Role Upload template for SAP GRC CUP 5.3

Good Morning / Afternoon / Evening SAP Security Gurus,
I am looking to upload end user roles via a role upload template spreadsheet for use in SAP GRC CUP 5.3. I am referring specifically to the recommended template mentioned in step 11 of the 5.3 Post Installation CUP guide, so that roles can be picked within ERM for workflow.
According to the guide, it recommends uploading from the backend systems via a spreadsheet - any template versions or advice on finalising this would be most appreciated.
Best Regards
Steve

Thanks Ashish,
Someone else recommended this option as well via another forum. Have tried it out and working fine.
Thanks for the reply
Steve

Similar Messages

Spanish Manual for SAP GRC AC 5.3

Hello,
I want to know if someone has an spanish manual for SAP GRC AC 5.3 for the 4 modules (RAR, SPM, CUP & ERM).
Or if someone knows a link to get them. I need them.
Thank you in advance.
Best Regards.
Pablo mortera.

Hi Pablo,
In 5.3 we can use the SPM by two different ways.
1. FFID based: In this you make a user as a FFID and then you use this FFID to perform all the actions.
User based roles are for the above.
3. Role based: In this you assign the roles(maintained in SPM) to the user.
Role based roles are for above.
The basic diffeence is in first one you use user (FFID) to perform the activities whereas in second you use role (which are maintained in SPM).
You can get more details of this in user guide and configuration guide.
Regards,
Shweta

Creation of Web Template for SAP R/3 Transaction

Hi ,
    How can i create my Web Template for SAP R/3
    transaction for publishing in ITS ?
    I have created my own Z transaction of
   (Module Pool ), <b> How can i create Template & run
   it through web .     </b>
Regards
Sachin S M

Go to transaction SE80
choose internet service option.
enter a name for the service and hit enter, the system will prompt with a message that the service is not available do you want to create clik yes.
choose the radiobutton screen based application and enter the transaction code and hit enter.
once the service is created, right click on the service name and click create Template, enter the program name (it will be defaulted from the transaction) screen number and hit save.
once created you have to activate it and publish it to ITS server.
Which version of SAP are you using? you can show your transaction on the web using ITS without creating template also.
Regards
Raja

Scope and Proposal preparation for SAP GRC AC Implementation.

Hi ,
I would like to know procedure how the RFP (Request for proposals) are prepared for SAP GRC AC Module implementation. and also how the scope and effort estimation are calculated.
are there any guidelines and checklist are available to be followed.
is there any generic approach followed during SAP GRC AC implementation for proposal as well as for effort estimation.
Pelase clarify my doubts
Regards,
RK

Hi,
Use RTA on SAP BASIS 7.00 System for any system other than ECC which has ABAP and Basis Level 7.00 with Kernel 7.00
I don't see any option for 7.20, may be it will be available later on.
We have SRM connected to GRC so I can cofirm, yes it is possible to connect SRM to GRC and work with SRM rulebook. RTA and Post-RTA activites and JCO and RAR connectors are a must to get it work properly. In fact all configurations are required as it is in ECC system.
No HR RTA is required ,as there is no HR module in SRM.
Regards,
Sabita

Tcodes & Roles for SAP GRC AC 5.3 SPM in R/3

Hello,
After installing part of the SAP GRC AC 5.3 SPM in the Tcode SAINT (R/3).
I want to know what Tcodes do I need to use the Tcode /VIRSA/VFAT.
Or what type of roles do I need. Is there some.
I have read the PDF "SAP Governance, Risk & Compliance Access Control 5.3 - 02 Post-Installation - SPM.pdf", and I have seen some roles. Are this the standard roles for the SPM in R/3?
Best Regards.
Pablo Mortera.

Hi Pablo,
In 5.3 we can use the SPM by two different ways.
1. FFID based: In this you make a user as a FFID and then you use this FFID to perform all the actions.
User based roles are for the above.
3. Role based: In this you assign the roles(maintained in SPM) to the user.
Role based roles are for above.
The basic diffeence is in first one you use user (FFID) to perform the activities whereas in second you use role (which are maintained in SPM).
You can get more details of this in user guide and configuration guide.
Regards,
Shweta

SAP GRC CUP password issue

Hi,
to get user password, i set email reminder, closing as send password in mail No and password display period : 0.It throws a password as sap default string .How can it be standard password,so user can reset by entering it.In SAP GRC 5.3 AC-CUP 5.3_05.0, I can't see password self service tab too.Is there any better way so user can get password in email as sap standard in 8 words (number , letters or any special characters as set like us).

when i try to create request type for password self service. i have only these actions to select
CREATE_USER Create User
CHANGE_USER Change User
DELETE_USER Delete User
LOCK_USER Lock User
UNLOCK_USER Unlock User
ASSIGN_ROLES Assign Roles
SUPER_USER_ACCESS Super User Access
USER_DEFAULTS User Defaults
i can't see any action for password self service in configuration->request type-> create option.please answer it.

