TRANSPORT FOR A ROLE

Hi all,
when we create a role , does it ask for a crequest.
i created a object class and object under a request thats under a workbench request.
when i crreated a role and assigned the same object to the role, IT NEVER ASKED FOR A REQUEST.
CAN ANYONE TELL ME AS TO HOW I TRANSFER THE ROLE FROM DEV TO QUALITY
THANKS
VENKI

Hello all,
can anyone tell me how to make this thread as a question,so that i can award points.
my question is doesn't it ask for arequest when your creating a role in the first instance.
It didnot asked for any request when i gave a name and click create and saved after giving description.
i don't know whether its saving as a local object or under a request.
let me know
thanks
venki

Similar Messages

How to track the transport request number for the Role/Composit Role

Hi,
How to track the transport request number for the Role/Composit Role.
Thanks,
Ravi

Use transaction SE03 Transport Organizer Tools
Execute "Search for Objects in Requests/Tasks" with objects of types:
R3TR ACGR Role
R3TR ACGT Role - User assignment
Regards

Transport Release frequency for Authorization Roles

Hi,
At my present customer all system changes are transported via release management. The current frequency of releases is 2 times a year. This includes SAP support packages, customizing, abap AND authorization roles.
Now I would like to establish a different, quicker release 'speed' for authorization roles only (f.i. once a week).
I already motivated my request with many reasons (role changes can be considered as master data changes; the lack of speed leeds to insecure 'workarounds'; role management issues are 'redesigned' to user management issues; etc.) but what I am still looking for are reference documents, best practices, audit reports in which the same advise is described.
Could you please help me with my quest?
Thank you!
Kind regards,
Lodewijk

Hi Lodewijk,
I agree, that is is useful to define a specific schedule for transporting roles in oposite to the schedule for updating the software, however, I do not have a document described some best practise. Anyway, the following link may help you to convince the management, that you can setup a process including 4-eyes checks on the transports:
[TMS Quality Assurance|http://help.sap.com/saphelp_nw70ehp2/helpdata/en/9c/a544c6c57111d2b438006094b9ea64/frameset.htm]
Using this process you would accept transports only which cointains roles (R3TR ACGR...).
Kind regards
Frank

Disable an Authorisation object for Multiple roles.

Hi ,
I need to Disable an authorisation object F_BKPF_BUP for about 345 roles.Is there any way by which we can make mass changes.Doing it for individual role would take a lot of time.kindly advice.
Thanks in advance

Hi,
1. Go to SE16 --> table USOBT_C --> put object F_BKPF_BUP in the field "Object" --> execute without restriction. Download the list of TCodes.
Now go to Table AGR_TCODES --> put the list of TCodes (found with above method) in the field "Extended name" as multiple selection --> execute and download the list of roles.
Look up your list of 345 roles with this list. After matching, you need to sort out the TCodes present in this list of roles which is checking the object F_BKPF_BUP.
2. Now go to SU24.. go to option "Authorization Object" and NOT in the Transaction section.
Put the Object and execute.... go to change mode.... check the proposals for the TCodes you sorted at last step of point 1. Make the proposal Do Not Check where ever it is not so.
Move the Workbench Transport through Landscape. Your purpose will be done. But you should also keep in mind if the TCodes are present in other roles besides of your 345, those will become vulnerable.
Regards,
Dipanjan

Query regarding transporting deletion of roles

Hi,
When I delete a role in dev, in order to make the deletion effective across the landscape I need to put it in a transport request.
If I don't do that, and instead create a new role in dev by the same name as the one that was deleted, and then I transport this new role, will the new role overwrite the old one in the quality and production systems?
Or am I first required to transport the deletion, and then transport the newly created role ( by the same name)?
Thank you.

hii
This is little critical and tricky but you know whenever u do any modifcation with the role like deleting a role or creating a role the best pratice is to put in the transport request so that this request can be transported throughout the landscape .........
As per u r question dear u have created role in the development that role is already their in prd system with profile attached to it if u delete in dev and try to create the role with same name in dev again that role might not be deleted till u transport the new role frm dev to prd but their might be inconsisentcy with the new role which u have created as their might be cofusion with the two profiles the new profile and the old profile in prd server if u send the delete transport request frm dev to prd for the role which was their in the prd server the old role and profile will be lost so when u create a new role and transport it frm dev to prd their might be no inconsistency between the old profile and new profile,,,,,,,,,,,,,
takecare

Can I create a transport for CRMC_UI_PROFILE + CRMC_UI_NBLINKS?.

