Trail of role changes

Hi All,
Is there any way for gettting information on changes to user association with roles. I would like to build trail on these changes.

Jeremy,
I know V12 will user NW UME.
But this is the requirement currently i have.
I could find xml file which will store list of users associated with particular role, but I need to configure an event for role changes so that I could read these xml file for changes.
Also, when I look in to xml file I could see last modified date in the encoded form.
Is it possible to get these info programmatically???

Similar Messages

Portal favorites doesn't work after role change

Dear all,
we encounter the following problem in our EP:
We have an WAD-Template stored in a folder. If a user is assigned to a specific portal role, he can see and execute the report. While executing he is allowed to store the report in his personal portal favorites.
Last week we joined three old portal roles (names: OLD_A, OLD_B and OLD_C) to a new one NEW_A containing all reports of OLD_A, OLD_B and OLD_C. After that we assigned the new role NEW_A to all users formerly assigned to at least one of OLD_A, OLD_B or OLD_C. In addition we unassigned the users from the old roles.
As a consequence the users now see all the reports of the old roles in their portal menu (as they are stored now in NEW_A) BUT the old favorites saved before the role change could not be opened anymore. The following error message appears:
"Page not found or not available"
We found out so far, that the favorite stores the combination of role and iview (in this case OLD_A and the iview-name). If the role changes the pcd-link is different.
Does anyone know this behaviour? How can we change the access pcd-link in the content management manually or by script/program?
Any help is appreciated.
Best regards,
Volker Schmitt

Yes I saw this thread too. However, I think viveknidhi solution is pointless for us since we can not perform this operation manualy for each favorite...
For the moment, based on what I red on forums and sap documentations, there is no workaround. Portal favorites are hardcoded pcd urls to the navigation node. If we modify our roles we will loose related favorites since the navigation node will change.
I hope you will find a solution to move forward.
Regards,
Alexis M.

SUIM - Track Role Changes Please Help

Dear Friends,
I want to know is there anyway or any report that track the changes done to a role for last 3 months - addition/deletion of tcode and Auth. Object Values Changes and when it was changed. I used SUIM (All Change Documents (Technical View). All I want to know is Any report or Program that tells me Role changes happened in last 2 months (for examples 3 tcodes were added and activity values have changed in some objects).
It gave the info like Role Name, Date, Time, Changes by, TCode, Change ID, Table, Short Text, Table Key. I Think Table key is having some information. I am not able to understand table key 500xxxx.L325P                    TYREEWL     2006011899991231
This information is not useful as it does not give any track changes. SUIM is good to find out what changes were made to a User, BUT when it comes to Track Role Changes, it does NOT give much information. We can also do some table search on AGR and UST* tables to get this information, but it is tedious to go to so Many tables and find out.
Your help is greatly appreciated. If this is not a right forum, it would of great help if you can forward this to the right forum.
Thanks
Kumar
Below is what i found out.
xxxx.L325P     03/06/2006     18:00:18     FF_SECURITY     SU01     D     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    TYREEWL     2006011899991231
xxxx.L325P     03/06/2006     18:00:18     FF_SECURITY     SU01     D     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    TYREEWL     2006012499991231
xxxx.L325P     03/06/2006     18:00:18     FF_SECURITY     SU01     I     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    TYREEWL     2006030699991231
xxxx.L325P     03/06/2006     18:00:19     FF_SECURITY     SU01     D     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    MASTERD     2006011899991231
xxxx.L325P     03/06/2006     18:00:19     FF_SECURITY     SU01     D     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    MASTERD     2006012499991231
xxxx.L325P     03/06/2006     18:00:19     FF_SECURITY     SU01     I     AGR_USERS     Assignment of roles to users     500xxxx.L325P                    MASTERD     2006030699991231

No it does not give any valuable information. for example, if the role was changed 17 times in last 2 months - added 4 new tcodes and deleted 7 tcodes and changes some activity values. when i did search on SUIM change documents, it gives me Table Key and some fields. I appreciate if you take a look at this issue. it gives me when it was changed, by whom and and also thru which tcode it was changed. But Never gave what Actually happened to the role in the last 1 month.
SUIM is good for user maintenance and tells us the basic role information. any ideas are suggested.
thanks
kumar

Which all TABLES are afftected when we CANCEL a ROLE change in PCFG

Hi,
When we try to change any ROLE using PCFG transaction,which all Function Modules are called and what all tables are affected.
Also please let me know , while cancelling the changes made on that ROLE which all Function Modules and Tables are affected

