User Comparison made easy?

Hello all --
Sorry if this is an old and already answered question, I did some searching but nothing came up.
Is it possible to do a "User Comparison" in bulk, or to schedule that as a background job? I find myself go through many roles and check the user comparison manually, but it seems like there should be a way to automate that. I am not that clear on what it actually does, although I believe it applies changes made somewhere.
Thanks in advance...
MMPP

Thanks Raghu for your reply, and sorry for posting in the wrong forum.
May I ask you for further details regarding your comment?
Raghu wrote:
This can play havoc with authorizations if you do not use it properly.
How is this different from running the user master comparison from within the role? How would you avoid using it "improperly"?

Similar Messages

CUP Auto Provisioning Error 260: User Comparison

I am in the process of configuring the CUP 5.3 module within our ECC and SRM environments. I believe the path and associated stages are established properly. I have tested the auto provisioning functionality within both SRM and ECC. As it relates to SRM, the auto provisioning functionality works without a hitch. However, when I attempt to auto provision a user into our ECC environment, I receive the following error:
Auto provisioned for request on 04/07/2010 13:41
   New User: T00522 created on 04/07/2010 13:42 in System(s): DR4-300.
   User attributes changed for User : T00522 in System(s) :DR4-300.
   Role Provisioning failed for System(s) : DR4-300. Error Message : 260:User master comparison incomplete; see long text
Speaking with out security team, the only time they have seen this issue was when they attempted to map a user, using PFCG, to a role. However, I informed them that CUP uses SU01. They have not experienced such an issue using SU01 and clicking on the user comparison button.
Interesting point: The user record is created and roles assigned to user but have a red light indicator by the role within SU01. However, when the next day rolls around the role has been changed to a Green light, profile assigned and everything is looking good. Unfortunately, CUP can't seem to register this and when the Role Owner attempts to approve the role / user request again. The same error occurs and until I can get around this error, the workflow is not closed out nor is the requester notifiied.
Questions:
(1) How can I fix this issue, I assume it will require a security change to be made within the ECC environment?
(2) If this issue can't be fixed, can I get around this issue with a detour or other CUP error processing step?

Denoted below is the log that corresponds to the 260 comparison error. Does anyone know what access I am missing within the UME. I have tested this provisioning process, manually, and do not run into a Comparison error within the SU01 screens:
2010-04-27 13:44:54,748 [SAPEngine_Application_Thread[impl:3]_31] ERROR com.virsa.ae.service.ServiceException: 260:User master comparison incomplete; see long text
com.virsa.ae.service.ServiceException: 260:User master comparison incomplete; see long text
     at com.virsa.ae.service.sap.SAPProvisionDAO.executeRoleOperation(SAPProvisionDAO.java:1706)
     at com.virsa.ae.service.sap.SAPProvisionDAO.assignRoles(SAPProvisionDAO.java:1458)
     at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionInNonCUA(ProvisionSAPUserDAO.java:1232)
     at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionRole(ProvisionSAPUserDAO.java:932)
     at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionUser(ProvisionSAPUserDAO.java:118)
     at com.virsa.ae.accessrequests.bo.ProvisioningBO.autoProvision(ProvisioningBO.java:216)
     at com.virsa.ae.accessrequests.bo.RequestBO.autoProvisioningForApprove(RequestBO.java:4572)
     at com.virsa.ae.accessrequests.bo.RequestBO.callAEExitService(RequestBO.java:5565)
     at com.virsa.ae.accessrequests.bo.RequestBO.callExitService(RequestBO.java:5339)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:5191)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:4984)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.confirmRequestApproval(RequestViewAction.java:941)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.execute(RequestViewAction.java:103)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:271)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)
2010-04-27 13:44:54,927 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.accessrequests.bo.RequestAuditHelper : logMajorAction() :   : intHstId : 3068
2010-04-27 13:44:54,972 [SAPEngine_Application_Thread[impl:3]_31] ERROR no dtos exist which are in the same state as the passing dto
com.virsa.ae.core.ObjectNotFoundException: no dtos exist which are in the same state as the passing dto
     at com.virsa.ae.workflow.bo.WorkFlowBOHelper.getIfUnapprovedPathExists(WorkFlowBOHelper.java:2662)
     at com.virsa.ae.workflow.bo.WorkFlowBOHelper.handleWFForNewPathStage(WorkFlowBOHelper.java:2516)
     at com.virsa.ae.workflow.bo.WorkFlowRequestRerouteHelper.rerouteRequest(WorkFlowRequestRerouteHelper.java:68)
     at com.virsa.ae.workflow.bo.WorkFlowBO.rerouteRequest(WorkFlowBO.java:614)
     at com.virsa.ae.accessrequests.bo.RequestBO.rerouteRequestForAutoProvisioningFailure(RequestBO.java:6897)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:5239)
     at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:4984)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.confirmRequestApproval(RequestViewAction.java:941)
     at com.virsa.ae.accessrequests.actions.RequestViewAction.execute(RequestViewAction.java:103)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:271)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)
2010-04-27 13:44:55,394 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.accessrequests.actions.RequestViewAction : confirmRequestApproval() :   : setting context to true, ending context
2010-04-27 13:44:55,414 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.RequestDataForwardDAO : findTransactions() :   : sbQuery : SELECT REQNO, REQPATHID, STAGE_NAME, FWDED_BY, APRVRID, ITERATION, FORWARD_TYPE, STATUS FROM VIRSA_AE_RQD_WPFWD WHERE REQNO = ?
2010-04-27 13:44:55,486 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.SAPConnectorDAO : findAllActiveSAPConnectors :   : going to return no of records= 3
2010-04-27 13:44:55,495 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.OracleAppsConnectorDAO : findAllActiveORACLEConnectors :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,498 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.PACSConnectorDAO : findAllActivePACSConnectors :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,502 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.WSConnectorDAO : findAllActive :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,505 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.ApplicationDAO : findAllForContext :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,532 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.RequestDataSODConflictDAO : findAllForContext(SqljContext ctx) :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,535 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.RequestDataSODConflictDAO : findAllForContext(SqljContext ctx) :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,540 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.dao.sqlj.RequestDataMitigationDAO : findAllForContext(SqljContext ctx) :   : going to return ImmutableList(empty)
2010-04-27 13:44:55,579 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.accessrequests.actions.RequestViewAction : pageLoad() :   : INTO the method
2010-04-27 13:44:55,580 [SAPEngine_Application_Thread[impl:3]_31] INFO com.virsa.ae.accessrequests.actions.RequestViewAction : pageLoad() :   : request number : 154
2010-04-27 13:45:14,055 [SAPEngine_Application_Thread[impl:3]_18] INFO com.virsa.ae.dao.sqlj.RequestTypeDAO : findAll :   : going to return no of records= 20

