User Default Mappings attribute "role" with condition "OR"

Hello,
we are using GRC 5.3 SP 8.1.
User default mappings with more than one "role" attribute and the condition "OR" don't seem to work. After provisioning no user parameters have changed in backend system. When I configure only one "role" with the condition "AND" everything works fine, request types are the same.
Any suggestions?
Thanks,
Manuel

Hallo Sirish,
thanks for this helpful answer.
In the note it says: "After upgrade from 5.2 to 5.3 SP08.1, the user defaults were not provisioned."
So this error only occurs when upgraded from 5.2 to 5.3 SP8.1 or is it a gnerally bug in SP 8.1?
I configured some new conditions in our test system and it worked. So in my opinion only the old configured user default mappings don't work because of the upgrade (???). I'm a little bit confused...
Regards,
Manuel Kunkel

Similar Messages

Default role with password - reality check

I support the database for an application. We upgraded from Oracle10 to Oracle11 9 months ago. Then recently we applied the OCT CPU.
The application admin says that they have a program that has recently stopped working that worked after the Oracle11 upgrade.
The application user has a default role which has a password. Is that possible? A default role with a password. Would this have ever worked in any version of Oracle?

Default role with password is a feature even available with Oracle XE. Default roles are activated without requiring role password in Oracle 10.2:
SQL> drop user admin cascade;
User dropped.
SQL> drop user test cascade;
User dropped.
SQL> drop role rwp;
Role dropped.
SQL> select * from v$version;
BANNER
Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product
PL/SQL Release 10.2.0.1.0 - Production
CORE 10.2.0.1.0 Production
TNS for 32-bit Windows: Version 10.2.0.1.0 - Production
NLSRTL Version 10.2.0.1.0 - Production
SQL>
SQL> create user admin identified by oraclexe;
User created.
SQL> grant create session, create table to admin;
Grant succeeded.
SQL> grant unlimited tablespace to admin;
Grant succeeded.
SQL> grant create user to admin;
Grant succeeded.
SQL> grant create role to admin;
Grant succeeded.
SQL>
SQL> create user test identified by oraclexe;
User created.
SQL> grant create session to test;
Grant succeeded.
SQL>
SQL> connect admin/oraclexe;
Connected.
SQL> create table t(x varchar2(10));
Table created.
SQL> insert into t values('admin OK');
1 row created.
SQL> commit;
Commit complete.
SQL> create role rwp identified by oraclexe;
Role created.
SQL> grant all on t to rwp;
Grant succeeded.
SQL> grant rwp to test;
Grant succeeded.
SQL>
SQL> connect test/oraclexe;
Connected.
SQL> select * from session_roles;
ROLE
RWP
SQL> select * from admin.t;
X
admin OK
SQL> insert into admin.t values('test OK');
1 row created.
SQL> commit;
Commit complete.
SQL> select * from admin.t;
X
admin OK
test OK
SQL>There have been changes between Oracle 10.2 and 11.2 because the same script fails in 11.2 unless the role is set with the password:
SQL> drop user admin cascade;
User dropped.
SQL> drop user test cascade;
User dropped.
SQL> drop role rwp;
Role dropped.
SQL> select * from v$version;
BANNER
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
PL/SQL Release 11.2.0.1.0 - Production
CORE 11.2.0.1.0 Production
TNS for Linux: Version 11.2.0.1.0 - Production
NLSRTL Version 11.2.0.1.0 - Production
SQL>
SQL> create user admin identified by oraclexe;
User created.
SQL> grant create session, create table to admin;
Grant succeeded.
SQL> grant unlimited tablespace to admin;
Grant succeeded.
SQL> grant create user to admin;
Grant succeeded.
SQL> grant create role to admin;
Grant succeeded.
SQL>
SQL> create user test identified by oraclexe;
User created.
SQL> grant create session to test;
Grant succeeded.
SQL>
SQL> connect admin/oraclexe;
Connected.
SQL> create table t(x varchar2(10));
Table created.
SQL> insert into t values('admin OK');
1 row created.
SQL> commit;
Commit complete.
SQL> create role rwp identified by oraclexe;
Role created.
SQL> grant all on t to rwp;
Grant succeeded.
SQL> grant rwp to test;
Grant succeeded.
SQL>
SQL> connect test/oraclexe;
Connected.
SQL> select * from session_roles;
no rows selected
SQL> select * from admin.t;
select * from admin.t
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> insert into admin.t values('test OK');
insert into admin.t values('test OK')
ERROR at line 1:
ORA-00942: table or view does not exist
SQL> commit;
Commit complete.
SQL> select * from admin.t;
select * from admin.t
ERROR at line 1:
ORA-00942: table or view does not exist
SQL>
SQL> set role rwp identified by oraclexe;
Role set.
SQL> select * from session_roles;
ROLE
RWP
SQL> select * from admin.t;
X
admin OK
SQL> insert into admin.t values('test OK');
1 row created.
SQL> commit;
Commit complete.
SQL> select * from admin.t;
X
admin OK
test OK
SQL>10.2 Security Guide says:
If you are granted a role protected by a password, then you can enable or disable the role by supplying the proper password for the role in a SET ROLE statement. However, if the role is made a default role and enabled at connect time, then the user is not required to enter a password.
11.1 and 11.2 Secuirty Guide says:
If a user is granted a role protected by a password, then you can enable or disable the role by supplying the proper password for the role in the SET ROLE statement. You cannot authenticate a password-authenticated role on logon, even if you add it to the list of default roles. You must explicitly enable it with the SET ROLE statement using the required password.
Edited by: P. Forstmann on 20 févr. 2010 10:28