For transactions CRMC_UI_PROFILE, CRMC_UI_NBLINKS (Nav bar profile) and PFCG there is an option under Edit called 'Transport'. Can I assume that this allows me to transport all objects for a particular business role (CRMC_UI_PROFILE) or Navigation Bar (CRMC_UI_NBLINKS) or for the authorisations (PFCG)?.
I was conscious that after changes made in these transactions that I was not asked for a transport request.
Is it good practice to create a transport for these, or do they need to be manually entered into each system (DEV,QAS, PRD etc.)
On another subject, does anyone know where I can source the CRM 7, or CRM 2007 cookbook for the Interaction Centre?
I have tried countless links, have entered my S000... number and got in only to find no document. Is there a link that will DEFINATELY get me to the cookbook(s)?.
Jason

Guys,
I'm reasonably new to the functional area and would like to ensure that I know how to get these changes into our CAQ/PRD environment when the times comes. Hence my questions regarding whether we can force the changed objects into a transport.
If anyone has done this and knows whether it works I would dearly like to hear from you.
with regards
Jason

Transport for BI Web

Hi Guru:
I created some roles in the portal for my BI reports and already include my reports in it.
My question is how to transport the portal role/workset/folders?
thanks.
Eric

hi,
chk the link whether useful
Transporting Roles:
http://help.sap.com/saphelp_nw2004s/helpdata/en/b5/9f1b5909d46c4f9f1dff5d8c308a5f/frameset.htm
Ramesh

Can we have multiple transports for the same object.

Hi guys,
Can we have multiple transports for same object in dev system. Can anyone tell me how can this be done.
Thanks

Its not possible for the same development object. Only 1 person can access an object at a time and if mutiple users modify an object new TASKs are created under the same TRANSPORT.
Only after releasing the tr you can create a new tr on the same object.
Message was edited by:
Abhishek Jolly

Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER]

SCCM 2012 has been successfully installed on the server:
SRVSCCM.
The database is on SQL Server 2008 R2 SP1 CU6 Failover Cluster (CLS-SQL4\MSSQLSERVER04)
Cluster nodes: SQL01 and SQL01. On all nodes made necessary the Security Setup of SCCM. No errors and warning on SCCM Monitoring.
The cluster service is running on the account: sqlclusteruser
The account has the appropriate SPN are registered:
setspn -L domain\sqlclusteruser
Registered ServicePrincipalNames for CN=SQL Cluster,OU=SQL,OU=Users special,OU=MAIN,DC=domain,DC=local:
MSSQLSvc/CLS-SQL4
MSSQLSvc/CLS-SQL4.domain.local
MSSQLSvc/CLS-SQL4:11434
MSSQLSvc/CLS-SQL4.domain.local:11434
After some time on the cluster hosts every day started appearing new folders with files inside:
srvboot.exe
srvboot.ini
srvboot.log
srvboot.log contains the following information:
SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER started.
Microsoft System Center 2012 Configuration Manager v5.00 (Build 7711)
Copyright (C) 2011 Microsoft Corp.
Command line: "SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER CAS K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8 /importcertificate SOFTWARE\MicrosoftCertBootStrap\ SMS_SQL_SERVER".
Set current directory to K:\SMS_SRVSCCM.domain.local_SMS_SQL_SERVER8.
Site server: SRVSCCM.domain.local_SMS_SQL_SERVER.
Importing machine self-signed certificate for site role [SMS_SQL_SERVER] on Server [SQL01]...
Failed to retrieve SQL Server service account.
Bootstrap operation failed: Failed to create machine self-signed certificate for site role [SMS_SQL_SERVER].
Disconnecting from Site Server.
SMS_SERVER_BOOTSTRAP_SRVSCCM.domain.local_SMS_SQL_SERVER stopped.

