     at com.virsa.re.dao.jdbc.ChangeHistoryDAO.saveChangeHistory(ChangeHistoryDAO.java:318)
     at com.virsa.re.bo.impl.ChangeHistoryBO.saveChangeHistory(ChangeHistoryBO.java:77)
     at com.virsa.re.bo.impl.RoleBO.updateRoleWithChngeHist(RoleBO.java:469)
     at com.virsa.re.bo.impl.RoleImportBO.createRole(RoleImportBO.java:1437)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:639)
     at com.virsa.re.bo.impl.RoleImportBO.importRoles(RoleImportBO.java:333)
     at com.virsa.re.configuration.action.MassRoleImportAction.generateRole(MassRoleImportAction.java:597)
     at com.virsa.re.configuration.action.MassRoleImportAction.execute(MassRoleImportAction.java:78)
     at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:273)
     at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)
     at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)
     at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(Native Method)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)

Hi All,
Two weeks ago, I have trying to load roles in ERM. The result hasn´t been than expected. I use SAP GRC AC (5.3). I need to load 6375 single roles, but only I have loaded 914 single role. Next I described to you a general context of my situation:
1. I divided the file VIRSA_RE_DNLDROLES.txt into 16 files (UTF - 8) with single roles per module (AM, PO, PS, GL, SD...)
2. Each file contains segmented roles associated to a business process and multiples sub - business process.
3. When I checked roles in ERM, I notice that just load any roles. Not all roles in template was loaded.
4. Files size varies between 18 kb y 145 kb.
5. Files concerned "Mass Role Import" have the following extensions: Bulk Download File* (.txt), Enterprise Role Management Information File (.xls) and Primary Org. Level File (.xls).
5. A error generated was "Unknown error occurred while performing operation (No space left on device (errno:28))."
Honestly, I don´t know the reason for not loading all roles from template. Any suggestions? or ideas?
Thanks in advance

ARQ: Role Import does not show roles in the preview

Dear All,
Recently I upgraded our system to SP#14. Now when I try to import roles from NWBC->AM->Role Mass Maintenance->Role Import, it does not show roles in preview. Also, it does not import the roles specified. (either a range or full name of the role). It does not even give any error message.
I implemented SAP note#1897975 Role import does not show roles in the preview.
Still facing the same problem. Has any one faced this problem? Please suggest.
Regards,
Faisal

HI Faisal,
This note(1897975) you have to implement in Plug-in System, try to check the same once and let me know if it resolves our issue.
Regards,
Neeraj Agarwal

Import roles to the ERM without using the "Mass Role Import

Hello,
I want to know if there is another way to import roles to the ERM without using the "Mass Role Import.
Im'm using SAP GRC AC 5.3
Best Regards.
Pablo Mortera.

Hi.
There is NO other way to import roles..
We need to use only ERM for "Mass Role Import.
Regards
Gangadhar

Business Role to System/Technical Role Mapping in CUP

All,
In our design of CUP we are having end-users logon and choose their "business role" and having CUP select the system/tecnhical roles. For example, we want an AP Clerk to be able to logon and choose "AP Clerk" and have role A, B & C from ECC selected and role D from BI.
Is this type of design possible in CUP 5.3 or are we extending into IDM functionality (which we do not have). Has anyone had experience in type of design? What are your recommendations?
Thank you,
Grace Rae

Grace,
I assume you are looking for Job/Position roles roles but for SAP systems. Fortunately, CUP provides the flexibility to implement RBAC concept for both SAP & Non SAP systems.
In this case, catch would be your blueprinting which depends on various parameters like u2013 How sound your authorization concept is placed in all the managed systems (R3, BI, non sap etc), Approval criteria, organizational operational view etc. Concern is that we may run into other issues of violations, risk analysis, approvals etc if we donu2019t plan diligently
Alpeshu2019s hint would be really helpful in terms of implementing this requirement.
Thanks
Qalid