I want to open a domain.site2 file outside the default folder (User/Library/Application Support/iWeb) with iWeb11, but iWeb only opens the domain file in the default folder. If I delete the default domain file, iWeb wants to create a new site. Help please

I want to open a domain.site2 file outside the default folder (User/Library/Application Support/iWeb) with iWeb11, but iWeb only opens the domain file in the default folder. If I delete the default domain file, iWeb wants to create a new site. Does anyone have the same problem or know how to fix it?

In Lion the Finder folder is now invisible. To make it permanetely visible enter the following in the Terminal applicaiton window: chflags nohidden ~/Library and hit the Enter button - 10.7: Un-hide the User Library folder.
For opening your domain file in Lion for the first time or to switch between multiple domain files Cyclosaurus has provided us with the following script that you can make into an Applescript application with Script Editor. Open Script Editor, copy and paste the script below into Script Editor's window and save as an applicaiton.
Just launch the applicaiton, find and select the domain file you want to open and it will open with iWeb. It modifies the iWeb preference file each time it's launched so one can switch between domain files.
do shell script "/usr/bin/defaults write com.apple.iWeb iWebDefaultsDocumentPath -boolean no"delay 1
tell application "iWeb" to activate
OT

Report to see list of roles with no user assignment

Hi Gurus,
I need to know the transaction/Report where i can see list of roles which doesnt have any user assignment.
Pls help me

HII,
To search for roles with no users assignment u can run a report RSUSR070 AFTER EXECUTING TCODE SA38 in the progran field enter the name of the report and click execute button u get roles by complex selection criteria then scroll down and in the selection according to user assignments select without user assignment then cli ck execute button u will get the roles with no user assigments............
Thanks and regards

Formatting a date according with user settings (user defaults)

Hi All,
I need to format a date I receive via JS in YYYYMMDD format according with user defaults <b>without</b> server side action (I know, this is not a good issue, but they want it).
My solution is to write a JS function (there are a lot of it on WWW) which accepts two strings and formats the first according to the second, something like:
userFormattedDate = formatDate('20060613','DD.MM.YYYY');
paying attention to generate 'DD.MM.YYYY' string on server side, according to user settings.
But if this isn't a weblog, where is the question? :-D
The question is: is there a JS function (in DatePicker or dateNavigator BSP) provided by standard libraries which serves similar functionality?
Does exist a JS public standard library?
Thanks.
Dany

Hi Durairaj,
Tags <% %> are for server side actions.
The question is about obtaining the same effect, but client side.
Thanks.
Dany

Fail to create roles with users in LDAP

I installed and configured two Directory Services one for AM and one for identity. I created an LDAP Data Store for the root realm and can see the LDAP users in the Subjects->User tab in AM. I can create Subjects->Groups and add LDAP users successfully, but I cannot create Subjects->Roles with LDAP users. I get the following error:
Plug-in com.sun.identity.idm.plugins.files.FilesRepo: Unable to find entry: C:\SFU\app\ironscale\amserver\idRepo\user\awhite
Any ideas? I also found it odd that my new Group was created in the FileRepo under idRepo/group. I thought it would have been written to the AM DS.
I deleted the flat file Data Store and the Group/Roles tabs disappeared. Must I import additional LDIFS to my LDAP Identity DS to store roles and groups it that DS?

