User details are missing in Access request in GRC 10.0

Hello All,
When we are trying to create Access request in GRC 10.0 for an user it results as user details not found.
Under SPRO - Maintain data source configuration we have configured 2 HR systems HR1 and HR2.
But the User details exits in HR1 system and lies in validity also. We have tried to run the Repository Object Sync also still unable to search the details.
But we observed even after the Sync job User details are not created in table GRACUSER and GRACUSERCONN. Is this could be the problem. Why its not updating even after the Sync job many times almost 10 times.
We have also configured parameter 5023 to YES.Please advise.
Thanks in advance.

Did the sequence for HR1 set to 1 or 2, I hope you are following the suggestions given by Luciana in other thread.
Please post your data source config screenshots otherwise.
BR,
Mangesh

Similar Messages

User details are not populating in access request

Hello All,
We have configured GRC 10 with LDAP and we are able to search the users in LDAP tcode(find option) and in the access request. But when i select the user and click on ok in the access request, user information is not populating to user details tab. I have followed the SAP Standard doc and configuration is fine. When i select data source as SAP system, user details are population as expected. But when i use LDAP as data source, i am having the issue. I hope this is an field mapping issue but i tried all different options but no solution i found. Kindly help me with your expert suggestions.
Field mapping is as follows:
LASTNAME
SN
FIRSTNAME
GIVENNAME
USERID
SAMACCOUNTNAME
ROLE_NAME
NAME
MEMBER_OF
MEMBEROF
EMAIL
MAIL
MANAGERID
MANAGER
Regards,
Jai Reddy.

I know the path, but how to check it? is it using metaverse search?
Look at the Runs. Are they succeeding, or failing to connect?
Remove the Bit 17 and try again.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Help- After upgrading to Mountain Lion 10.8.4 all of my default user pictures are missing

Hello,
After ugrading to Mountain LIon 10.8.4 on my 2010 1.4 GHz Macbook air and now all of my default user pictures are missing.
I found a similar situation on the net in which the guy says to do this: "logged in as root and trashed the old user icon images file the copied the folder froma ML factory disk image". I have no idea what any of that means or if is for real as an answer or just a way to screw up my computer even more. I need help, and really basic simple instructions like your talking to some one who barely know how to turn on a computer. I would be really grateful to anyone who will help me. Thank you for your time.

I found a simple solution that worked on my Macbook Air running 10.8.4 which was missing all the User pictures when I tried to access them as the computer administrator even through they wer all there in the User Pictures folder in the Library.
I went into the Library Folder and trashed the "User Pictures" Folder.
I then copied the User Pictures folder from my Macbook Pro (also running 10.8.4) that did not have this issue and installed in on the Macbook Air in place of the User Pictures folder I had trashed. Then it all worked fine.

After F110 run in the payment file the account holder details are missed

Hai
After running the F110 pament run, In the payment file the ACCOUNT HOLDER name is missing . The ACCOUNT HOLDER details must picked up from VENDOR MASTER. This is happening when ACCOUNT HOLDER and VENDOR are different. When ACCOUNT HOLDER and VENDOR are same it is displaying Correctly.The Bottom line is when VENDOR=ACCOUNT HOLDER, in the payment file it is displaying the VENDOR name correctly. But When VENDOR is not= ACCOUNT HOLDER, in the Payment file ACCOUNT HOLDER name is blanked out. The bank requires the name in that field in the payment file.
Kindly Assist me
Thanks in advance
Regards,
Akash Narayana

Hello Friends - Can you please give me a little idea on what could be the reason for the below issue.
We are using the program RFFOJP_T and when payment file is generated, some of the payment details are missing.
I have executed payment run for 5 payments and only one 1 has come to the file and below 4 are missing.
The following payment documents/payment orders were not updated
(Result of the payment document update)
    CoCd Payment document/Payment order
    9770 1400001524
    9770 1400001525
    9770 1400001526
    9770 1400001527
The accompanying payment media have not been generated
>
> Overview of the files generated (DME)
> Name / File name
Thanks

Tables in which basis users details are stored

Hello,
I'm writing an application to read Basis users details using JCO. But I'm not able to locate in which tables the users details are stored. I tried looking at USR* tables, but most of its tables doesn't have data. Only usr01 and usr02 are having some relevant data. I also tried looking at ADR* tables, which are again of no use.
If anyone knows in which tables Basis users details are stored, please let me know.
Thanks & Regards,
Chandrasekhar.

