User Valid to changed while assigning role to a set of users in SU10

Hi All
I had a task of assigning a role to a set of users in various systems across landscape. I find that some of the users had their valid to date (logon data tab) changed to their last login date. Moreover, in every system; the list of user ids who had this issue of valid to date changed to their last logon date is different. It seems it occurs randomly in various system but out of every 10-11 users 3-4 get affected with this issue. Has anyone faced such an issue before and how could we resolve this issue.
Many thanks for your help and time !!
Best Regards
Prashant

Have you checked OSS notes? Maybe note 1325775 may be relevant for you.
Cheers

Similar Messages

Error while assigning roles to java users

Hi Experts,
I am trying to create a user on a Java system ( databse not LDAP) and assign a role. I am able to create a user successfully but it fails with following error;
Pass: SetJavaRole&GroupForUser.
Error putNextEntry failed storingtestidm123
Exception from Add operation:com.sap.idm.ic.ToPassException: No such objectclass defined
Exception from Modify operation:com.sap.idm.ic.ToPassException: SPML exception: No valid id to modify defined
ACCOUNTD1U testidm123
MXREF_MX_PRIVILEGE 316
MX_ENTRYTYPE MX_PERSON
DISPLAYNAME test user
MX_LASTNAME idm
MX_FIRSTNAME test
ACCOUNTD1E testidm123%
TEMPACCOUNTD1E testidm123
MSKEY 6179
MSKEYVALUE testidm123
The pass reads as follows;
SPMLID : %MSKEYVALUE%
assignedrole : PRIV:ROLE:SID:idm.authenticated
Regards,
Shailesh
Edited by: Shailesh Deshpande on May 3, 2011 6:43 PM

Hi Shailesh,
Can you please take a look at note 1476301. I hope it helps.
Thanks,
Anderson

Error role while assigning to user

Hi,
I am using protal 6.0 in my project.I have small bug while assigning role to user.
I assigned role to user and after role assined, the role check box is in disable.I can't remove that role for that user.
And the role is not working for that user.
Can any one tell me what is the problem?
Regards,
Suresh

Hi Baji,
I had assigned the same role to 400 users.Its working for all user but for this user ia m facing problem.
Cany clues regarding this issue.
Regards,
Suresh

Error While Assigning Approval Management Roles to User

Dear All,
While assigning "Approvals Management...." Roles to the user through User management responsibility and Click on to Apply Button I am getting following Error.
oracle.apps.fnd.framework.OAException: java.sql.SQLException: ORA-01403
ORA-06512: at "APPS.UMX_ACCESS_ROLES_PVT"
Can anybody help me to get rid of this error.
Thanks In Advance
Jithindev

Hi,
Standard roles are not assigned to users directly.Make sure that copy the role from standard roles then change naming convention like your company specification.
Ex: standard role : SAP_BC_JSF_COMMUNICATION_RO
Step:1: go to t-code: PFCG and give the role name in role tab SAP_BC_JSF_COMMUNICATION_RO
Step:2: press copy button and change the naming convention.
Step:3: Assign to the user.
I hope it will help you.
kiran kumar.v

SECATT for assigning roles to users

Hi All,
How do we make the ECATT to work for the below scenario:
Users already have roles assigned to them. We need to add a new roles to the users which can vary in number based on the users job.
A simple ECATT script that was developed to add a single role to a new user does not work in the above case and gives an error of invalid batch input. How do I create a ECATT to assign role to user who already has a set of roles assigned (number of roles assigned to users differ, so I cannot assume to train the ECATT to assign a role on line X). Is there something I am missing while the ECATT script creation?
We are doing this from a CUA and its very difficult to assume how many roles a user could have.
Thanks,
Jay

Thanks Alex for the insight. For some reason SU10 is slow in the CUA environment and I wanted to avoid it but yes I finally had to use SU10. Talking to one of our ABAPer I came to know that even in their BDC recordings they get the error which I receeived, but he changes his program to skip all the lines with data and then fill the empty line.
In CUA environment, how do we create ECATT to delete a role from many users?
Thanks,
Jay

Error while Assigning database level role (db_datareader) to SQL login (Domain Account)