GRC AC 5.3 SP5 - ERM mass role import error

Dear Gurus
I am customising ERM 5.3 SP5 and encountering the following error.
I have tried to search and find the forum for an analogous message, but unsuccessfully.
Thanks in advance for your assistance / support
Best regards
RONAN
Role Import Failed for SAP_CO_OM_XXXXX_XXXXXX_X :
2010-01-15 09:07:47,065 [Thread-315] ERROR com.sap.engine.services.dbpool.exceptions.BaseSQLException: ResourceException in method ConnectionFactoryImpl.getConnection(): com.sap.engine.services.connector.exceptions.BaseResourceException: Cannot get connection for 120 seconds. Possible reasons: 1) Connections are cached within SystemThread(can be any server service or any code invoked within SystemThread in the SAP J2EE Engine), 2) The pool size of adapter "SAPxxxDB" is not enough according to the current load of the system or 3) The specified time to wait for connection is not enough according to the pool size and current load of the system. In case 1) the solution is to check for cached connections using the Connector Service list-conns command, in case 2) to increase the size of the pool and in case 3) to increase the time to wait for connection property. In case of application thread, there is an automatic mechanism which detects unclosed connections and unfinished transactions.

Hello Ronan,
This is a connection error and can be rectified by your basis team (as mentioned by Alpesh) which need to increase the wait time. If you are just dealing with the configuration part, then I would say it is not an error resulting from Functional Config but Basis Configuration.
regards,
hersh.
Edited by: HERSH GUPTA on Jan 17, 2010 3:28 PM

Error on role import for SAP integration with BO in CMC (3.1)

Hello,
We are trying to integrate existing BO environment in our company with existing BW installation.
BO Environment - 3.1
BW/ECC Environment - (BW - BI 7.0 SP20, ECC 6.0)
So got the pre-requisites completed and the transports imported into both BW and ECC environments. Upon these steps we went ahead and installed the integration kit for 3.1 system.
There were no error messages, after we completed the installation went into infoview and in the authentication drop down checked to see if I can get "SAP" in there....which it did. So, I am assuming there were no issues till this point which we might have missed out.
Upon this, when I went into SAP authentication in CMC and double clicked on SAP and in the next screen clicked on "NEW" and added in the application server, system number, id and password and updated it...this automatically updated the logical system.
But when I go into the role import, it gives me the following error message....
Exception in JSP: /jsp/auth/sapsec_import_role.jsp:22:19:20: <%21:string context::secSAPR3ImportRoleBean.getContextPath():22: secSAPR3ImportRoleBean.init(request):23:response.setHeader("Expires","0"):24: 5> Stacktrace:
The only thing is we have not assigned the CRYSTAL_ENTITLEMENT role to it as we are at this point only trying to see if we can log into webi...
So, is it required to assign this role to an existing user id role in order for me to import the roles into BO CMC screen in order to be assigned to a group.
Can you please help me out on this.
Thanks
Dharma.

Hello Ingo,
Thanks a lot for looking into the question.
Yes, we are taking about the SAP Authentication part where I am trying to import roles in SAP into BO after I provide the login information in the Entitlement systems tab.
I confirmed that all parts of Java Connector configuration were taken care of as mentioned in the installation manual and from your blog.
The only piece left off is the CRYSTAL_ENTITLEMENT role assignment to the id which is used within the entitlement systems tab in CMC. I will get this configured and try it one more time.
Just to confirm,
1. The new user id to be created (should it be a RFC user or dialog user)
2. Is the only role to be assigned to the new user is CRYSTAL_ENTITLEMENT with the authorization mentioned in the installation manual
3. What are the roles to be imported into BO within CMC (are these the roles which we want for data access)
4. When a user tries to login with any other user id other than the one listed in Entitlement systems tab, does it use the roles assigned to that person in SAP to retrieve the data or would it be dependent on the roles imported into BO within CMC in earlier step.
Please let me know.
Thanks
Dharma.

Role Import in CUP

Similar Messages

Maybe you are looking for