Users assigned to CRM Business Roles

Is there a report that can show what users are assigned to what Web UI business roles. We have business roles assigned to positions and not PFCG roles. If not, what table to show business roles assigned to positions numbers so I can atleast query names on positions that have specific business roles.
Thank You,
Alex

Hi Alex,
Normally the AGR_USERs table through SE16 can give you this output
in AGR_USERS table go and set the ORG_FLAG and COL_FLAG to get the output, you could also do this just for roles
AGR tables.
also if you have a proper naming convention please search by "UIU" string most of the WEBUI roles supplied by SAP has this key word "UIU"
Also you can go through SPRO ("UI Framework") to see the default business roles assigned to the "UIU" roles supplied by SAP.

Similar Messages

CRM business role - user mapping initial load

Hi,
I'm tyring to initial load the data from the CRM systems into IDM. I'm able to get all data of the users expect their business role mapping(parameter in CRM).
in the read pass of the user from the abap initial load , the attribute for the parameter is as follows,
                    Target                                                                             Source
sap%$rep.$NAME%Parameter1:Info:VARCHAR:255|                        parameter1
but no data is stored in the parameter1 table though the user has some parameter mapped in the CRM system
Can anyone plz help to load this user-business role mapping details.
Thanks in Advance.
Regards,
Pricy

Hello Pricy,
can you just give me some hints on what you are trying to do exactly?
My assumptions:
- CRM business role is stored as user parameter in ABAP SU01 user data, right?
- you want to read all the ABAP user data from your CRM system INCLUDING the user parameter data from ABAP SU01 user data, right?
If that is the case at least the loading part should work pretty fine. I just tried this on my local system and had no issues, all user parameters of my existing ABAP users where loaded into one temporary table.
-> Pass: ReadABAPUsers -> table "sap%$rep.$NAME%Parameter1:Info:VARCHAR:255|"
Did you find this temp table created on your database correctly? My table is there and is called "sapT01_001Parameter1" (where my repository is named T01_001) and it contains all the existing user parameters.
What exactly is your issue?
Regards,
René

Logon is not possible because you have not been assigned to a business role; please contact your system administrator

Hi experts,
I'm having a problem when our project approaching the end.
If I assigned the business role in parameter CRM_UI_PROFILE and PFCG role in SU01.
It works fine,and the user can logon the web ui.
Now I created a new organization model and position,assigned the business role and user to the position.
A PFCG role was also assigned to the business role:
Then I removed all the roles and profiles in user master in SU01.
The user can not login CRM WEB UI and the system raised "Logon is not possible because you have not been assigned to a business role; please contact your system administrator".
Can anybody suggest what the problem is? Is there any other settings I should make?
I suppose that,since the user was assigned to the position the organizational model, the system can determine the user's business role, and through the business role, the corresponding PFCG role can also be determined.
Am I correct?
Thanks.
Jerry

Jerry, yes, you're right.
Let me point you to pretty good explanation right here: Logon is not possible because you have not been assigned to a business role; please contact your system administrator
So business role determination is taken in three steps (you can observe them in class CL_CRM_UI_PROFILE_DETERM method LOAD_PROFILES):
1. From user's parameter CRM_UI_PROFILE (method LOAD_FROM_USER_PARAMETER);
If CRM_UI_PROFILE = * then the user needs to have S_DEVELOP authorization object with OBJTYPE = 'DEBUG' (debug authorization).
2. If not found on previous step: From organizational management (method LOAD_FROM_ORG_MANAGEMENT)
3. If not found on previous steps: Based on PFCG roles (method LOAD_FROM_PFCG_ROLE);

Logon is not possible because you have not been assigned to a business role

I am getting the message u201CLogon is not possible because you have not been assigned to a business role; contact your system administratoru201D when I try to access an incident ticket SMIN I created in SolMan 7.1. I have seen this exact error in lower releases and was able to resolve it by making sure the business partner had a General and an employee configured. Unfortunately on 7.1 I have both but I still canu2019t open the message I created. Same error if I test SICF service /default_host/sap/bc/bsp/sap/ crm_ui_start. I have gone through SOLMAN_SETUP IT Service Management and Generate BP Automatically but no luck so far. Any ideas? Thank you,
David

Hi,
As far as I know, you need to maintain business org details (like org name, positions, business partners etc) in the ppoma_crm tcode. Then have to assign a position to your user ID. This assigns the business role as well.
This link should be helpful:
http://www.sapcrmsecurity.com/SAP%20CRM%20Business%20Role.html
Regards,
Srikishan

CRM business role

Hi all,
how to create business role and how to assign 5 business roles to an organizational unit.