Update.
I deleted LDAPv3 Plug-in Supported Types and Operations values group, user, and role, based on Sun's Access Manager training class examples. I re-added them and deleted the File Data Store and groups now get created in the LDAP Identity repo. However when I create a role and add users the operation sucessfully completes. But I cannot find the roles using an LDAP browser. I can grep the role name from the LDAP database and the roles remain after restarting the db and AM. It appears AM is adding roles in a way other tools cannot see them.

User Role with All MM Transaction codes

Hi SAP Gurus,
I need to create a User role with all MM transactions. Can anyone please let me know whether Standard User role is available which has authorisations for all MM transaction codes ? If yes, what is the User role name. If not, what is the easiest way to get a list of all MM transaction codes.
Regards,
Janagiraman.

Hi,
sap_mm_all role name is not available in client sap system version 5.0. The role might have been deleted by someone.
Regards,
Janagi

New Apps User defaults with all User Edition Privileges - Security Breach?

Please check the following Scenario/Issue and please let me know if anyone has a solution for it.
1. In Apps, created following Responsibilities
- Payables Inquiry-Only User
- Projects Inquiry-Only User
2. In Discoverer Admin, Tools->Privileges, assigned following privilege to "Payables Inquiry-Only User"
- User Edition Parent only (unchecked all child privileges such as Create/Edit Query)
3. In Discoverer Admin, Tools->Security, mapped following Responsibilities/Business Areas (BA)
- Resp: Payables Inquiry-Only User BA: AP Payables
- Resp: Projects Inquiry-Only User BA: PA Projects
4. In Apps, created user DISC_INQUIRY_USER, assigned following responsibilities
- Payables Inquiry-Only User
- Projects Inquiry-Only User
5. At this stage, if user connects to User Edition;
- user is able to create new query in BA: AP Payables or BA: PA Projects depending on login Responsibility
- By default Discoverer assigns all User Edition Privileges to new Apps User including Create/Edit Query
Requirement
1. Create new Apps User DISC_INQUIRY_USER, assign it Inquiry-Only Responsbilities
2. Login to User Edition - DISC_INQUIRY_USER: Payables Inquiry-Only User
- User can inquiry Workbooks associated with Resp: Payables Inqiry-Only user
- Should not be able to create new workbooks
3. Login to User Edition - DISC_INQUIRY_USER: Projects Inquiry-Only User
- User can inquiry Workbooks associated with Resp: Projects Inquiry-Only User
- Should not be able to create new workbooks
Issue
There is time-gap between creating Apps User and login to Discoverer Admin to remove user privileges. This is security Breach, is their any way to change get around it.
- Discoverer gives precedence to Responsibility Privileges over User Privileges. Is their any way to change it?
- Is it possible to change default Privileges for new Apps User?
- I am facing this issue in Discoverer 4.1.48, Does discoverer Admin behaves differently in latest Versions?

Nobody helps you except yourself. ;)
So, this query get privileges for user PUBLIC
select eap.ap_id, eap.gp_app_id
from eul5_eul_users eeu,
eul5_access_privs eap
where eeu.eu_username = 'PUBLIC'
and eap.ap_eu_id = eeu.eu_id
and eap.ap_type = 'GP'
In my case
3001     1000
3002     1001
3003     1002
3004     1003
3005     1004
3006     1005
3015     1013
3016     1014
3017     1018
3018     1024
I research а corresponding between gp_app_id (second column) and real name of privilege and get the next list:
1000     Discoverer and Plus Privilege
1001     Create/Edit Query
1002     Item Drill
1003     Drill Out
1004     Grant Workbook
1005     Collect Query Statistics
1006     Administration Privilege
1007     Set Privilege
1008     Create/Edit Business Area
1009     Format Business Area
1010     Create/Edit Summaries
1012     Schedule Workbook
1013     Unknown
1014     Save Workbooks to Database
1015     Manage Scheduled Workbooks
1018     Unknown
1024     Create Link
So, the ID of privilege 'Save Workbooks to Database' is 1014. This privilege exists in table in spite of in Discoverer Administrator this option UNCHECK for user PUBLIC.
This is a REAL BUG!!!
Then I executed query
delete from eul5_access_privs where ap_id = 3016
and after that all became right.
Now please explain me this bug. And I have question - which privileges have IDs 1013 and 1018?
Thank you.