Hi Chandrasekhar,
SAP users are stored in the usr01 table (see transaction SE16.)
Best regards,
Houcine

Payment details are missing in the file generated by driver program RFFOJP_T

Hello Friends – We send the payment files generated by driver program RFFOJP_T (Payment Medium Japan - Domestic DME (and Bank Charges)). Now, we see issue that couple of payment details are missing in Output file/AL11.
If 20 payment documents are created in F110, only few are shown in AL11/Output file.
Can you pls give me a little idea on how to analyze this issue.
Thanks

Hello Friends - Can you please give me a little idea on what could be the reason for the below issue.
We are using the program RFFOJP_T and when payment file is generated, some of the payment details are missing.
I have executed payment run for 5 payments and only one 1 has come to the file and below 4 are missing.
The following payment documents/payment orders were not updated
(Result of the payment document update)
    CoCd Payment document/Payment order
    9770 1400001524
    9770 1400001525
    9770 1400001526
    9770 1400001527
The accompanying payment media have not been generated
>
> Overview of the files generated (DME)
> Name / File name
Thanks

Error while trying to submit Access request to GRC from IDM

Hello
We have SAP IDM 7.2 SP8 installed and done all the prerequisite for connecting to GRC AC 10 as in configuration document.
We are trying to submit request to GRC using Standard GRC provisioning framework task ( AC Validation) but pass: Submit AC Request fails with error: "Pass stopped by script"
Is there anything wrong with the script which put RoleData details since its getting aborted ?
I tried providing Role name directly in Role data attribute inside the action task and got following error:
Error
putNextEntry failed
storingcn=IDMUSR0023,ou=useraccessrequest,o=grc
Exception from Add operation:javax.naming.NamingException: [LDAP: error code
82 - (GRC User Access Request:82:Script execution failed)]; remaining name
'cn=IDMUSR0023,ou=useraccessrequest,o=grc'
I checked VDS Logs and there was one error :
Additional message = msgcode=4;msgdescription=Mandatory field ITEM NAME is empty in line no 1 ;msgtype=ERROR
From where exactly ITEM NAME field value will be fetched and pass to GRC for request creation ?
Regards
Deepak Gupta

Thanks Christopher
I got my issue fixed, There was issue with my GRC Initial load job which couldn't enrich repository privileges and hence the issue was coming since script wasn't able to find GRC ROLE ID and Application ID attribute from privileges.
Regards
Deepak Gupta

After a UPSA connection edit, all my user profiles are "missing from import"

Hi there,
I've got a problem with my User Profile Service Application. I edited my existing connection to add some new OU containers to the list, after the networks team had done some
restructuring to reflect an organizational change. Then I ran a Full Synchronization. But now all of my user profiles show up under the "Missing from Import" list. I still have 943 profiles in SharePoint, and not surprisingly, people search isn't
working. I suspect that I did something wrong in the process of selecting the Users OU containers in the AD tree (in Populate Containers), but I cannot see what, since I replicated the selections that had been made for an unchanged department, to
the ones that had been reorganized.
Any help appreciated.
Tom
SharePoint Systems Officer, Capital Regional District, BC, Canada