User Comparison - Roles contantly going to 'red' inactive

Hi,
Can someone shed some light on this issue i'm having here.
I noticed today while working with a user in SU01 that the role assigned to the user switch from green 'active' to 'red' inactive. There were updates made to the master role and then passed to the child (derived) roles. I manually ran user comparison and then verified in SU01 that the roles were still green. Couple hours later I noticed the child role went to 'red' inactive. Why is this happening. This happened and I took at as one time incident but this happening more frequently.
-Wes

Could be...
According to Wes's Business Card he (?) is from the US and for some reason (probably the training documentation in ADM940...!) I have more often than not noticed that US based systems tried to allign the profile names to the "activity group" names when building little single roles - sometimes one role per transaction - as "building blocks" for activities clubbed together into composites.
@ David: I also hate composites...
Unless Wes clarifies, I would however still place my bets on a profile name collision as a result of the DEV, QAS and PROD having the same first and third characters in the SID name, or a client disorder in DEV from which the roles are being transported (e.g. "golden security client" implemented later than the productive client transport routes, or a customizing client was used to make the changes).
AGR_NUM_2 has MANDT as a key field and with derived roles and small singles the limit can be reached with ease, particularly if these were download / uploaded in the past to avoid transport request sequence confusion - which is reasonable in my opinion.
Cheers,
Julius

User Comparison - Job showing output deleted users in Sol.man

Hi All,
I scheduled the User Comparison job for every 4 hrs with respective of the program RHAUTUPD_NEW. In the output it is showing me the list of deleted users as well. like "User EAMANITR does not exist" in Sol.man.
I am sure it is not a problem, but want to knwo what the job output showing this list as well.
let me know if any one come up with this issue.
SV

Hi,
Have you checked OSS note 1280891?
Cheers

User comparison?

Hi all!!!
I am relatively new to SAP authorisation concept, ad i think i dont completely understand the idea of user comparison.
Am i correct:
- if i use SU01 to assign a role to a user there's no need to perform a user comparison
- if i assign user to a role i have to run user comparison. Before comparison,if you look into user master record the role is already there, but it is uncompared, and user dont have authorisations yet, though he can log on and see role menu.
What is the point of user comparison? what does it do apart from assigning profiles? if nothing, why is it so that user dont have roles authorisation immeadiately after assignin him to a role in pfcg?? What is the point? First i thought that it removes all profiles which are not connected to the assigned role..but i try to attach some profiles manually and did user comparison, wich didn't remove manually entered profiles...so..
Can anybody describe it using simple language?
Tanks!

