Workflow in Access Enforce

Hi Guys!
I have a doubt.... In my WF for approval access in CUP we have define 3 STAGES:
1- First Approval: Just define the function the user should have, he doesn´t choose any role-
2- Security: Selec the roles
3- Role Owner
When Security Lead selec roles.... my workflow re start waiting the First Approval. But I really don´t want this happen... there´s a possibility that if Security change the request this doesn´t happend and the request go to next stage (not back)???
Thanks!
Kind Regards

Yes, Karen. This totally depends on your stage level settings. Go to configuration -> workflow -> stage : select the security stage and scroll down to 'Additional Configuration'. Change the 'Path Revaluation for New Roles' to 'None' and this will not send the request to first stage for approval.
Alpesh

Similar Messages

Deleting Workflows in Access Enforcer

Hi,
I am trying to delete 'Paths' in AE and receive the below error.
<b> Error deleting Workflow Path. There are about 20 requests tied to this path.</b>
This is in the sandbox and the processing of requests does not really matter.
The 20 requests were for New Account creation, because of errors in Auto Provisioning the requests were not processed through the entire path, and were set to CANCEL status via the administartion function.
Despite setting to CANCEL I am unable to delete the path. Do we have a procedure/step to be able to delete a path in AE?
Thanks

Hi all,
after speaking with SAP support, the following SQL statements should be executed to delete "test" data from AE:
DELETE FROM VIRSA_AE_RQD_APLAP
DELETE FROM VIRSA_AE_RQD_APL
DELETE FROM VIRSA_AE_RQD_CSFLD
DELETE FROM VIRSA_AE_RQD_FWD
DELETE FROM VIRSA_AE_RQD_UPFL
DELETE FROM VIRSA_AE_RQD_MTGTN
DELETE FROM VIRSA_AE_RQD_PDPRL
DELETE FROM VIRSA_AE_RQD_POCAP
DELETE FROM VIRSA_AE_RQD_RLCF
DELETE FROM VIRSA_AE_RQD_RLAPV
DELETE FROM VIRSA_AE_RQD_RLPRL
DELETE FROM VIRSA_AE_RQD_SODCF
DELETE FROM VIRSA_AE_RQD_USERS
DELETE FROM VIRSA_AE_RQD_WFCLD
DELETE FROM VIRSA_AE_RQD_WFTRN
DELETE FROM VIRSA_AE_RQ_HST
DELETE FROM VIRSA_AE_DATA
DELETE FROM VIRSA_AE_CSTMDATA
DELETE FROM VIRSA_AE_INT_TRIG
DELETE FROM VIRSA_AE_REQ_DTL
DELETE FROM VIRSA_AE_RQD_ATCH
DELETE FROM VIRSA_AE_RQD_ORGRL
DELETE FROM VIRSA_AE_RQD_RLCF
DELETE FROM VIRSA_AE_RQD_WPCLD
DELETE FROM VIRSA_AE_RQD_WPFWD
DELETE FROM VIRSA_AE_RQD_WPHST
DELETE FROM VIRSA_AE_RQD_WPTRN
DELETE FROM VIRSA_AE_RQD_WFHST
DELETE FROM VIRSA_AE_REQD_HDR
This will delete all requests from AE and you will be able to edit workflow configuration again.
Cheers,
Alexi

Auto Email generation in multiple language in Access Enforcer 5.2

Hi All,
We have configured workflow in Access Enforcer 5.2 for autoprovisioning of users in the system. Requestor gets an email in english with the userid and password once the user is provisioned in the system. Now the requirment is to send these emails in different language, which is specific to the user. Like a spanish user should receive the email in spanish language.
Whether this has anything to do with language setting while user creation.
Please suggest.
Thanks & Regards,
Pravin

Hi Pravin,
It has nothing to do with the language settings for the user. This configuration has to be done in closing section of Email reminders under workflow. As per my experience with AE 5.2/CUP 5.3, I don't think this is possible as of now. This could be a good functionality, so you can open an enhancement request with SAP.
Regards,
Alpesh

Access Enforcer (error in creating a request)

Hi All,
when i am creating a new request in Access Enforcer . After filling alll the details and clicking the submit button it is showing a error in creating request .Path not found.

Hello,
You must have to select at least one condition attribute while creating your initiator. It seems initiator condition not meeting the details you are filling in your request. So it is not able to trigger the workflow initiator.
For simple scenario, if you are filling your company details in your request then change your initiator condition attribute to "Company".(Don't include more condition attributes for now). Once it works out then change initiator details back to your requirements.
Please let me know if this will not resolve your issue.
Thanks
Himadama

Validity date issue: Access Enforcer

Hi All,
There is a request in Access Enforcer wherein there are total 4 stages of approval, the first 2 stages have been properly approved however when the same arrived to the 3rd stage of approval, the validity date for the request was over and therefore the approvers tried to extend the same, but the "more" tab is not appearing and therefore the approvers are not able to approve the request by extensing the validity date.
Can you please help with this issue?
Thanks
Vani

Vani,
Go to the stage level settings for this particular stage via configuration -> workflow -> stage. Change the option of 'Change request content' to 'Yes' and the approver in this stage should be able to change the vailidity dates.
Regards,
Alpesh

CUA still necessary/recommended with Access Enforcer?