Hi Tom ,
According to your description, my understanding is that all the user profiles are showing up under "Profiles missing from import" list after you edited the existing User Profile Synchronization
Connection.
For your issue, it can be caused by that your User Profile Synchronization Connection is unable to connect to your AD. Please make sure the account used to connect to Active Directory to import
profiles has access to the Organizational Unit you are importing from. By default this account is the Default Content Access account. And the Default Content Access account must be a domain user account and it must have read access to external or secure
content sources that you want to crawl by using this account.
Then you need to check if the “Profile Synchronization” job status is “succeed”.
Also please check the “Sync filter” for the service, and make sure the account are not include in the Exclusion Filter for Users.
For a workaround, you can just delete the existing connection , recreate it and perform a full synchronization.
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contact [email protected]
Eric Tao
TechNet Community Support

Framed-Ip-Address missing in Access-Request & Acct-Start messages

We have a Cisco 7206(IOS12.2(33)) equipment associated with freeRadius server2.1.10. Upon PPPOE client start, dynamic IP is assigned from the IP-Pool to the PPPOE client. However this IP address, is not included in the Frame-IP-Address AVP sent in the Access-Request or Acct-Start message from the NAS. It is sent only in Acct-Update or Acct-Stop messages though, I have enabled this AVP inclusion with the NAS command, radius-server attribute 8 include-in-access-req
Also i have attached the configuration used in NAS for your reference. Request to provide your inputs to get this resolved at the earliest.
Appreciate your inputs.
thanks,
Raj

It worked well, after adding "aaa accounting delay-start" to the conf file.
thanks,
Raj

Split of an Access Request in GRC

Hello GRC Experts,
I have a following issue in my MSMP workflow:
I have created a MSMP workflow using detour Rule GRAC_MSMP_DETOUR_SODVIOL ar first stage. If an Access request contains SOD violations the request should be routed to Security stage. If works fine so far, but with one exception. We have requests which contain three roles, two of them have SODs and one is clean. I expect that only two roles which contain SOD should be routed to SOD path, and the role which is clean should go the normal path (No SOD path). However I am facing the situation that the whole request is routed to the SOD path and Security stage.
Do you have any idea how to solve this issue?
thank you in advance
best regards
Sabrina
Here are the screenshots from the MSMP workflow

Hi Sabrina,
we had exactly the same challenge - this is how we solve it:
- check parameter: 1073 Enable sod violations detour on risks from existing roles (recommended YES)
- routing level - make sure the stage settings (where your routing rule is executed) are set to "line item level" under MSMP Workflow configuration / Maintain paths/ maintain stage settings
Hope this helps,
Filip

Automatically reject access requests in GRC 10.0

Hello friends,
In PMU WF has set three escalations, when no one approves the request after a while, can automatically reject these access requests?

You can use the Stale Request functionality to CANCEL requests that have not been worked on after x amount of days.
Schedule ABAP GRFNMW_BATCH_STALE_REQUEST to run daily. This is done by individual MSMP Process IDs.
Thanks.
Kevin Tucholke

GRC 10.0 Access Request Creation- Data Source of User Details

Hi Experts,
I was doing GRC 10.0 Configuration and found a query which I am not able to resolve.
While creation of any kind of Access Request in GRC through NWBC> Acces Management Tab>Access Request>Access Request Creation.
In the user details section, I can see the HR records( like Pernr, position, manager) have been visible to some extent.
My question is where from these details came in GRC. What configuration we should maintain to achieve these HR records?
Hope to get a quick response as this is one of the requirement of the implementation which I am doing with my customer.
Thanks,
Atanu

Alessandro,
Thanks for your response. It helped me to know certain things.
But when I am navigating to SPRO > GRC > Access Control > Maintain Data Sources Configuration > [User Detail Data Source], it is configured with a ECC system in target connector and User data type is maintained as "SU01".
Now my question is where from in my case the GRC is pulling the HR records (PA20) like PERNR, POSITION,PERSONEL AREA etc? SU01 does not provide these information. My ECC box is integrated with HR module, so is it taking the data from HR directly?
Thanks in advance!
Atanu

GRC 10.0: Access Request Creation - LDAP user advanced search not working

Dear Experts,
We are implementing SAP GRC Access Control and we have an issue in Access Request Creation. If we put the user name in “User” field and press intro, the user details are updated, but if we want to make an "Advanced search" the user is not found and the application give us the following message: “No records found for the search criteria entered.”
Scenario 1: If we put the user name in “User” field and press intro, the user details are updated:
Scenario 2: If we want to make an "Advanced search" the user is not found and the application give us the following message: “No records found for the search criteria entered.”
We are using the Active Directory as Data Source.
Thanks and Regards.