Hi Stanislaw,
>
Stanislaw Adamski wrote:
> - if i use SU01 to assign a role to a user there's no need to perform a user comparison
Yes, that is correct. When saved through SU01, SU10, a UMR reconcilation is done for the user(s).
>
Stanislaw Adamski wrote:
> - if i assign user to a role i have to run user comparison. Before comparison,if you look into user master record the role is already there, but it is uncompared, and user dont have authorisations yet, though he can log on and see role menu.
>
Thats a very good observation. Even I didnt know that the role menu would be displayed. However, (technically) since its actually the profiles and not the assignment of roles that give authorization, a user or role compare is required. The assignment of profiles to users can be viewed in table UST04. SU01/SU10 updates the UMR to reflect the appropriate profile(s) of the role in UST04. PFCG does not do this, unless manually done. If not compared via PFCG, this compare is rectified on the next run of PFCG_TIME_DEPENDENCY.
>
Stanislaw Adamski wrote:
> What is the point of user comparison? what does it do apart from assigning profiles? if nothing, why is it so that user dont have roles authorisation immeadiately after assignin him to a role in pfcg?? What is the point?
User Comparison updates the profiles in the UMR, table UST04 ...and maybe many others! . I hope you are clear on assigning through PFCG now
>
Stanislaw Adamski wrote:
First i thought that it removes all profiles which are not connected to the assigned role..but i try to attach some profiles manually and did user comparison, wich didn't remove manually entered profiles...so..
Generated profiles should not be assigned via the profiles tab. It does not allow to do this, maybe on earlier versions, still does allow this. However, if you still do assign this, PFCG_TIME_DEPENDENCY will remove this assignment!
A standard SAP profile, or a manually created profile(through SU02) will not get affected.
Hope this clarifies
Abhishek

R/3 authorization made easy

hi all,
I need R/3 authorization made easy 4.5 A/B. if any one has pls forward it to
<b><removed by moderator></b>

Use this link to download:
http://dl4.ohshare.com/d/9815564/1182678010/45_all.pdf
Points are appreciated!
Kind regards,
Lodewijk

PFCG, user comparison

Hi,
in PFCG trx there is a tab named user and a button "user comparison".
I cannot understand what is the function of that button.
After clicked it I can see that the warning icon on the abova tab becomes green.
Thanks
Best regards

Hi,
This tab does similier job as PFUD for reconcilation of profiles to users.
Yello tab of User Comparison indicates , though role is assigned to user , it is not up to date and needs to reconsile.
Green tab indicates , profiles assigned to user is up to date and have all required authorization granted.
Read Help guidelines :
Comparing user master records
o   The user master record comparison that is run automatically by
     report PFCG_TIME_DEPENDENCY can also be executed manually for a
     single role. To do this, choose Compare users on the Users tab. The
     status display on this pushbutton indicates whether or not you need
     to execute the comparison again.
     -   If you make changes to the users assigned to the role or
         generate a corresponding authorization profile, then you need to
         compare the user master records again.
     -   This compares the authorization profiles with the user master
         records, that is, profiles that are no longer current are
         removed from the user master records, and the current profiles
         are entered.
Regards,
Edited by: Rupali B on Mar 6, 2012 2:36 PM

Coming Soon! DNS Made Easy Client Success Stories

As part of DNS Made Easy’s continued efforts to optimize our services for your needs, we’ve developed a series of Client Success Stories. These case studies are compiled from direct testimonials from our clients who were asked to explain how DNS Made Easy has helped them simplify their DNS services and optimize their websites for […]
Read More
This topic first appeared in the Spiceworks Community

user10233638, did you install a 64 bit Oracle client or a 32 bit Oracle client? Your subject line says instant client which I would think you are using the EZconnect feature. To the best of my knowledge, which I admint is limited in regards to the instant client, I thought that the EZ connection like a java thin client connection supplied all the Oracle target information so not tnsnames.ora file was required.
I found a EQ connection example in the following while researching your issue:
ORA-12154 When Using Long SQLNET Alias in DBQ Property of ODBC Connection String or TNS Service Name of DSN [ID 1340407.1]
Is there any reason you are not using a regular Oracle client or an ODAC client installation? The ODAC client installation does not come with the network configuration tools but I have copied a tnsnames.ora file into the appropriate directory my customer wanted installed so they could use the MS Visual Studio support provided by ODAC. We are using that client to support connections to Oracle.
As far as I know Oracle does not care if you point to a network hosted tnsnames.ora file via the TNS_ADMIN environment variable. So long as the sqlnet software can open and read the tnsnames.ora file I am pretty sure Oracle does not care. We have been using a network hosted tnsnames.ora file to support desktop clients for over a decade and a half though we do not use this option from servers. I am pretty sure it was Oracle support that suggested using a commont client tnsnames.ora file to us to begin with.
HTH -- Mark D Powell --

ABAP Program: User comparison

Hi all,
I would like to know the name of ABAP report that can enable me to perform user comparison after I have created a new role and added to user.
thanks