Hello Avinash,
The Tables that get affected by changes can be traced in ST05.
Go to ST05. Activate Trace.
Perfrom the changes in PFCG, Save the changes.
Now got to ST05, Deactivate the trace and Display the Trace.
You can check all the efected tables and so on in the log.
Genearlly all Role changes are saved in AGR* tables...
Hopefully this info shd help.
br,
Sri
Award points for helpful answers

Report to view composite and master role changes

Dear All,
i would like to know list of master role and composite role changes, i searched in SUIM for change document for roles,which gives all role changes, which is not solving the pupose.my requirement is past perticular period any composite role got changed and new tcode got added to master role

ramesh,
try SUIM-change document -> For roles / or reports
Role:    RSSCD100_PFCG
for User         (RSUSR100)
A profile    ( RSUSR101)
An authorization (RSUSR102)
A role assignment (RSSCD100_PFCG)
just wanted to let you know that SAP meanwhile developed a new report RSUSR100N. I think it's only available with a certain SP level (at least in ECC 5.0).
Thanks
sri

How to track role change

We have several groups making changes to roles in our portal. Is there a way to track roles changes and where can I find this information.
We have several plants and portal admins at each site making changes to "shared roles". I need to track these changes.
Thanks
Mikie

How do you transport the roles and groups?
You should have a development and a test portal.
You should also look into the Netweaver Developer Infrastructure.
This should give you some help on tracking the changes!
You should also set up your authorizations for your admins so that they cannot change the "shared roles".
Check the portal security guide at:
http://help.sap.com/saphelp_nw04/helpdata/en/5c/429f00a14aa54195b1c63ae1512d10/frameset.htm
Regards
Fredrik

Advice needed: what does your company log for SAP security role changes?

My client has a situation where for many years, they never logged changes to SAP security roles. By that I mean, they never logged even basic details, like who requested a change, tested it, approved it, and what changed!! Sadly their ticketing system is terrible, completely free-form text and not even searchable.
Does anyone here use Word docs, Excel sheets, or some other way to capture security role change details? What details do you capture? What about Projects, that involve dozens of changes and testing over several months?
I plan to recommend, at least, they need to use a unique# (a ticket#, or whatever) for every change and update the same in PFCG role desc tab, plus in CTS description of transports... but what about other details, since they have a bad ticketing system? I spoke with internal audit and change Mgmnt "manager" about it, and they are clueless and will not make recommendations. It's really weird but they will get into big trouble eventually without any logs for security changes!

Does anyone here use Word docs, Excel sheets, or some other way to capture security role change details? What details do you capture? What about Projects, that involve dozens of changes and testing over several months?
I have questions:
a) Do you want to make things straight
b) Do you want to implement a versioning mechanism
c) You cannot implement anything technical, but you`re asking about best "paper" practise?
The mentioned scenarios can be well maintained if you use SAP GRC Solutions 10 (Business Role Management)
Task Based, Approvals, Risk Analysis, SOD and role generation and maintenance in a structured way (Business Role Management). Workflow based, staged process with approvals.
PFCG transaction usage will be curtailed to minimum if implemented fully.
Do we really want to do things "outside" PFCG?
@all:
a) do you guys use custom approval workflows for roles?
b) how tight your processes are? how much paperwork, workflow, tickets, requests and incidents you have to go through to change a role?
c) who is a friend of GRC here, raise your hand
Cheers Otto
p.s.: very interesting discussion, I would like to learn something here about how it works out there in the wild

CUA : SU01 role change

Hello friends,
I am developing a report in Sending system, based on role change information for user id. We configued CUA correctly and everything is working fine.
Is there any table or funciton module or report which shows Role modification history with timestamp for a user in Sending system.
Lets say if i change a user's role in SU01 roles tab in sending sytem, i can only find role modified date but i am unable to find time when was modified.
thanks.
Macs

Hi,
Tables USL04, USLA04, USZBVSYS gives changed date information only. But i am looking at time information.
Table USZBVSYS contains all information for whatever you change in SU01. So i dont know whether role has been changed or user data has been changed.
Table AGR_USERS gives date and time but it is only for local systems. In CUA sender system, user can have roles for different systems. So, i need to get information from the sender system about what roles has been changed with Date Time.
It would be too good for me to share any ideas if you have.
thanks,
Macs

Advise on Role Change of Functional Consultant to IS U Consultant

Hi,
I'm currently working as SD/MM Consultant with cross functional modules as team lead. I want an advise from the experts that can i change my current role to IS U consultant. What will be the pros and conss. Suggest me for which part of IS U will be suitable for me.
Request you post your suggestions.
Regards
Sashikanth