Roles in BP for SAP CRM 4.0 6.2.2.

I have imported the business package for SAP CRM 4.0 6.2.2 in the portal (EP 6.0 SP2).
After the import of other business packages the roles provided with the BP could be connected to a group or user by user administration > roles.
I cannot find the roles provided with the BP CRM 4.0. When i look in the directory structure on the server, there are plenty of roles in the folder
... > import > business package for sap crm 4.0_6_2_2 > roles.
I have copied some roles to other folders, but still i don't see them in the portal.
Where can i find these roles, or what do i have do to get the roles shown to me?
Thanks in advance,
Timo

Hello,
I have looked in the logfile. I get an object content list where all the roles are mentioned.
Furthur on in the log file it says that the migration of the .par's is succesful. But for some .ivu's i get the warning: The PAR file: com.sapportals.km.par containing profile: 'navigation' was not deployed prior to IVU handling, no template iView can be created ,path searched : par:/applications/com.sapportals.km/components/navigation
This warning is followed by the error (severe) Object was not migrated: Import of iView: com.sap.pct.crm.infocenter.news.AuthorPartnerCompany Failed !
I get this for several .ivu's. All for com.sapportals.km.par.
Since is have had no error on a .par i suspect that i should have imported/installed something else first. But what?
Now i will miss some iviews en pages but i think i should get something since a lot of iviews and pages are migrated successful.
However, in the logfile nothing, beside in the object content list, is mentioned about roles. But i get something about a rolecopier:
The object /com.sap.pct.crm.pad.RoleCopier.ivu is defined for skipping in cms_mapping.properties.
Followed by
SUCCESS: Object was skipped.
And something about a checkrole:
The object /com.sap.pct.crm.pad.RoleCheck.ivu is defined for skipping in cms_mapping.properties.
Followed by
SUCCESS: Object was skipped.
It looks like that this is OK.
And .... later on in the logfile i get the following serie of messages:
- PCD lookup for page: portal_content/com.sap.portal.migrated/ep_5.0/pages/com.sap.pct.crm.pad.RoleCopier did not find target ,Exception message: Child not found: com.sap.pct.crm.pad.RoleCopier at portal_content/com.sap.portal.migrated/ep_5.0/pages, The page will be created
- Page com.sap.pct.crm.pad.RoleCopier was created successfully!
- WARNING: iView com.sap.pct.crm.pad.RoleCopier Was skipped
- Page layout name is com.sap.portal.fullWidth
- SUCCESS: Object was created successful. page id : com.sap.pct.crm.pad.RoleCopier, page title : Role Copier
And the same for the RoleCheck.pag
When i imported the support package for the business package i got 2 roles (com.sap.cnt.crm.container.sapcrm40.all and com.sap.cnt.crm.crm_default_services). I have assigned these 2 roles to a group, but i don't see a new tab.
In the logfile for the support package i get for each rol within the rol SAPCRM40.All the WARNING: StructureObject.handle_Link(/roles/com.sap.pct.crm.container.SapCRM40.All/Customer): The target object of the link (source object) is not available. You can ignore this message if the target object will be migrated later.
Followed by SUCCESS: StructureObject.handleLink(): DeltaLink to portal_content/com.sap.portal.migrated/ep_5.0/roles/com.sap.pct.crm.Customer was created successfully.
The migration of SAPCRM40.All ends with
SUCCESS: Role com.sap.pct.crm.container.SapCRM40.All was migrated successfully.
What is happening here?
Why don't i have the par com.sapportals.km.sap?
What is going wrong with the roles?
Greetings,
Timo

SAP GRC CUP Getting message "Some unmitigated risks exist".

Hi,
when there is one profile or role,when approver mitigate the request.It gets message" Some unmitigated risks exist".
Already it's configured as unchecked for "Allow Approvers to approve access, despite any conflicts" in GRC CUP.
Any advise or solution.
Thanks
shahed.