Transporting role with user assignments

Hi Guru's,
When we transport a role with user assignments then in the target system, the role will wipe out all the existing assignment and show the the users in the original released request.
eg. D->Q
In dev:
role-A has userA, userB
In Qas;
Role-A has UserA and userC
......after import of request:
the roleA will have userA and userB
What I have noticed is even if userB does not exist in Qas, the assignment will be reflected in AGR_USERS. A PFUD or user compare in a role does not remove the ghost entries. Is there any way to remove these inconsistencies ?
I saw note 534010, which is applicable for UST04.
Thank you
Abhishek

Hi Matt,
Yes, I do agree this is not a best practice. However, for a particular requirement, we thought this was the best way to solve the problem. Infact, this was the first time I ever did this
We have a role that needs to ONLY be assigned to every person in a particular team. With more than 30 systems present( out of the production landscape, just the testing systems), we thought this would be the only fast way out than going in each system and assigning this role. This would also ensure unassignment of this role to any other person too
Any other alternative?
Thank you
Abhishek

Exporting Active directory users to excel with conditions

I'm trying to export AD users with selected fields out to a spreadsheet, with the condition that the employeeid field is greater than 99999. I found a VBScript elsewhere on this site that does everything i need, even filtering on the employeeid
field except that when it export to the spreadsheet the employeeid field comes back as if it's blank. But i know it's not as it will do the filtering correctly. Below is the script i've been using. As i said it will correctly list all users
with employeeid greated than 5 digits but it just won't export the actual employeeid field
Dim ObjWb
Dim ObjExcel
Dim x, zz
Set objRoot = GetObject("LDAP://RootDSE")
strDNC = objRoot.Get("DefaultNamingContext")
Set objDomain = GetObject("LDAP://" & strDNC) ' Bind to the top of the Domain using LDAP using ROotDSE
Call ExcelSetup("Sheet1") ' Sub to make Excel Document
x = 1
Call enummembers(objDomain)
Sub enumMembers(objDomain)
On Error Resume Next
Dim Secondary(20) ' Variable to store the Array of 2ndary email alias's
For Each objMember In objDomain ' go through the collection
if ObjMember.EmployeeID > 199999 Then 'if employee id greater than 199999 then add to spreadsheet (meaning physician)
x = x +1 ' counter used to increment the cells in Excel
' I set AD properties to variables so if needed you could do Null checks or add if/then's to this code
' this was done so the script could be modified easier.
SamAccountName = ObjMember.samAccountName
FirstName = objMember.GivenName
LastName = objMember.sn
EmployeeID = ojbMember.employeeID
EmailAddr = objMember.mail
Addr1 = objMember.streetAddress
Title = ObjMember.Title
Department = objMember.Department
' Write the values to Excel, using the X counter to increment the rows.
objwb.Cells(x, 1).Value = EmployeeID
objwb.Cells(x, 2).Value = SamAccountName
objwb.Cells(x, 3).Value = FirstName
objwb.Cells(x, 4).Value = LastName
objwb.Cells(x, 5).Value = EmailAddr
objwb.Cells(x, 6).Value = Addr1
objwb.Cells(x, 7).Value = Title
objwb.Cells(x, 8).Value = Department
' Write out the Array for the 2ndary email addresses.
For ll = 1 To 20
objwb.Cells(x,26+ll).Value = Secondary(ll)
Next
' Blank out Variables in case the next object doesn't have a value for the property
EmployeeID = "-"
SamAccountName = "-"
FirstName = "-"
LastName = "-"
EmailAddr = "-"
Addr1 = "-"
Title = "-"
Department = "-"
For ll = 1 To 20
Secondary(ll) = ""
Next
End If
' If the AD enumeration runs into an OU object, call the Sub again to itinerate
If objMember.Class = "organizationalUnit" or OBjMember.Class = "container" Then
enumMembers (objMember)
End If
Next
End Sub
Sub ExcelSetup(shtName) ' This sub creates an Excel worksheet and adds Column heads to the 1st row
Set objExcel = CreateObject("Excel.Application")
Set objwb = objExcel.Workbooks.Add
Set objwb = objExcel.ActiveWorkbook.Worksheets(shtName)
Objwb.Name = "Active Directory Users" ' name the sheet
objwb.Activate
objExcel.Visible = True
objwb.Cells(1, 1).Value = "EmployeeID"
objwb.Cells(1, 2).Value = "SAMAccountName"
objwb.Cells(1, 3).Value = "FirstName"
objwb.Cells(1, 4).Value = "LastName"
objwb.Cells(1, 5).Value = "Email"
objwb.Cells(1, 6).Value = "Addr1"
objwb.Cells(1, 7).Value = "Title"
objwb.Cells(1, 8).Value = "Department"
End Sub
MsgBox "User dump has completed.", 64, "AD Dump" ' show that script is complete