Hi pramela
Follow the below SPRO path in CRM system
Customer Relationship Management->UI Framework->Business Roles.
Take any standard business role (say for example SALESPRO) and copy the business role change accordingly as per your requirement.
once this is changed go to transaction PPOMA_CRM (Organization unit maintainance) from here search for relevant organizationunit under the organization unit you will found the positions under the positions you will see the Assignment of either users or Business partners as Central persons.
Here you have to remember two points either you can assign ROLE to Organization unit or Position. If you assign it at organization unit level the sub organization units and positons will get that assigned role.
if you assign at position level , the users only assigned to that position will get that rolee.
How to assign the role. Doube click on any organization unit or position that you want to assign the role, From the menu path
GOTO->DETAILOBJECT->ENHANCEDOBJECTDESCRIPTION after going here you will see Maintain object screen under ACTIVE TAB search(scroll) for the infotype with name BUSINESS ROLE , select the business role and click on create button (on top you will see the create button) in the create screen specify your role.
if you assign five users to the same position then you have to carry this only once, if they are assigned to several positions under differnt organization units you have to assign those many times.
Thanks & Regards
raj

SOD User Violation report by Business Role

All,
Is there a current method for generating a User violation report that shows all SOD's via the technical role and which Business role that, the Technical role is associated to in GRC?
Currently the reports that I am seeing do provide the transaction, authorization, and technical role level of any violation and what business process triggered it but does not show which business role(s) that these conflicting SOD's reside in. (especially if a user is assigned to 2 or more business roles)
Audit is pulling reports of users with SOD's and asking to re-mediate the SOD but currently we have to do dumps of all of the business roles a user is assigned to and then compare the role listed in the violation with the technical roles listed in the assigned business roles of the user.
is this available at all? or maybe in 10.1?

Dear Michael,
yes exactly - the new feature comes with the note. It is also possible to implement this note in 10.0 (it's included in SP17 but can be implemented earlier).
See the following screenshot how it looks like in an productive environment after implementing this note:
[BR] stands for Business Role.
Hope this answer the question.
Bestregards,
Alesandro

CRM2007 How to add a Web Dynpro ABAP application to a CRM business role

I am investigating CRM2007 UI framework and I cannot seem to find a way to add a custom made Web Dynpro ABAP Application (created in CRM 4.0) to a business role, or how to add a custom transaction created in classic ABAP (transaction created via se93, progam created via se38). Whatever I do, I only see BSP components. I am using transaction BSP_WD_CMPWB.
Next to this it seems you can add/integrate Visual Composer applications to (there is an entry in spro called "integration of the visual composer in BI"). However, I presume we first have to meet the requirements for the portal integration in SAP CRM 2007 as described in spro. If somebody knows how this works, that would be great!
kind regards
Angelique Heutinck

Hello Angelique,
It should be possible to call web dynpro applications from the L-shape menu of CRM UI (check transaction CRMC_UI_NBLINKS). As for the old GUI transactions, you can embedd them also via transaction launcher using CRMC_UI_NBLINKS (search for "transaction launcher" in this forum, there is plenty of information on it).
Best Regards,
Yevgen
Edited by: Yevgen Trukhin on Jun 19, 2008 11:53 AM

CRM 7.0 How to create Business role & generate

Hi Team,
Can you please let me know some breif idea about CRM 7.0 security guide.
How to created Business role is this part of functional activity?
Whats the role of Technical colleagues BASIS guys in CRM 7.0 security .
Please help me to get some document regarding business role creation , generation , assignment & authorization checks in CRM 7.0.
Thanks & Regards,
Vyash Mishra

Hello Viyash
I will add the most important information for generation of business roles and assignment of authorizations to users.
You must first create the PFCG roles. PFCG role is built based on the Business Role.
Please see documentation in : SPRO
SAP Implementation Guide => Customer Relationship Management
UI Framework > Business roles > Define Authorization Role
Then the PFCG role can be assigned to the business role in
SAP Implementation Guide => Customer Relationship Management
UI Framework > Business roles > Define Business role
Finally you must assign business roles to Organizations or positions in organizations in
SAP Implementation Guide => Customer Relationship Management
UI Framework > Business roles > Define Organizational Assignment
The users that are assigned to such organizations / positions will be therefore linked to the business role.
With the previous steps the users will have the authorizations that are assigned to the PFCG profile that is linked to their business role.
Business roles are the main way to configure authorizations for users in CRM but you have more options that give you flexibility.Each business role has assigned one PFCG role, but the relationship between business role and PFCG role is not strict. You can even assign a dummy PFCG role to a certain business role in business role customizing and then go to transaction PFCG and assign other PFCG role(s) to the users that are assigned to that business role.
I would say that the previous tasks must be performed by the basis team but in cooperation with the functional team
Best Regards
Luis Rivera

