SAP GRC Compliant User Provisioning (CUP) Password Self Service

Hello everyone,
I am setting up Password Self Service within CUP.  For those users that do not already have access to the UME frontend, I know that I need to create a user ID in the UME frontend for each user so that they can access the Password Self Service option.  Since I only want the user to access the Password Self Service option, what UME role do I assign to them to ensure that they cannot access anything else within CUP?
Thank you!
Johonna

Johonna,
The 3 defined roles are only those suggested by SAP.
You can create your own roles by assigning the various actions as needed to provide access or restrict as your organisation requires.
However, depending on your patch level, you may find that certain actions are dependant on others to work properly.
Also, you either grant access to the functionality or not. There is no partial or display only setting in the java stack.
Enjoy!
Simon

Similar Messages

  • CUP-Password Self Service-Email not received by user

    Hi,
    I confidured SMTP server with Mail server information.
    I raised a request for Password Self-service for a User.
    Request executed successfuly with a message " Password was reset and send to email id of user"
    Password in backend system has reset successfully,
    but No Email has received by user regarding reset PW.
    What si the problem, why the user not received email? even in CUP it shows that email sent successfully.

    Hi,
    Yes i scheduled email dispatcher.
    Now Email is received by the user.
    User received a link for password, when user click on that a blank page with header Password is displayed.
    no other information is appearing.
    Thanks
    Ram.

  • CUP Password Self Service

    Hi,
    I have some problems with using the password self service.
    The user has answered the challenge response and is registered. After losing the password the user tries to access the password self service link. Therefore he has to login - why??? This doesn't makes at all, as the user lost his password! Did I miss a setting or did I misunderstood the functionality???
    Best regards,
    Christian

    Hi Christian,
    sure this authentication depends on the "Authentication" configuration, but I wouldn't change this data source as you probably had a reason for choosing a SAP system as data source.
    Following things I figured:
    - setting the Self-Service to "SAP HR" and configuring the "Disable Verification" to "Password Self-Service" will do exactly what you need: no authentication needed but verification by HR info types. This extra logon before the verification can be disabled like it was in 5.2
    Unfortunately you will need an HR system with data configured for all users using PSS
    - setting Self-Service to "Challenge Response", by setting the "Disable Verification" to "None" you can disable the questions but NOT the initial logon
    I can't really figure why this is working the opposite way for both types of password self-service. Let me know if you find a nice solution. Or did you open an OSS?
    Regards,
    Daniela

  • GRC CUP: Password Self Service Problem

    Hi Friends,
    We are working on GRC 5.3 SP16.
    Recently one of the users experienced a peculiar problem while submitting request for resetting the password for his user id. We have defined 2 systems in the CUP in the following way:
    1. ABC_100 (ABC being the system number and 100 being the client number)
    2. ABC_200(ABC being the system number and 200 being the client number)
    So when a user selected both of the systems to reset the password for his id in both the clients, he got the below error message:
    Password reset for the system(s):
    ABC_100: A notification mail with new password has been sent to mnopq_at_xyx.com
    Connection failed with system: ABC_200
    I have checked the JCO connections for that system and clients and working fine and also checked the connectors in the "Configuraiton" tab of CUP. This is also fine.
    Has anybody faced such problem? If so, can you please help me moving in the right direction to solve this problem?
    Regards,
    Faisal

    Hello Faisal,
    Simon was talking about authorizations for communication user you have for that JCo connector. It should have full auth. objects S_USER_AGR, S_USER_AUT, S_USER_GRP, S_USER_PRO, S_USER_SAS, S_USER_SYS. This user is making all provisioning in a backend system.
    Could not be the problem in the client number?
    Password reset for the system(s):
    ABC_100: A notification mail with new password has been sent to mnopq_at_xyx.com
    Connection failed with system: ABC_200
    You are requesting password for client 100 but the error is for client 200.
    Have you checked that you have correct client number in all those JCo connectors (VIRSAXSR3..., ABC_100) and in the connector configured in CUP?
    Regards
    Pavel