The site server is trying to install the sms_backup agent on the SQL Server Cluster nodes.
Without successfull bootstrap the siteserver backup is not able to run successfully.
Try grant everyone the read permisson on
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS on the SQL server nodes.
This worked for me.
After that a Folder named "SMS_<SITESERVER-FQDN>" appeared on C: on the SQL Cluster nodes, and a "SMS_SITE_SQL_BACKUP_FQDN" Service should be installed.
After the new Folder is created and the new Service is installed, you can safely remove the bootstrap Service by opening a command prompt and enter:
sc delete "SMS_SERVER_BOOTSTRAP_FQDN-of-SiteServer_SMS_SQL_SERVER"

Link is not working for one role. how to check please guide.

Hi Expert,
I have a simple question but as don;t aware of some of the techincal area not able to understand where to check.
I have a link under document flow in offer( opportunity) where for one role sales support user the link is not happening. I have checked for other role its working fine.I understand that for this role the link will not work as per the role maintianed.
But where this link got maintained and how i will be able to check which link is tagged to which profile.
rolewise mappeing with link.
Please guide.
Prem.

Hello Prem,
Please check the navigation bar profile from your business role.
Then go to the navigation bar profile settings, you can find the details settings there.
If it is a link under some work center, you need to start from the work center.
If it is a direct link, then start from the derect link group.
Hope this could be helpful.
Best regards,
'Maggie

Account Creation - Badi for Default values for BP Role and Sales Area

Hi all,
my requirement regards the possibility to create a new prospect (a link should be available in the navigation bar or create section).
Logically, a bp role as "Prospect" and particoular sales area should be created automatically.
I created an implementation for the BADI definition "BADI_CRM_BP_UIU_DEFAULTS". But don't know how to create the default values for BP role and Sales area:
In my code
assign cr_me->('VIEW') to <lv_view_name>.
if sy-subrc ne 0.
exit.
endif.
lv_viewname = <lv_view_name>.
case lv_viewname.
when 'AccountDetails.htm'.
I obtain the viewname "AccountDetails" , the related context "Header". After I don't know how to proceed to obtain the related entities through the relationship BuilRolesRel and BuilSalesArrangementRel.
Am I following the right way? Is there another solution to prepare the output for default values?
Any kind of suggestion will be appreciated.
Regards, Roberto

go to spro>cross-application components>sap busines partner>business partner> basic settings>field groupings>Configure Field Attributes per BP Role
Double click the business role which you want to customaze (e.g. 'A') and change the proper settings.
Regards.

Transport for System Copy from RSA1 in BW 3.5

Hi Guys,
I am not able to create transport for Source system objects for system copy in RSA1.
I have copied the production system(BWP) to sandbox(BWQ) and want to connect to same source system.
According to note 886102 when creating transport for Source system objects I am getting following error.
You cannot use request BWQK900020
Object ISIP ZPAK_5FKMUFOSQPPRNYYDZV1U6A7W0 could not be saved to order
BWQK900020
This is stand alone system but for transports I have created virtual system. Before creating virtual system I am able to create transports. But now after creating virtual systems I am not able to get pass above errors.
Any help would be appreciated also with points.
regards,
Santosh

Hi,
Check the notes 140276 and 325470 to chart out a plan of action.
BR/
Mathew.