Team,
I got an error while creating a User for Domain Account. Below is the screen shot of the error (error : 15401)
Database instance is on SQL 2000 SP3. ( I know it is out of support, But the customer is relutanct to upgrade)
On Google search, i found below article which is best matching for this error
http://support.microsoft.com/kb/324321
I have follows each step of troubleshooting. But still the issue persists.
Step 1. The login does not exist == The login is very much exist in the domain as i am able to add the same domain id to other database instances
Step 2. Duplicate security identifiers == i have used this query to find duplicate SID
/* SELECT name FROM syslogins WHERE sid = SUSER_SID ('YourDomain\YourLogin') */
But there was only one row returned with create date of today's.
Error while Assigning database level role (db_datareader) to SQL login (Domain Account)
Step 3. Authentication failure == Domain is available. User is able to login on other servers via RDP connection.
Step 4. Case sensitivity == Database collation is set to Case insensitivity. (CI)
Other two 5. Local Accounts & 6. Name resolution == is not applicable to me.
I tried other ways also.
A. Creating login and providing permission in one go only = User account is not created
B. Instead of GUI, use query to create login and provide required permission = Same error.
Does anybody has faced any such situation
Chetan

See the below output
srvid
sid
xstatus
xdate1
xdate2
name
password
dbid
language
isrpcinmap
ishqoutmap
selfoutmap
NULL
0x010500000000000515000000A1F66E1BFC1DC75D26E72530A2B80400
14
20:25.9
57:33.4
UKBAA\LHRAPPMuttavarapuS
NULL
1
us_english
0
0
0
Chetan

Why Case-Sensitive while assigning tasks to other users??

I am trying to assign a task to another user through AdminUI.
While searching for users, I am supposed to provide case-sensitive search text to find actual users.
In previous installations it is not a problem. i.e only in production it happens.
Is there any place to modify this settings?
Please see the attached screenshot of the page.
Thanks,
Nith

Raghu,
thanks for the reply, you are right as per the audit .But suppose if it is for 200 users ,creating 200 CUP requests will be impractical right.
there should be some solution for this , because there will be many situations practically where we have to assign roles to N number of users.
Is this possible in GRC 10 ? any idea ?
Regards,
Jaags

How to change HR assignment for BP with employee role in CRM

Hi,
we download employees from R3 HR into CRM. By mistake, some duplicates BP were created. we want to change the assignment with the BP employee in CRM and the employee in R3. In other word, to remove the personnel number ID stored in CRM and to add this personnel ID to others BP in CRM.
For example:
In CRM, BP 100 does not have a personnel number assigned to his employee role.
In CRM, BP 101 (duplicate of BP 100) is assigned to the personnel number 345 from the employee in R3.
We'd like to assign the personnel number 345 to BP 100 and remove the link with HR in BP 101.
is it possible? where is this assignment stored - In R3&HR or in CRM?
can you guys share your experience on how to resolve this
thanks in advance
Stephanie
Edited by: Stephanie Blouin on May 6, 2008 2:16 PM

Hi,
We can assing the CC in two ways.
1. is for position.
2. or for a Org unit.
In your case if it is for Position. GOTO PP02 enter the details as
Plan Version    HI
Object Type     s
Object ID       50018133
Object abbr.
Infotype        1001
Subtype         A011
Planning status 1
Validity        06/23/2008 to     12/31/9999
Data sample.
Then goto change and change the CC. this will also updates the IT0001.
If not, You can also change through Org unit.
Where goto PPos_old> select the org unit> then goto staff assignments> select the required position> and there is a option called goto from top menu> there you can check accoutn assignment> there you will get diff screen to be displayed--> there select the position if you want to change and select the option maste cost center and change the CC by giving dates, this will also updates the IT0001.
Reward me if hleps.
Thanks,
Vasu.