Here is a test version
Set xl = CreateObject("Excel.Application")
xl.Visible = True
Set wb = xl.Workbooks.Add()
Set sheet = wb.Worksheets("sheet1")
sheet.Name = "Active Directory Users"
i = 1
With sheet
.Cells(i, 1).Value = "EmployeeID"
.Cells(i, 2).Value = "SAMAccountName"
.Cells(i, 3).Value = "FirstName"
.Cells(i, 4).Value = "LastName"
.Cells(i, 5).Value = "Email"
.Cells(i, 6).Value = "Addr1"
.Cells(i, 7).Value = "Title"
.Cells(i, 8).Value = "Department"
End With
Set users = GetADUsers()
While Not users.EOF
i = i + 1
With sheet
.Cells(i, 1).Value = users("employeeID")
.Cells(i, 2).Value = users("samAccountName")
.Cells(i, 3).Value = users("GivenName")
.Cells(i, 4).Value = users("sn")
.Cells(i, 5).Value = users("mail")
.Cells(i, 6).Value = users("streetAddress")
.Cells(i, 7).Value = users("Title")
.Cells(i, 8).Value = users("Department")
End With
users.MoveNext
Wend
Function GetADUsers()
Set rootDSE = GetObject("LDAP://RootDSE")
base = "<LDAP://" & rootDSE.Get("defaultNamingContext") & ">"
filt = "(&(objectClass=user)(objectCategory=Person))"
attr = "employeeid,SAMAccountName,mail,GivenName,sn,streetAddress,Title,Department"
scope = "subtree"
Set conn = CreateObject("ADODB.Connection")
conn.Provider = "ADsDSOObject"
conn.Open "Active Directory Provider"
Set cmd = CreateObject("ADODB.Command")
Set cmd.ActiveConnection = conn
cmd.CommandText = base & ";" & filt & ";" & attr & ";" & scope
Set GetADUsers = cmd.Execute()
End Function
¯\_(ツ)_/¯

Open XML file with user default browser and not the default editor.

Hi,
I'm writing a java program that appends numerous XML files together. The result is a NEW well formed XML document. Since i have an XSLT that performs several UI modifications on this xml file, the file extension must remain '.xml'. I need to open this xml file with the users default web browser. The problem is that:
Runtime.getRuntime().exec(cmd);
....opens the xml file with the users default program for opening xml files which in my case is Oxygen. I want to force java to open this xml file with the users default web browser and nothing else.
I guess i need the Windows command to perform the 'open with' feature but i have no idea what that command is or how to find it.
Any ideas?
Thanks,
Varun Singh
Edited by: Jagara00 on Jul 2, 2009 3:49 PM

sabre150 wrote:
Jagara00 wrote:
Your right, but my question relates to the java issue and not the XSLT aspect of the problem. I am looking for a java solution for reasons i will no go into here. You have lost me.Me too.
People do not often ask questions (or make challenges or observations) idly for the sake of 'theory'. It is most useful to explain to the best of your ability.
As to
"Since the Desktop class was only released with SE 6 I am forced to find another alternative. "
There is an 'alternative'. You can import it into a 1.5 project. It was available as a free standing API before 1.6 - through JDIC. See [https://jdic.dev.java.net/documentation/Examples.html|https://jdic.dev.java.net/documentation/Examples.html] for more info.
Edit 1:
To a later reply
"Do u .."
..want to spell incorrectly when you get frustrated?
"..do not wish to.."
..get any help? That is the way you are heading.
Edited by: AndrewThompson64 on Jul 3, 2009 9:27 AM