Problem creating Network ACL for a ROLE in Oracle 11gR2

According to Oracle Documentation when you create a new Network ACL you can add privileges to a user or role. I need to create a new ACL for the UTL_SMTP package for a specific role, but when I granted it the users who have that role are still getting the "ORA-24247: network access denied by access control list (ACL)" error when they try to send an email. If I grant the ACL privilege to the same users directly it works fine. Is there any step I'm missing? This is the test I have made on my Solaris 10 - Oracle 11gR2 (11.2.0.3) Standard Edition server:
SQL*Plus: Release 11.2.0.1.0 Production on Wed Aug 21 09:31:52 2013
Copyright (c) 1982, 2010, Oracle. All rights reserved.
SQL> CONNECT system/******@testdb
Connected.
SQL> SET LINES 1000
SQL> SELECT * FROM v$version;
BANNER
Oracle Database 11g Release 11.2.0.3.0 - 64bit Production
PL/SQL Release 11.2.0.3.0 - Production
CORE    11.2.0.3.0      Production
TNS for Solaris: Version 11.2.0.3.0 - Production
NLSRTL Version 11.2.0.3.0 - Production
SQL> COLUMN host FORMAT A20
SQL> COLUMN lower_port FORMAT 99999
SQL> COLUMN upper_port FORMAT 99999
SQL> COLUMN acl FORMAT A40
SQL> COLUMN acl FORMAT A40
SQL> COLUMN principal FORMAT A15
SQL> COLUMN privilege FORMAT A10
SQL> COLUMN is_grant FORMAT A8
SQL> COLUMN status FORMAT A10
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
no rows selected
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
no rows selected
SQL> CREATE USER testacl IDENTIFIED BY testacl;
User created.
SQL> GRANT CONNECT TO testacl;
Grant succeeded.
SQL>
SQL> BEGIN
2     dbms_network_acl_admin.create_acl('test_smtp.xml','TEST SMTP ACL','TESTACL',true,'connect');
3     dbms_network_acl_admin.assign_acl('test_smtp.xml','localhost',25);
4     commit;
5 END;
6 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
HOST                 LOWER_PORT UPPER_PORT ACL
localhost                    25         25 /sys/acls/test_smtp.xml
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
ACL                                      PRINCIPAL       PRIVILEGE IS_GRANT
/sys/acls/test_smtp.xml                  TESTACL         connect    true
After creating this ACL I test it like this:
SQL> CONNECT testacl/testacl@testdb
Connected.
SQL> SELECT host, lower_port, upper_port, privilege, status FROM user_network_acl_privileges;
HOST                 LOWER_PORT UPPER_PORT PRIVILEGE STATUS
localhost                    25         25 connect    GRANTED
SQL> DECLARE
2     c utl_smtp.connection;
3 BEGIN
4     c := utl_smtp.open_connection('localhost', 25); -- SMTP on port 25
5     utl_smtp.helo(c, 'localhost');
6     utl_smtp.mail(c, 'Oracle11.2');
7     utl_smtp.rcpt(c, '[email protected]');
8     utl_smtp.data(c,'From: Oracle'||utl_tcp.crlf||'To: [email protected]'||utl_tcp.crlf||'Subject: UTL_SMTP TEST'||utl_tcp.crlf||'');
9     utl_smtp.quit(c);
10 END;
11 /
PL/SQL procedure successfully completed.
SQL>
This works fine and I receive the email correctly. Now if I try to do the same thing for a role:
SQL> CONNECT system/******@testdb
Connected.
SQL> BEGIN
2     dbms_network_acl_admin.drop_acl('test_smtp.xml');
3     commit;
4 END;
5 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
no rows selected
SQL> CREATE ROLE testacl_role;
Role created.
SQL> GRANT testacl_role TO testacl;
Grant succeeded.
SQL> ALTER USER testacl DEFAULT ROLE ALL;
User altered.
SQL>
SQL> BEGIN
2     dbms_network_acl_admin.create_acl('test_smtp.xml','TEST SMTP ACL','TESTACL_ROLE',true,'connect');
3     dbms_network_acl_admin.assign_acl('test_smtp.xml','localhost',25);
4     commit;
5 END;
6 /
PL/SQL procedure successfully completed.
SQL> SELECT host, lower_port, upper_port, acl FROM dba_network_acls;
HOST                 LOWER_PORT UPPER_PORT ACL
localhost                    25         25 /sys/acls/test_smtp.xml
SQL> SELECT acl,principal,privilege,is_grant FROM dba_network_acl_privileges;
ACL                                      PRINCIPAL       PRIVILEGE IS_GRANT
/sys/acls/test_smtp.xml                  TESTACL_ROLE    connect    true
SQL>
And now I test it again with the same user:
SQL> CONNECT testacl/testacl@testdb
Connected.
SQL>
SQL> SELECT host, lower_port, upper_port, privilege, status FROM user_network_acl_privileges;
no rows selected
SQL> DECLARE
2     c utl_smtp.connection;
3 BEGIN
4     c := utl_smtp.open_connection('localhost', 25); -- SMTP on port 25
5     utl_smtp.helo(c, 'localhost');
6     utl_smtp.mail(c, 'Oracle11.2');
7     utl_smtp.rcpt(c, '[email protected]');
8     utl_smtp.data(c,'From: Oracle'||utl_tcp.crlf||'To: [email protected]'||utl_tcp.crlf||'Subject: UTL_SMTP TEST'||utl_tcp.crlf||'');
9     utl_smtp.quit(c);
10 END;
11 /
DECLARE
ERROR at line 1:
ORA-24247: network access denied by access control list (ACL)
ORA-06512: at "SYS.UTL_TCP", line 17
ORA-06512: at "SYS.UTL_TCP", line 267
ORA-06512: at "SYS.UTL_SMTP", line 161
ORA-06512: at "SYS.UTL_SMTP", line 197
ORA-06512: at line 4
SQL>
I'm aware that role privileges doesn't apply inside procedures, functions or packages by default, but this is an anonymous block so it should use the active roles for the user. I also tried adding a "dbms_session.set_role('TESTACL_ROLE');" at the beggining of the anonymous PL/SQL block but I got the same access error.
Thanks in advance for any help you can give to me on this question, it would be very hard to grant the ACL to all the individual users as they are more than 1000, and we create more regularly.