A question about users assigned roles extraction

Dear all,
I have a question about users assigned roles list extraction. I need the list of the users who have already been created along with their assigned roles. According to what I found on Google, there is a table named AGR_USERS which provides the roles assigned to each user. Yet, this table provides only the SAP ID of each user along with the assigned roles. What I need more is to have also the first name and second name of each user.
So, do you know any table providing at least the following information:
1) First name of each user
2) Second name of each user
3) SAP ID of each user
4) All assigned roles to each user.
NOTE: I really need to have first name and second name in separate columns
Thanks in advance,
Dariyoosh

>
Shekar.J wrote:
> Agr_users for the user ID and role assignments
> USR02 to check the validity of the User ID
> and USER_ADDR for the first name and last name
>
> You can create a Table join of the above 3 tables to retrieve the data you require
Thanks to you and others for your attention to my problem
I don't know anything about ABAP programming, is there any transaction allowing to create this join? As it seems to me the column "UNAME" in the table "AGR_USERS" and the column "BNAME" in the table "USER_ADDR", both refer to the SAP ID of the user. As a result the condition of the join would be "WHERE (UNAME = BNAME)", is there any transaction/programme allowing to create this join?
Thanks in advance,
Dariyoosh

E Portal User Administran--Automatic loss of assigned roles of users

Hi All,
Some users are losing assigned roles automatically without anybody modifying User administration part.This is happening frequently.
My senior told me that
"<b>roles are based on Active Directories. When Users move from one location to another there is change in the Active Directories.
If Active directories do not get refreshed properly roles will be not come up.</b>"
Please guide me.
Thanks in advance,
Gangadharayya.

Hi Gangadharayya,
Check the Unique ID of the user(whose role has lost) in the system Administration --> support -->support Desk -->
User Management >Test component for UME objects
Enter the user ID of the user(whose role has lost)in the Get User table. And click the 'Get' .
And in the bottom of that screen you ll get the 'UME User toString' table. In that get the unique ID of the user and check this unique ID with the LDAP.
Try the same steps from the role. Give the Role ID search in the 'Get Role ' column and click get. Now compare the unique IDs of the user.
Regards,
Birla.

How to change the portal role presentation based on users BW authorization?

Hello,
I have created 3 BW Roles, each one contains an iView with a certain report.
For simplicity let's name the Roles A,B,C and assume that in order to see the proper report the user needs to be assigned to the matching group (A,B,C) at the BW side.
I have imported these 3 roles to the portal as worksets, created new pcd role, placed these 3 worksets inside the new role and assigned this role to a certain group of users in the portal (these users are ABAP users so they are the same at the BW side as well).
What I would like to do is this: I would like that each user that I have assigned this new role to will see only the worksets that he/she allowed to see based on it's BW authorization. Meaning, if I have been assigned roles A and B at the BW I will see only worksets A and B inside the role.
The problem is this: From the portal I cannot assign the users to the BW groups and from BW I cannot control pcd roles so this kind of change requires me to make two modifications: One for authorization from the BW and one for presentation from the portal. I would like to manage it just from one place, either from the BW or from the portal, I don't care.
How can I achieve this?

I think I have found a solution: Export it as a role instead of a workset and do one to one assignments with the BW groups.

Need to delet or assign individual roles without changing all existing role

Hi
I am looking for a way in order to delete or add single roles without touching all other roles a user has.
I found various BAPI_USER_* , however they always change the entire role assignment.
Does anybody got an idea or an associated BAPI`?
Thanks a lot,
Kind regards,
Mingolo

Hello Minima
The corresponding BAPI is BAPI_USER_ACTGROUPS_ASSIGN. In to delete only specific roles you first have to read the assigned roles of the user using BAPI BAPI_USER_GET_DETAIL.
Now here the procedure:
(1) Read the assigned roles for a given user using BAPI_USER_GET_DETAIL. The roles are returned in TABLES parameter ACTIVITYGROUPS.
(2) Delete the role you want to unassigned from ACTIVITYGROUPS.
(3) Change the user using BAPI_USER_ACTGROUPS_ASSIGN with the modified list of roles (in ACTIVITYGROUPS).
The logic behind this is as follows:
- the BAPI BAPI_USER_ACTGROUPS_ASSIGN compared the imported list of roles with the currently assigned roles.
- If one is missing, it is unassigned.
- If one is new, it is assigned.
- All others role assignements remain.
Regards
Uwe

List of Portal users with the assigned Roles.....

