Stable API's for GRC 2010 - simulation function needed

Question

Dear gurus,
I have an ABAP application I want to integrate with GRC 2010 (on the ABAP stack). I understand this is ramp-up and not all API's are available yet, but need one which is pretty basic so was hoping it would exist with documentation and is released.
My intention:
1) The user with various authorizations already exists.
2) My application wants to generate an additional role for the user because they are missing some auths during testing of the roles.
3) Each authorization generated should call the GRC API to simulate whether this would cause an SOD for the user.
4) I will generate and assign anyway, but export those authorizations for which SOD warning messages were raised.
5) Messages are logged for rework / mitigation, but the role build and test can continue.
Is there any documented API with a stable interface for a function which returns messages based information for SOD's which can be reacted to for an existing user and all their ABAP authorization object based auths AND a simulation of whether authorization data sent to it would produce an SOD.
Plan B would be to generate the role and simulate the assignment and return messages of which auths in the role caused the SOD.
I would expect that GRC is open minded enough to release such APIs to the ruleset , but if I am mistaken then "show stopper" answers are also appreciated as being a lesser evil...
Cheers,
Julius

Answer 1

Thanks Supreet,
I know that GRC can do an SOD check and also simulation of an SOD check "as if" the user had an additional role (which you want to assign but know in advance whether that will cause an SOD conflict). In it's previous life on the ABAP stack it was known as "Risk Rerminator". I am aware of the "old" /VIRSA/ function modules and the coding technique they used.... but have some doubts that GRC 2010 still uses those nor the same approach, which is why I am looking for a stable API.
My application makes the assumption that GRC is already installed and wants to generate a role for a user based on a test case they are executing. In my UI where the trace data is being analyzed, I want to add some intuitive highlighting and warnings for SOD conflicts which would happen if the role were generated and assigned.
At this ponit in time, the role does not actually exist yet so ideally I would want to send the API the authorization data and not just the role name. I could however for simplicity sake generate the role anyway but need at least the API to tell me which authorizations in the role are causing the SoD conflict with the user's already existing authorizations.
I am very much hoping to find something like a BAPI_GRC_SIMULATE_SOD which is documented and stable and offers an import parameter with a structure something like this for the authorization data:
OBJECT                         CHARACTER       10
LFDNR                          NUMC            3
FIELD                          CHARACTER       10
LOW                            CHARACTER       40
HIGH                           CHARACTER       40
MODIFIER                       CHARACTER       12
MODDATE                        DATE
MODTIME                        TIME
... together with the user name of course, and then returns SOD warnings per OBJECT and LFDNR (which is just a sequencial number for the authorization instance).
Of course it only works if GRC is installed....
Cheers,
Julius
Edited by: Julius Bussche on Jan 27, 2011 7:56 AM