Thanks for your quick reply... I don't have a problem creating the basic ACL with the privileges granted for a user. The problem appears when I try to create an ACL with privileges for a ROLE. You can see here http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_networkacl_adm.htm#BABIGEGG than the official Oracle documentation states that you can assign the ACL principal to be a user or role:
Parameter
Description
acl
Name of the ACL. Relative path will be relative to "/sys/acls".
description
Description attribute in the ACL
principal
Principal (database user or role) to whom the privilege is granted or denied. Case sensitive.
My issue is that when I try to create the ACL for a role it doesn't work.
Have you ever created an ACL for a role? if so please send me an example or let me know which step I might be missing. Cheers.

On the web how can I check the user role to display the form suitable for this role i

Hello
How can I check on the web the use role to display the a form for each role
Example
If the admin login I display admin_form.fmb and if user login I display
user_form.fmb
Thankx
Tamer

In my forms I hide tab pages according the role using something like the following script in the WHEN_NEW_FORM_INSTANCE trigger.
So the user can not navigate to tabs which are vorbiden by his role.
CURSOR users_roles_cur IS SELECT granted_role FROM user_role_privs
WHERE username=(SELECT user FROM dual);
user_roles_rec users_roles_cur%ROWTYPE;
IF users_roles_cur%ISOPEN
THEN
CLOSE users_roles_cur;
END IF;
OPEN users_roles_cur;
LOOP
FETCH users_roles_cur INTO user_roles_rec;
EXIT WHEN users_roles_cur%NOTFOUND;
MESSAGE (user_roles_rec.granted_role);
PAUSE;
IF RTRIM(user_roles_rec.granted_role,' ') = 'BLA-BLA'
THEN
tb_pg_id := FIND_TAB_PAGE('activity');
IF GET_TAB_PAGE_PROPERTY(tb_pg_id, visible) = 'FALSE' THEN
SET_TAB_PAGE_PROPERTY(tb_pg_id, visible, property_true);
END IF;
END IF;
END LOOP;
CLOSE users_roles_cur;
Other solution may be is to use an initial form which only will detect the user role and run the appropriate form.
Other solutions are also possible.
Joseph

How to create a transport for sapscript translations

Hello,
does someone knows how to create a transport for sapscript translations which can then be released to the other system via SE10?
In 4.6C when I changed a translation for a sapscript form it created automatically a transport.
Now in 6.0 it wont!
Kind regards
Wolfi.

Hi,
Go through the help.
http://help.sap.com/saphelp_nw04s/helpdata/en/b4/54601d77f38e429ffad9e3e11c1b25/frameset.htm
https://www.sdn.sap.com/irj/sdn/wiki?path=/display/abap/assigning%2ba%2btransport%2brequest%2bfor%2bthe%2btranslations%2bin%2bsmart%2bforms
in the above example you have to select FORM instead Smartform.
Thanks,
Sree.
Edited by: t sree on Oct 28, 2008 10:59 AM

TRANSPORT FOR A ROLE

Similar Messages

Maybe you are looking for