Replace User msRTCSIP-GroupingID attribute with the OU ObjectGUID

Hello!
I am trying to create a script that will replace the users msRTCSIP-GroupingID attribute with the OU ObjectGUID
Can anyone help with this
Get-ADUser -Filter * -SearchBase "OU=Test,OU=Tenants,DC=Mayernetworks,DC=COM"
$OUobjectGUID = get-ADOrganizationalUnit -filter * -searchbase "ou=test,ou=tenants,dc=mayernetworks,dc=com" | ft ObjectGUID
Set-ADUser $Accounts -Add @{"msRTCSIP-GroupingID"=$OUobjectGUID}
i'm getting the argument is null error
bradley Wyatt

I dont think this is supported
The attribute msRTCSIP-GroupingID should
not be used in a commercial hosting environment and is not supported by Microsoft due
to the privacy and security risks when providing multi-tenancy in a hosting environment. The use of the attribute only simulates a grouping of users in logical partitions, and does not create a true partition in which the security and privacy of the tenants
can be tightly controlled.
Please remember, if you see a post that helped you please click ;Vote As Helpful" and if it answered your question please click "Mark As Answer" Regards Edwin Anthony Joseph

Report layout with User default and gobal default

hi,
any authorization to control report layout, only some user ID can use "user default" layout, and part of user available to set the layout as default
thanks

Is is a custom-developed ALV report or an SAP-supplied one?
If if is custom-developed, you can register the following user-commands
&AVE - Save layout
&OL0 - Change layout
&OAD - Select layout
in parameter IT_EVENT_EXIT of REUSE_ALV_LIST_DISPLAY. When these user-commands are triggered, control passes to the user command routine in your callback program. In the callback routine, you can implement authorization/security checks.
Also look at parameters IS_VARIANT and I_SAVE to control use of variants.,
If it is an SAP-supplied program, try using the auth-object mentioned in my earlier post.

Role with dynamic iview assignment depending on users

Hi All,
We have a situation here for BI reports. Let me explain in detail.
We have Home role common for every user in portal having home page. Home page contains VC BI iviews.
Now our requirement is that the role should remain the same but the VC iview should change depending on the user.
For example.
User A has home role should see VC BI iview1
User B has home role should see VC BI iview2
Please guide us how to achieve this.
Regards,
Bharat Mistry.
Edited by: Bharat Mistry on Dec 24, 2007 10:53 AM

Hi Bharat,
You can refer to this [link|http://help.sap.com/saphelp_nw70/helpdata/en/53/89503ede925441e10000000a114084/frameset.htm] for detail.
Also this [thread|Re: Controlling visibility of Second Level navigation tabs in portal;.
Regards,
Ami

User Defaults - GRC 10

Hi All,
We are on GRC SP13.
I have configured User Defaults.
My Decision table has Request Type and User Default ID entries and User defaults are correctly getting updated in the target system based on the connector tagged to User Default ID.
My scenario:
New Account Request Type - User selected ECC role and it has mapped BW roles.
Now User defaults work only for ECC and not BW
Hence I have tried changing my BRF+ decision table with Connector and Role Connector both, when i include any of these User defaults itself not working.
Anyone faced the same issue?
If I have Connector or Role connector in BRF+ decision table, User Defaults don't work
Already applied SAP note 2020712 - UAM: User group not provisioned after approval
Regards,
Sai.

Hi Sai,
Could you please check and confirm if you have user defaults action from the request type..?
As highlighted in the note "you are using "System" as one of the fields in setting the conditions for User Defaults, then try using the option for Implementing a LOOP in your BRF Rule. This might be needed since "System" field is not available under Request Header attributes, rather it is available as Role Attributes which are called as line-item fields while calling the BRF Rule. So, in such cases LOOP is a suggested solution, rather than using the Decision Table directly. Though within the LOOP, you can still call the Decision Table or implement IF/ELSE conditions."
Better paste some of the snap shots from your BRF+ configurations.
If you are sure enough that your config is on right track then raising this concern with SAP might be an option.
Regards,
Ameet

User Default Mappings attribute "role" with condition "OR"

Similar Messages

Maybe you are looking for