  • GRC CUP 5.3 SP16.3 -Password self service limit

    Hello Experts,
    We came across the issue when integrating Password Self Service(PSS) via challenge response to ask users to answer 2 security questions that they self register the answers to. We noticed that users can even put only one character value in the answers to the security questions, and it accepts it and sends the user the re-set password info to re-log in to the sap backend system via email.
    But this is not good bc the security answers should be at least a certain character length with a mixture of upper case ,lower case or numbers..but at least give us the capability to not allow one character answers for the challenge response questions. Is there any1 else who has also faced these issues and know if SAP provided any SAP notes or something to fix the issue. Otherwise, this is not secure enough to reset passwords via one character answers to the challenge response questions.
    Thanks and Regards,
    A

    So, SAP stated that functionality is not available as of right now and to send an enhancement request. I'm surprised they didn't think of this when configuring PSS to ensure the challenge response questions would be well protected and would require at least min character length, etc..

  • CUP v5.3 - Password Self Service - HR Fields Out or Order

    Hello everyone,
    I have set up Password Self Service in CUP v5.3 for SAP HR.  In the Configuration --> Self Service, I have created a few Infotype/Subtype entries.  When I go to reset a test user ID's password, the Infotype/Subtype fields appear in a different order than the order in which they are configured in CUP. 
    What's worse is that even one of the Infotypes is separated from itself by another Infotype/Subtype.  For instance, we are testing using IT0009 Bank Details with two Fields: Bank Key and Bank Account Number.  Even though I cofigured these two fields to be one after another, the logon screen has them separated by one of the other Infotype/Subtype options.
    There doesn't seem to be any logic in the way that the system has adjust the sequence.  It's not in alphabetical order, not in numberical order by Infotype, and more importantly, not in the order that I configured them.  This will make it very confusing for the users, which of course, defeats the purpose.
    Any insight into this?
    Thank you!
    Johonna

    Hello Simon,
    That's what I thought was happening at first, but it doesn't appear so.  It's not going my the text, technical name , or number for the Infotype, Subtype, or Field Name.  What's even stranger  ... I deleted them all, then recreated them in the same order that I did the first time, and not only did it not come up in the right sequence, the sequence was different than the first time!  Both created the same, both resulted in an incorrect sequence, and yet both came out different!
    Even though they are standard HR fields, I might try creating custom versions so that I can force the sequence with the Z01, Z02 naming convention like you did.
    Thank you!
    Johonna

  • Compliant user provisioning configuration done but can't create new request

    Hi All,
    We have upgraded our system from GRC 5.2 to GRC 5.3.
    Then we have done all the configuration for Risk analysis (CC) and then we have completed the configuration for Compliant user provisioning(Access enforcer) but now when we are going to create the request it is saying the request canniot be created.
    THe request passes through all the steps it is successful at Risk anlysis step also.
    But at the last step when we go to submit the Request this error comes.
    I have looked at the logs present in : Monitoring :--> System log.    I could not find anything.
    Am i looking at wrong place for logs. ?
    Is there any issue with the configuration.. Because the requests was successfully created when in GRC 5.2.
    Can anybody help me. ?

    Rajesh-
    Since 5.3 is in the ramp-up phase, you can contact SAP directly and they will resolve your problem very quickly, since they will be releasing it to all clients in October.
    And I am assuming you are working with SAP directly right now, since you have upgraded to 5.3, right?...
    Ankur
    GRC Consultant

  • CUP 5.3 Password-Self-Service SP9

    Hello all,
    since CUP 5.3 SP09, the Password-Self-Service has complety changed.
    You need to Login to the System before you can reset the password. The Authentication System is linked to the UME, which is connected to an SAP-System where all approvers have a User.
    The PSS is used by all our SAP-Users, not only approvers. So, not all Users have a UserID in the UME.
    -> From SP 09, the PSS is not working anymore for most of our users, since a Login to use the PSS is needed.
    Due to different errors, we had to patch the system now to SP14.
    We have activated SSO as recommended in note 1451616 does not help as not all Users have access to our UME.
    Does anyone has similar problems / experiences? And an idea for a workaround?
    Thanks a lot
    Marco