Hello All,
I am working on EP6 SP9 and want to know from where can I get a list of all Portal users along with the assigned roles for each of them.
One way I found is by searching for all users in User Administration role and along with the searched users, there is also an icon for Assigned roles.
Apart from the above mentioned way, is there any other way by which I can get a direct list of the same. Is there a Java sample code for this.....?
Please help.
Awaiting Reply.
Thanks and Warm Regards,
Ritu R Hunjan

Hi Ritu,
Yes it is possible to get the roles of the users. You can try the following java code.
package com.hcl.user;
import java.util.Iterator;
import java.util.Vector;
import com.sap.security.api.IRole;
import com.sap.security.api.IRoleFactory;
import com.sap.security.api.IRoleSearchFilter;
import com.sap.security.api.ISearchResult;
import com.sap.security.api.IUser;
import com.sap.security.api.IUserAccount;
import com.sap.security.api.IUserFactory;
import com.sap.security.api.UMFactory;
import com.sapportals.portal.prt.component.AbstractPortalComponent;
import com.sapportals.portal.prt.component.IPortalComponentRequest;
import com.sapportals.portal.prt.component.IPortalComponentResponse;
public class role_member extends AbstractPortalComponent {
public void doContent(
IPortalComponentRequest request,
IPortalComponentResponse response) {
try {
IUserFactory userfactory = UMFactory.getUserFactory();
IRoleFactory rolefactory = UMFactory.getRoleFactory();
IRoleSearchFilter rolefltr = rolefactory.getRoleSearchFilter();
rolefltr.setMaxSearchResultSize(2000);
ISearchResult result = rolefactory.searchRoles(rolefltr);
while (result.hasNext()) {
response.write("<table border=0>n");
String uniqueid = (String) result.next();
IRole role = rolefactory.getRole(uniqueid);
response.write("<tr><td bgcolor=Red>"+ role.getDisplayName()+ "</tr></td>n");
Iterator users = role.getUserMembers(true);
while (users.hasNext()) {
String unique_user = (String) users.next();
IUser user = userfactory.getUser(unique_user);
IUserAccount account[] = user.getUserAccounts();
response.write(
"<tr><td>" + account[0].getLogonUid() + "</tr></td>n");
response.write("</table>n");
response.write("</br>n");
} catch (Exception e) {
This code gives you the list of all the users of your portal along with the roles assigned to them.
Apart from this if you want you want to know all the roles assigned to the user on portal itself then the way you mentioned is the correct method.
Regards
Pravesh
PS: Please consider awarding points.

How to assign roles to users using WL api?

Hi,
We have a requirement to allow creation of new users through application screens and assign groups and roles to those users.
My users will exist in external LDAP server while my groups and roles will exist in embedded LDAP server. Using WL APIs i am able to create users and add them to groups using the code peices given below:
========================================
userProviderControl.createUserSimple(form.userID, form.password);
groupProviderControl.addUserToGroup(ocnGroup, form.userID);
========================================
How do i assign roles to this new user programatically?
If i add a role from console (Home > Realm Roles > Summary of Security Realms > myrealm > Realm Roles -> Global Roles) and edit role condition to add this newly created user then i it works fine. I want to achieve the same i.e. edit role condition programatically.
Any help will be greatly appreciated.
Thanks,

Problem Solved !!!
The data-type conversion needs to be performed in the SPML2 Person Form. Add a Field called waveset.roles and map it to the SPML2 attribute name being used in ur client. It's best done through a rule.....
If anybody is facing similar problem and need more details....please email me @ [email protected]

Problem while assigning multiple staffing to project role.

Dear All,
I am facing problem while assigning multiple staffing to project role.
In the project role, we are doing staffing ( assigning BP). While assigning the BP's getting below errors.
Resource assignments overlap
Message no. DPR_BUPA_LINK004
Diagnosis
The validity period '10.02.2008'-'01.03.2008' for the assignment of project role Product Manager and ' Rakesh Pradhan' overlaps with the validity period of the assignment ''.
However, the project role type does not allow several staffings to be edited at the same time in the project role.
System Response
The system does not allow this constellation of data when saving.
Procedure
Check and correct the start and finish dates of the staffings affected.
Request you to advise in fiixng the issue.
Thank you for your cooperation.
Regards,
Ranjan

Hi Biplab,
For multiple staffings in the same time frame, check the option of 'Edit in Parallel' in the Role Type settings in SPRO.
Let me know if that helps.
Regards,
Vivek Pandey

User Valid to changed while assigning role to a set of users in SU10

Similar Messages

Maybe you are looking for