Hi Siva,
Thanks for your reply. Can you give me some more inputs like a)current opportunities across the globe, b)certification details, c) future assumptions about IS U market, d) any trainings institutes etc.
I'm currently working for CMMI Level5 company in India.
I hope this will give more insight about the decision for role change.
Thanks
Sashikanth

Role change re-authorisation

Hi
We are looking for following solution using ORM(Oracle Role Manager)
Can anybody help us on how to achieve the following requirement,
Role change re-authorisation
Ability to add additional authorisation or authentication requirements to specific roles
e.g. if a user wish to change role within an application which is of higher privilege then prompt for authorisation.
Any help will be highly apprecaited.
Regards

Hi,
Using T-Code SUIM you can find the information regarding roles.
Change Documents
->For Roles
Role Name *
From date Enter the date from which you want to see the changes
In change Documents
Choose
. Create and Delete Roles
I hope you are looking for this.
Regards,
Archna

Bug: Role changes show up as blank messages

When anyone in a call (at least P2P calls), change roles, including role changes that normally don't show up publically on Desktop Skype, the android version shows an empty chat message from the user that is changing roles. I have several people reproducing this.

Well its back to using Outlook for professional and Mac mail for leisure purposes untill this problem is resolved.
I would still appreciate a response if and when there is a solution to this problem as I still want to revert to Mac mail.
Regards.

Regarding Client Role change in DEV system.

Hi All,
I had some requirement from SapHR they want to do some Holiday calender changes in Sap Level.
and we have only Test Role client in our Dev System. They want me to change the Client Role from Test to Customizing Client.
Kindly let me know if Client Role is changes from TEST to CUSTOMIZING. is there any inconsistany in TMS.
Thanks,
Abdul

Hi,
Run BDLS to change the source system assn. Then check to see if all your transfer structures are active and also your source system is now the correct one. Easiest way is to goto RSA7 on the src system and see where the system is pointing to.
Cheers,
Kedar

Script or Program for massive role changes

Hi,
does anybody know some script to execute massive changes in SAP ROLE??
Ciao

You can try a bash script. Example: This one converts wav to mp3:
#!/bin/bash
for i in "$@" ; do
lame --r3mix "$i" "`basename "$i" .wav `.mp3"
done
./wav2mp3.sh *.wav
will convert all wav in the current directory to mp3. You can change the lame line if you have other formats.

System role change in Sol Man

Dear friends,
I am working with Solution Manger 4.0. In Solar01, in top menu option, under "Business Blueprint", we are having option to change the "System role".
I wants to restrict this option based on the user ID. Because, now everybody logins to different systems (means DEV,QA,PRD) by changing the system role.
How to restrict this option?
Thanks
Senthil

Hello Sentil,
The functionality you are looking for is not available.
However, you may consider the following to achieve a similar result:
In SOLAR_PROJECT_ADMIN of the respective project, tab System Landscape, sub tab Systems there is a button calls System Landscape Assignment via which you can project specifically hide certain system roles. So for instance if during business blueprinting you only need the evaluation and development systems, you can hide the system roles which are not required at that point of time, such as QA and PRD. The result: Project team members working on SOLAR01 and SOLAR02 for instance can only see the roles which have been defined in SOLAR_PROJECT_ADMIN.
At a later project stage you can then add QA and PRD if required simply by adding the respective system roles again. The information on system-clients assigned is simply retrieved from the system landscape maintenance (SMSY transaction), where this information still resides.
So this might be an alternative to your suggestion (system roles based on user ID) because in this way you have control of offering system roles and, thus, the respective systems project-phase-dependently.
Best regards,
Doreen

Role Change in R/3 not updating in CRM

Dear Experts,
We have replicated Customers from R/3 to CRM Successfully.
But according to Business Process, if the role a customer Change from Prospect to Sold-To in R/3 the change is not replicating to CRM. In fact the Role remain same as Prospect in CRM.
Kindly advise me, how can I change the process.
Srujan

Dear Rekha,
I have verified but No issues in PIDE, looks everything is fine.
Account Groups 0001 to 0005 were asssigned to Classification B.
But initially when I started replicating customers all the roles were created as Sold-to-Party in CRM irrespective of their role in R/3. We have applied Note: 914437. Since then the issue got resolved.
Pls suggest me in this regard.
Srujan

Trail of role changes

Similar Messages

Maybe you are looking for