    Hello Kristian,
    unfortunatly thats not possible, because the UserIDs in the SAP-Systems are different (we are using personnel-number).
    So, regular CUP-requests could not be approved any longer as the approvers have to login with their personnel-ID to approve the requests pending. The LineManager-approver ID is getting read from HR.
    It is not possible to choose different UserDataSource to Login for PSS and approvals. And in the new PSS-Version, you can only reset the password for the ID you are logged in.
    thanks
    Marco

  • Password Self Service - User receive new Password Email - But link empty

    With Password Self Service we sometimes have users that get the Email with the link.
    But when they open the link it is just an empty page.
    (as if it has been opened before or the password show time has passed)
    Have anyone had this issue?
    Thank you

    Hi Kristian,
    guess you talk about AC 5.3.
    Please check in CUP -> Configuration -> Workflow -> SMTP if you have configured some application url.
    If not, are you using SSL or SSO, there might be an issue then.
    Best,
    Frank

  • Compliant User Provisioning implementation

    What would you say is the amount of time it would take to implement CUP, in the simplest way possible?  In other words, barring unforeseen circumstances, and with the simplest workflows, how long would it take?
    Thanks a lot ...
    Santosh

    Hi Santosh
    I hope you have RAR installed in your system.
    To implement CUP you can follow the plan below,
    1. Compliant User Provisioning Implementation          14 days
    2  Complete AE Pre-Implementation Checklist          1 day
    3. Deploy and install AE on NW                    1 day
    4. Perform AE post -installation configuration and connectivity     1 day
    5. Perform AE issue resolution                    1 day
    6. Discussion & Configuration of Test workflows          7 days
    7. Run end to end request scenario testing for each workflow path     3 days
    It is upto your project resource allocation and working hours to minimise the task ASAP.
    Regards,
    Sudip.

  • SAP GRC AC 5.3 (CUP) connecting to module of R/3 (HR)

    Hello,
    I have a problem.
    I want to monitor from the SAP GRC AC 5.3 (CUP) some event or activation or trigger when someone create or does some modificaction to an employee from the module HR. Maybe from the Tcode PA20, AP30 or PA40.
    IS there a "how to" or a manual to configure this from the SAP GRC AC 5.3?
    Thank you in advance
    Best Regards...
    Pablo Mortera.

    Pablo,
       I am not clear on what exactly you want but as far as I know there is no monitoring capability in CUP. If you want to monitor something, you will have to write your own Java code (for CUP front-end) or ABAP code (SAP back-end) to access particular database tables.
    Regards,
    Alpesh

  • CUP 5.3. Password Self Service description+sequence

    Hi together,
    where is it possible to chance the password self service description? The description appears on the "request access"-screen. Every requesttype can be changed in the configuration but not the password self service. Also it isn't possible to change the sequence...
    Is this correct? Or is there a other possibility I didn't notice?
    Thanks & Best Regards
    Alexa

    Hi,
    we are on SP8 but we will upgrade to SP09 in the next weeks...
    I need to change the desciption because of different language requirements for different users. Because the requestors aren't in the UME we can't make varieties in the language with the login. We enter the requesttypes in two languages in the description field. So that all requestors understand the different types. But this isn't possible for the password-self-service, because there is no configuration for the description.
    Perhaps my question will be solved with SP09
    Thanks.
    Alexa

  • Password self service in AC10

    What is the procedure to roll out Password self service in a 1000+ company.  Does it means all the backend system users has to be copied to GRC Production system to use this feature.
    If the user wants to reset his password, is it necessarily to login with GRC Password first into GRC and than reset the backend password. If this is the case, than there are less chances that users will remember his GRC password to login into it to reset the password.