Hi Shahed,
When u you the seeting "Allow approver to approve dispite Risks" as unchecked. This setting exist at stage level as well as at global level. Stage level setting get the preference. With this setting Approver will not be able to approve the request untill all risks are mitigated or no risks exists. It will show an error some unmitigated risk.
Kind Regards,
Srinivasan

HTML Editor for creating e-mail templates for SAP Cloud for Customer

Hi Techies,
                 Is there any preferred software for creating e-mail templates to use with SAP Cloud for Customers ? I mean to avoid unnecessary errors when creating standard e-mail template which are recognized unified manner within the system.
Will appreciate with rewards points for best support.

Here is a template for the wire-frame that we used. We went with pure HTML tables so that the response could be multi-client compatible. We found that additional code caused issues with certain clients. In the middle table, we had linked icons to our respective self serve properties and additional support options for Chat and our own Support Community.
The content of the email will be placed where #Text# is. Our email responses include the content and the basic signature. We also provide our detailed legal disclaimer at the bottom with additional links if needed.
Let me know if you have any questions.
Thanks!
Josh
<font face="Trebuchet MS, Arial, Helvetica, sans-serif" size="2">
<table width="100%" cellspacing="0" cellpadding="0">
<tr>
    <td style="width:50px;"> </td>
    <td style="border: 1px solid #9b9b9b; border-bottom: none;">
       <div style="color: #6a6a6a; display: block; margin: 10px; padding: 10px;">#Text#</div>
      <p style="color: #6a6a6a; display: block; margin: 10px; padding: 10px;">Chat:       <br />
      Support Community: <br />
      Customer Care: </p>
    <p> </p></td>
</tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0">
<tr>
    <td style="width:500px; border: 1px solid #9b9b9b;">
<table width="100%">
<tr>
<td width="50" valign="middle"><img src="XXXXX" alt="XXXX" title="XXXX" style="border:0 none;" /></a></td>
        <td valign="middle">
        <p style="color: #6a6a6a; display: block; margin: 5px;">Support is also on: 
</td>
</tr>
</table>
    </td>
    <td style="border-right: 1px solid #9b9b9b;"> </td>
</tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0">
<tr>
    <td style="width:50px;"> </td>
    <td border="1" style="border: 1px solid #9b9b9b; border-top:none;"><p> </p>
    <p style="color: #6a6a6a; display: block; margin: 10px; padding: 10px;"><strong>NOTICE:</strong> Legal Disclaimer   Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse a
magna non libero accumsan luctus. Donec purus metus, mollis nec
commodo ac, hendrerit pulvinar lectus. Sed quis elit felis. Duis ut
eros urna. Morbi fringilla nunc vitae enim mollis in sodales nisl
tincidunt. Etiam orci risus, convallis ut tristique in, vestibulum sed
ligula. Donec quis sodales purus. Donec dignissim lacus dignissim
justo fermentum eu volutpat justo consectetur. Fusce metus massa,
fringilla sed malesuada nec, vulputate quis lectus. Vestibulum et
venenatis ante. Vestibulum non dui dolor, et tempus magna. Cras
tincidunt cursus enim, id convallis tortor placerat eu. In in magna ac
dui pretium placerat. Duis tortor leo, viverra ac tincidunt nec,
bibendum non nunc.
Curabitur et turpis vel nulla vulputate ullamcorper id sed eros. Donec
orci lacus, elementum nec vulputate et, varius id neque. In ac magna
ac lectus gravida consectetur. Class aptent taciti sociosqu ad litora
torquent per conubia nostra, per inceptos himenaeos. Etiam egestas,
diam vitae molestie vestibulum, magna orci ultricies nisi, id luctus
lorem nulla nec lorem. Donec tincidunt vehicula ipsum eget mattis.
Donec dictum vulputate mi ut facilisis. Vivamus varius augue fermentum
libero iaculis quis dictum ante consequat. Aenean luctus massa sit
amet nulla sagittis id fermentum sem luctus. Vivamus odio diam,
lacinia ac egestas eget, tincidunt et sem. Sed a ante dui, eu
scelerisque eros. Nullam et faucibus odio. Nunc posuere auctor sem, ac
blandit ipsum molestie sit amet. Nullam nec luctus arcu. </p>
    <p> </p></td>
</tr>
</table>
</font>

Looking for SAP GRC study material

Hi Folks
i am looking for some GRC 10.0 material for self study. i found some material in help.sap.com, but looking for some material which deals with basics.
if any one has any any info please share,, that would be a great help....
regards
Kevin.