Hi Jose,
Try maintaning the parameter 2050 as YES and check once.
Kindly, also make refer to the below list of SAP notes:
1757906 - GRC 10.0 - LDAP user search does not work in NWBC
1745370 - LDAP search in GRC does not work anonymously
1718242- UAM: User search not working in Access Request.
Regards,
Neeraj Agarwal

GRC 10 - Legacy connector as user detail data source

Hello,
I'm trying to use a legacy connector (with a text file as input) as a user data-source.
Repository user sync for this legacy connector works : checked GRACUSER table, it is populated with all the user details from the input file (id,firstname,lastname,mail,department,phone
I got it working for user search data source : when creating an access request for "other" user, searching for a user ID/name works : data are displayed in search result, however when I select the user from the serach result the user details are not populated in an access-request form.
Any clue about this ? Any one already got this working ?
GRC 10.0 SP13.
Checked SP14 and SP15 release notes, and found no relevant notes yet.
repository-related notes applied :
-1864423
-1950231
Regards,
Emmanuel.

Hi Pedro,
You only have confirmed that 2 accounts are maintained in HCM and in SU01 as well, so you would be able to see these accounts' details both ways.
Yes, you are right about user account maintenance first in HCM at the time of new hire, then you can manually raise the access request to grant them access to various SAP systems. Or in order to automate this process as Prasahant suggested, you can take help from HR Triggers.
You can refer: GRC 10.0 - HR Trigger configuration - Governance, Risk and Compliance - SCN Wiki
But responding to your original discussion, whatever user accounts are maintained in HCM you would see those details provided you define HR for the "user search data source" AND from SU01 for "user detail data source"
In your case you have 2 accounts which have been maintained in HCM as well as SU01, so that is what creating confusion for you.
Let us know if you need any more clarifications.
Regards,
Ameet

AC 10.1 remove tabs from Access Request

Hello,
I checked the forum for my specific issue but didn't find what I was looking for.
We're on GRC 10.1 V1100 SP04
Here's the scenario...
- We're requesting a new role to be assigned to an existing user in ECC using the Access Request form from GRC AC 10.1 system.
- I've created a new Request Type "Change Account" with actions Retain/Remove/Assign under process id SAP_GRAC_ACCESS_REQUEST
- We cannot modify the default EUP ID 999 Maintain EUP as they are SAP values & hard coded
- We even copied the 999 and made a custom EUP and made these fields non-mandatory but we want to remove these unnecessary tabs
So what's happening is when we put in a request for assignment of a new role to a user...and hit submit after selecting the role it is asking for "Enter the value for Email" & "Enter the value for Last Name"...which are mandatory fields.
Does anyone know how I can remove/hide the Risk Violations, User Details, Parameters, User Groups etc tabs which are NOT required in this request...we only need the User Access & Attachments tab.
I know in SE80\Access Request package there is a way to hide these BUT I do not see this form under the packages.
Is there any other way?
Thanks in advance,
Rajiv

Hi Rajiv,
Please check the below path
Go to SE80 T-code and select package from the drop down and enter GRAC_ACCESS_REQUEST.
Then in the Web Dynpro tab go to FPM Applications and there you can find the aplication GRAC_OIF_REQUEST_SUBMISSION where you can make your changes.
Regards,
Neeraj

User details are missing in Access request in GRC 10.0

Similar Messages

Maybe you are looking for