    A user shouldn't need access to the GRC box itself to use PSS.
    Look at the PSS configuration under SPRO->GRC->AC->User Provisioning->Maintain PSS
    You can set the authentication source for a user attempting to leverage the PSS feature. You can use the Challenge Questions themselves or another HR system.   Also, under that same IMG tree, you will also need to ensure your End User Logon URL is activated and setup properly. This would be the URL individuals would use to access the basic AC features (creating requests, PSS, etc) whom do not have AC accounts themselves.
    The key design decisions will be where you will be storing a user's challenge questions and how you will ensure they have their answers registered (ideally part of their onboarding) so that they can use the PSS tool.

  • GRC5.2 password self service

    Hi Guys,
    We plan to start with GRC5.2 with our backend system not having any HR module. However, we do have Travel Expenses setup with relationship of a user mini master.
    I understood that in 5.2 Access Enforcer, the password self-service requires infotype (data container), subtype, field and description, from the SAP HR. Can these info also be obtain from a user mini master?
    Can I setup the password self service even without HR module (only mini master is setup) within my backend system?
    Thanks.
    Raymond

    Hi Naveen and Amol,
    I did checked on the Quick Reference guide and also have a look into the transaction invoved. When I checked on the transaction code (PRMM) for the user mini master, it looks the same as that in transaction PA30 (from the guide).  So, theoritically the info from the mini master does looks/match the same as that of the needed info from the HR master records.
    I cannot confirm totally on my above statement and was hoping that someone who have tried it to share the experience or is able to guide me with the password self service in 5.2AE.
    Thanks Guys..I do welcome more info or advises I can get as it does link critically on the version of GRC AC that the company has decide to implement and password self service is one of the selling point.
    P.S: Hi JBS, sry but your links are either not working or pointing to the wrong info.
    Thanks.
    Raymond

  • Password Self Service

    Friends,
    We are trying to implement password self service for SAP, AD and Non-SAP systems. The installation and post configuration is complete.
    The dispatchers are defined and running sucessfully and the task for Password Reset  is defined. The problem is the password reset task/job is not running or picked up by the dispatcher, its always in idle mode. The job logs are also empty.
    Are we missing something....we are new to IDM and running 7.1
    Regards,
    Muthu Kumaran KG

    Matt,
    Here is the requirement.,
    - Password self service for multiple SAP systems and AD
    - Password Synchronisation between AD's
    Right now I'm trying to configure the PSS. Followed the SAP document and created tasks for password reset, edit authentication questions and password reset failed.
    The users will register their authentication questions (http://<server>:port/idm) and after that they do self service (http://<sercer>:port/idm/pwdreset) by answering those questions.
    Thanks.
    Regards,
    Muthu Kumaran KG

Maybe you are looking for

  • COPA Re-alignment fro new value field

    Hi, I would like to know if the COPA realignment would popolate the values for a new value field for the past transactions. Regards Venkata Devaraj

  • CSS shorthand background problem

    Like many of you I'm sure, I prefer to write shorthand CSS. In Preferences I have shorthand checked for all five options and "When editing CSS rules" set to "According to settings above." However when I try to write a shorthand background rule it doe

  • Parallel Approval in Self Servie HR (SSHR)

    Hi All, We have a requirement in which we need to send approval to multiple people at once. And if any approver approves the transaction, it should be considered approved and should not require any further approvals. According to the metalink note 47

  • SQL*NET SESSION의 DEAD CONNECTION 처리 방법

    제품 : SQL*NET 작성날짜 : 1996-04-03 SQL*NET SESSION의 DEAD CONNECTION 처리 방법 ========================================== server에서 수행 중이던 프로그램이 비정상 종료한 경우에는 오라클의 smon이 자동으로 detection하여 수행 중이던 transaction을 rollback하여 정리하여 준다. 그러나, Client Server 환경에서 PC를 Client

  • Foxfire crashes when i try to print any page from the web site

    foxfire crashes when i try to print and page ie my ncis(firearm), bank statement even if do a print page