Hi,
You can use the program RHAUTUPD_NEW or goto the transaction PFCG->Utilities-> Mass Comparison.
Hope it helps.
Regards,
Gaurav

Developer-Online Tutorial announcement :: Dynamic Mod_Rewrite Just Made Easy ::

Dynamic Mod_Rewrite Just Made Easy
Mod Rewrite Dynamic URL's into Static URL's The Issue at Hand, There are two types of URLs: dynamic and static. A dynamic URL is a page address that results from the search of a database-driven web site or the URL of a web site that runs a script. In contrast to static URLs, in which the contents of the web page stay the same unless the changes are hard-coded into the HTML, dynamic URLs are generated from specific queries to a site's database. The dynamic page is basically only a template in which to display the results of the database query. Instead of changing information in the HTML code, the data is changed in the database.
Tags:
ADDT | tips & trics | Search Engine Optimization | SEO |
Votes:
Not Rated!
Viewed:
[1] time(s)
Rate This Tutorial:
Posted on:
2009-06-14 03:15:15
Author:
waleed

Great info!!

I have a product code for my photoshop c6 under a different account that i cant remember. how can i use my software with the product code that i have with the new user i made?

I have a product code for my photoshop c6 and i used a different account to register this software. how can i use this product that i have with my new account that i just made?
please advise
I dont have the serial number so yeah
i have a product code

Contact Adobe Customer Service directly by phone or web chat (they don't do email). They don't do email. If you can provide proof of purchase to their satisfaction, they may be able to help you.
These are user forums, so you're not addressing Adobe here. We can't help you with this type of issue.

Firmware upgrade made easy

Why wont nokia firmware upgrade get beta like the iphone,cause nokia upgrade is so stressing u backup,format,do this do that jeez.but iphone just click update everything starts like magic only what u have to do is keep the internet connection steady others are done by the upgrader software. PLEASE NOKIA HELP US TO HELP YOU MAKE UPGRADING MORE EASIER BY INTRODUCING NEW FIRMWARE THAT WILL BE MUCH LIKE APPLE iphone. Please nokia users,help to persuade.

Not only iPhone but Motorola upgrader utility also doing like iPhone. I have a Motorola KRZR K1 and I have upgrade its firmware and its utility first backup all the data from mobile then doing firmware upgrade and then restore everything. Many users asking NSU to do like this and hope Nokia also will make NSU like this. We have to wait for it.
If you like my post then give me "Kudos" star...

Transaction code for user menu, sap easy access

Hi system experts!
Does anybody know which transaction causes the user-specific menu within "SAP easy access" (the welcome screen after login, like /n does) ?
I need it to be called from a portal iView, so that the usual sapgui-like screen with the user's menu appears in a portal screen, both for SAPGUI for windows and http.
Trx. S000 or SESSION_MANAGER does not cause the user-specific menu when called from the portal. These work least of all for call via ITS.
thanks
Andreas

hi ,
The transaction code is SE41.. This is for creating Menus and tool bars.
you can also try SMEN it will call the user menu as you described in your post.
Regards,
Krishna
Message was edited by: Krishnakumar

Active SAN, XSAN made easy! About time!

Active Storage just announced Active SAN, which makes XSAN super easy to deal with. Thank you Active Storage!
http://www.youtube.com/user/activestoragevideos?feature=mhum

Active Storage just announced Active SAN, which makes XSAN super easy to deal with. Thank you Active Storage!
http://www.youtube.com/user/activestoragevideos?feature=mhum

Unauthorized second user name made

     I have had my skype account for some time now. This morning I received an email welcoming me to skype for the "second time". I assumed it was a hacker considering they used my married name, and went by the name on my email address.
     I changed the password to the second user name, as well as the password to my email. I am just wondering if you allow multiple user names to be associated with the same email address and why.
     This is a great concern to me because I do not want my main account banned because some hacker in some random place decided to use my information. They changed the birth month and year so they made the second account name 1 month and 2 years older than me born the same day... I am very concerned now for my privacy and that of others.
     Any help that you guys could give regarding this issue would be great.
=D

Skype indeed allow to have more than 1 account to be associated with a single email address. In cases where someone created an account and used your email address, you can email [email protected] to report the user and to request to unlink your email from the unauthorized account/s.
IF YOU FOUND OUR POST USEFUL THEN PLEASE GIVE "KUDOS". IF IT HELPED TO FIX YOUR ISSUE PLEASE MARK IT AS A "SOLUTION" TO HELP OTHERS. THANKS!
ALTERNATIVE SKYPE DOWNLOAD LINKS | HOW TO RECORD SKYPE VIDEO CALLS | HOW TO HANDLE SUSPICIOS CALLS AND MESSAGES
SEE MORE TIPS, TRICKS, TUTORIALS AND UPDATES in
| skypefordummies.blogspot.com |

User Comparison made easy?

Similar Messages

Maybe you are looking for