Business role of user

Hi,
How do we find what business role is associated with the user in crm sap 2007?
Regards
Shilpi

Hi Shilpi,
Do the following :
1) Generate PFCG Authorization Profile.
Goto Transaction PFCG ->Select the role (example: BP_SLS_EMPLOYEE)->click on CopyAs -> Change the name to Z_BP_SLS_EMPLOYEE -> select "authorizations" tab page -> Generate Profile (click on button next to Profile Name -> display authorizations screen will be displayed -> click Generate Profile (shift+F5) button next to open button) -> Save -> accept transport request (if any))
2) Assign PFCG Authorization Profile to User
We can achieve this by 2 ways
a) Goto transaction SU01->enter user name (ex: SAPUSER01)-> select 'Roles' tab page-> enter PFCG Role (example: Z_BP_SLS_EMPLOYEE)-> select 'Profiles' tab page -> enter SAP_ALL and SAP_NEW -> Save
OR
b) Goto transaction PFCG-> select 'Users' tab page -> enter user name (example: SAPUSER01) -> Save
3) Assign User to the Business Partner (Employee)
Goto transaction BP -> create a new BP in role employee or open/display the existing BP in role employee (example: Shilpi) -> select role = employee -> select 'Identification' tab page -> enter User name (example: SAPUSER01) -> Save -> accept transport request (if any)
4) Assign Employee to the Organization Unit
Select the Organization unit and assign the BP employee to the position (position = sales employee) -> Save
5) Create Business Role
SPRO->Img->CRM->Business Roles->Define Business Role-> select 'SALESPRO' (business role)->click on CopyAs->Change the name to ZSALESPRO->only change PFCG Role = Z_BP_SLS_EMPLOYEE->enter->click on skip button (ignore any warnings)->Save-> accept transport request (if any)
6) Assign Business Role to the Position in Org. Model
SPRO->Img->CRM->Business Roles->Define Organization Assignment->select the position (example: sales employee)->double-click on position (to make sure that you have select position)-> click on 'Goto' -> click on 'Detail Object' -> click on 'Enhanced Object Description' -> select 'Active' tab page -> highlight 'Business Role' line -> click on create/change button to add the business role -> enter Business Role = ZSALESPRO -> save -> accept transport request (if any)
7) Refresh your Internet Browser
Tools-> Internet Options -> Click on delete files button -> select delete all offline content check box -> click on OK button
Logon to CRM WEB UI with the User (SAPUSER01)...
Please note that when ever you have saved any configuration in CRM, you have to come out of that sequence to reflect the changes made.
If this solved your problem, please award the points...
Cheers,
Peter J.

Business Role assignment now working as Expected

Hi All,
We have a User A, B and C , all these users have Business Role X, when these users were logging in they were gettings screens as per the configuration.
However now all of sudden Only User A ,though still has same Business Role X , is getting different Work centers,Logical links Mostly standard(Claim management, worklist, calendar,Email Inbox) .
User B and C who have the same business role are getting correct UI screens.
We are unable to find what went wrong all of sudden.
Thanks in advance for your suggestions
Regards,
Chandu.

Chandu,
If the CRM_UI_PROFILE is set to some UI Profile, this takes more priority(than the UI Profile assigned to the Business Role)
and shows the Navigation Bar and Work Centre configured for this UI Profile.
The normal Business Role configs wont work at that time.
Remove this entry and see, it will solve the issue.
Regards,
Masood Imrani S.

Issue regarding Business Role assignment

Hi All,
1.
I have a user Agent1 which is assigned to position POS_IC_AGENT in my org structure.
In the infotype Business Role I have assigned IC_AGENT (standard) business role.
IC_AGENT has PFCG role SAP_CRM_UIU_IC_AGENT assigned to it.
But, when I run the application (for my user Agent1), only telephony buttons are visible on top, navigation bar and work area is empty (nothing is visible there)
2.
Now, when I open my user Agent1 in SU01 and assign PFCG role SAP_CRM_UIU_IC_AGENT.
Now when I run the application everything is visible (telephony, navigation bar and workarea).
Why is it not visible in first case?
I think it should work without assigning Role in SU01.. I mean it should have taken settings from Org. structure
Regards,
Ashish