Hi Kevin,
Since GRC 10 is still in the initial phases, it might take time to publish the study material as like GRC 5.3. However, some of the reference documents are available at New AC 10.0 documents published in BPX
Regards,
Raghu

License for SAP GRC

Hi All,
We are planning to implement the SAP GRC. For this, I would like to know, if Netweaver license is part of GRC software or it needs to be procured seperately ?
Any suggestion on this please!!!
Thanks & Regards,
Santhosh Kumar P

Hi,
It depends upon the your company license contract with SAP, Check with your SAP account contacts.
hope this helps,
Kalyan.

SAP GRC CUP for backgrounjobs

Hi,
I set background jobs email dispatcher,shedule type other to every sec as 3600 and it's not taking to less than 3600.i am trying to put 60 sec and it's throwing error Enter a valid numeric value for Every Second, Value greater than or equal to Background Job Time Interval, 3600

Hi,
The background job dispatcher time should be greater than or equal to the background job time interval time defined under configuration -> miscellaneous. Remember, the Background Job Time Interval is in Minutes.
Regards,
Alpesh

SAP Roles and Access for SAP Implementation team members

Hi,
Is it correct practice to give SAP_ALL role access for all SAP Implementation team members in Dev and QA?
If not, what is the correct practice?
Kindly let me know

Madhu,
It is NOT correct practice to give anyone SAP_ALL in any of the systems; not DEV, not QAS, and certainly not PRD. However, many implementation teams (and particularly consultants from SIs) insist that they cannot possibly do their jobs without it. This is completely incorrect as there are specific roles for them to use for that purpose. The only circumstance where it could be justified is if you require a special "firefighter" role - and even then, I would still be a bit doubtful.
You should also consider that once you have given someone SAP_ALL, they will fight tooth and nail to keep it. It also means that they probably are not testing the user roles correctly. Most of those that insist they need it simply do not understand the security issues and probably don't care.
Just think; if they have access to do soemthing that they shouldn't and then cause a big problem, are they the ones that will have to fix it or are they going to expect you to do it? If they expect you to clear up after them, then you have the right to insist on restricting their access to cause issues in the first place.
But I know just how demanding they can be....
Best of luck
Tony

Template for SAP Security Standard document

Hi SAP Gurus,
I was asked to overhaul our company's SAP Security Standards document. So Im hoping someone can give me a template on what information/data should be in the document?

Hmm, interesting comments. Is it really a Standard that you're after? Not wishing to ask if you like salt with your eggs but I assume we know the differences between Standard, Policy, Procedure? You'd be surprised with the number of so called Security experts /Consultants that can't articulate this. I have seen big 4 people who are meant to be delivering Policy but actually documenting a Standard, even Procedures
So are you looking at delivering a Standard per Application? You should also have a Generic App Security Standard.
Standard - you're looking to no more than 10-20 pages.
SAP hooks into several other documents so you should be explicitly referencing O/S and Database Standards.
Authenticating against SAP - that should be covered in Access Control Policy /Standard.
Encryption ....? Your encryption doc's and so on.
SAP sits on an O/S, so if you're an IBM house then you're looking at AIX. SAP would assume this as a pre-req. Database? You've got Oracle and if again you're an IBM house you follow DB2.
DB2 inherits numerous priv's from the underlying O/S. So if AIX is poorly configured, then DB2 inherits this. Of course there's a bunch of stuff that you can do from SYS* parameters etc.
I've just put together a bunch of stuff for an Org. The actual SAP piece is actually not that hard. The Procedure is a little more specific e.g. specific Install Accounts /Passwords that need to be changed, how you secure external interfaces.
Please let me know if you need anything further.
Cheers, N

Anyone have SAP GRC CUP LDAP connector using port 636 SSL working?

Hello,
I wanted to verify if anybody connects to an eDirectory (or any other) LDAP in CUP using SSL port 636?
Statement I received from SAP is that this is not supported in CUP, and only non SSL connections to LDAP work. I just have trouble to believe this as SSL would be best practice in any company.

Pados,
By using STUNNEL, CUP will not know about SSL. CUP will always think it is a regular connection but stunnel will send SSL connection to LDAP. Here is the link:
http://www.stunnel.org/
Regards,
Alpesh

Role Upload template for SAP GRC CUP 5.3

Similar Messages

Maybe you are looking for