Hi Ashish,
As far as work center page context is concerned , its decided by the navigation bar profile and business role customizations ( we add work center home and several related stuff etc in navigation bar profile and make them activate/deactivate, visible/invisible through business role customizing ) .
PFCG role has nothing to do with what you see on the Work Center...it decides whether you can see or not..meaning whether you have authorization for disply of a business object and its related subobjects.
PFCG role basically determines the authorization objects that will be grated to the particular business role ( to which this PFCG role is linked ) PFCG is about CREATE/CHANGE/DELETE authorizations.
In first case, its business role linked authorizations. You dont see the work centers may be because USER has not granted the DISPLAY authorization for the business Object related to BP( i.e Account ) , or BO related to account search (BUPASEARCH ) as the IC agent home basically has Account identification home , or account search home...which overrides the PFCG authorizations attached to the business role.
Remember, individual object authorizations set for a user using transaction PFCG will have more priority over the Business role linked authorizations as 1 business role can be assigned to many users however if one user is not grated to see BP related data, this will still remain enforced even though the business Role PFCG is granting him to see...There is a difference between user specific authorizations and Business Role specific authorization...
In second case,its user linked Authorizations. When you add the PFCG role in SU01, this is being the User Specific Authorizations which will always have the priority and thus granting the display.
This is my basic understanding. I am 100% sure that PFCG role only controls the DISPLAY/CREATE/CHANGE related authorizations and lots more in context of authorizations. However what to include & show is decided by Navigation Profile and Business Role customizations.
If everything is intact in navigation bar profile and business role customizations, and still you dont see anything on the work center, then i am 100% sure that its related to User Authorizations
Refer pg 56 in CR580, it will clear your doubt.
Thanks & regards,
Suchita

GRC 10 BRM - Approve Single Role assignment in Business Roles

Hello,
I want to set up a workflow where any Single Role assigned to a Business Role requires an approval of the Single Role Owner.
The thing is that my customer doesn't have a Security Administrator, so what they want is that each Single Role Owner could be aware when their roles are assigned to a Business Role, especially when the Business Role Owner is another person.
Once the Business Role is created, the provisioning would be in charge of Business Role Owners.
Do you know any way to configure this?
Thanks,
Fernando

Hi Claudio - thanks for breaking it down
@ Fernando - for the Role Approval Methodology you need to split your approval out to be based on request type. Claudio has shown this up above already. In continuing his example, where the business role goes to path C - you would then have Path C do a line by line approval based on the single role owners
By using this role approval methodology your single role approvers are indirectly allowing any user who are approved the business role via an access request and that request is approved by business role owner (which is role owner).
As mentioned - you are using two different workflow process ids
Role Build - using BRM to approve the single roles being part of the business role
Access Assignment - approving the user to receive the business role which includes the single roles
Regards
Colleen

Business role not assigned..

Hi,
I am not able to see the webclient UI and it shows message " logon is not possible because you have not been assigned to a business role.
Please suggest me the steps need to be done to get the webclient UI for user.
Regards,
Nex

Hello Nex,
Do the following steps:
Txn:PPOMA
Click on Position and expand.
Click on 'Search Term' With Name* and Execute
You would see the list of Business Roles.
Double click on any of these roles like SALES PRO or SERVICE PRO or TPM PRO .
On RHS, Task Assignment , Right Click and select 'Assign'
Choose Holder- User and give your user name and save.
Or
In Txn:SU01 ,under the tab 'Parameters, you can give
Parameter ID CRM_UI_PROFILE
Parameter Value Role Name and Save.
Hope this helps!
Best Regards,
Shanthala Kudva.

Hide Top level navigation if user assigned only one role

Hi,
I would like to hide the top level navigation if user assigned with only one role.
I can create role based rule to show desktop using Master rule collection, but is it possible by doing to with role count.
If user has multiple roles show desktop1 else show desktop2

not sure if this possible ,you may check feasibility of creating a application which checks user role count and if role count is = 1 load the Portal url (URL alais) which had TLN iview invisible in the same window else do nothing and load the portal with the desktop which has tln.
Put the application in framewrk page which has TLN visible.
create a URL alias and create a desktop -framework page which dont have TLN ,assign this desktop to this URL alias in rule collection set its priority before user conditions check in rule collection so that it has high priority before user or group check in rule collection.
you can create a poc in sandbox and check if it wiorks?

Link to Business Role and User Account

How to link an user account with a business role so that the user account can work with the new UI?

Hi,
Go to transaction PPOMA_CRM. Search for your business role say SALESPRO in the Position Search.Double click on the role so that its details are visible on the right hand side.Then search for your user from the user search.When it comes in the left side bottom, drag and drop it to the position on the right side.
Regards,
Rohit

Users assigned to CRM Business Roles

Similar Messages

Maybe you are looking for