Hello forum members,
we are planning to implement SAP GRC Access Control for one of our clients. There are 5 R/3 Systems in the landscape, one of them a HR System. Currently there is no CUA in place an all users and roles are maintained separately in each system. Now with the introduction of GRC Access Control there is the question, if we should at the same time also have a CUA introduced or if it is better to directly provision the Users and Roles from Access Enforcer to the target systems.
What are the pros/cons to have a CUA in between? Does Access Enforcer also provide overview on all users in all system and the assigned roles?
Thanks for your replies.

This is a question that I'm asked all the time. For some environments, using CUA with AE is really nice. For other environments, it's just not feasible to have CUA as the security authorisation strategies are too inconsistent across systems.
For example:
a. There are three systems (ECC, BI, and SRM) implemented with a consistent top-down (job) approach to defining roles. So, a AP clerk will receive the 'AP Clerk' role in ECC, 'AP Clerk' role in BI, and 'AP Clerk' role in SRM (for simplicity). Obviously, the roles are different as they are for different systems, but the point is, it is easy to categorise the authorisations for a particular job across each of the systems. If security is consistent like this, then CUA can be implemented and the three single roles for the three systems can be grouped together in a cross-system composite role called 'AP Clerk'. When AE is implemented over the top of this, a user only has to request the 'AP Clerk' role (composite). AE performs the workflows, risk analysis etc and then finally passes the request to CUA, which then provisions out to the other two systems. Very easy from a user point of view as they only have to request one role, which is their job.
b. If however due to inconsistency between the systems, it is not feasible to group access into cross-system composites, it may just be better to go with AE without CUA. In this scenario, a user must request the applicable roles from each of the three systems. It is more flexible, but a little more difficult for the end user.
I normally spend quite a bit of time developing the Access Controls strategy during the blueprint phase of the implementation just to make sure that I'm coming up with the optimal design. A bit of prototyping helps also!

"Refresh" of development Access Enforcer system

Greetings!
Our Access Enforcer system is now in production. Our development system is quite a mess, with old requests and configuration. We would like to make the dev system look more like the production and test systems and get rid of all of the old requests, initiators, stages, etc. Does anyone know how to clean up AE so we can start over with a clean slate? We are on 5.2 with SP3, running on an AIX box with Netweaver only.
Thanks!

Hi,
I am not sure on the reasons for system refresh. Look at the below points:
1. The RAR data c(Rules, Functions, Risks etc) an be downloaded and uploaded in the Development environment. Why you need the production user data in Development?
2. The SPM users are intended for production. Why you are planning to copy/simulate them in development?
3. The ERM and CUPs are workflows, where the systems and other settings have to be created manually. What is your intention in getting them to development?
As per my knowledge, no system refresh is performed for GRC systems? May be you need to educate the client on these things. Please look for the ideas from the other experts too before you go back to your client.
Hope this helps!!
Warm Regards,
Raghu

Access Enforcer 5.2 open request details including stage.

Dear All,
We have requirement to pull the open requests in Access Enforcer 5.2, with the information of the stage at which the open request is.
We have a workflow with 5 stages. Now we have requirement to pull the information about open request along with the respective stage in which the request is. In AE 5.2, we can pull the information for open or closed request, but not with stage information for open request.
Please assist is there any alternate way to pull this information. or the java table in which the request details are stored. We have access to database.
Thanks & Regards,
GRC Team.

There is a query below that you need to list in the SQL box, but this address varies based upon your support pack. If you're up to date (or close to) on SPs, enter the following address into your web browser AFTER logging into AE: http://<server>:<port>/AE/opensql_test.jsp.
Paste the following query into the SQL box:
SELECT DISTINCT
WPHST.REQNO,
WPHST.REQPATHID,
WPHST.PATHNAME,
WPHST.STATUS AS REQUEST_STATUS,
TBLPATHSTAGE.STAGENAME
FROM
(VIRSA_AE_RQD_WPHST AS WPHST INNER JOIN VIRSA_AE_WF_PTSTG AS TBLPATHSTAGE ON (WPHST.PATHNAME = TBLPATHSTAGE.PATHNAME) AND (WPHST.CURRENTAPPRVRSEQ = TBLPATHSTAGE.STAGESEQ)) INNER JOIN VIRSA_AE_RQD_WPTRN AS WPTRN ON (TBLPATHSTAGE.STAGENAME = WPTRN.STAGE_NAME) AND (WPHST.REQNO = WPTRN.REQNO)WHERE
(WPHST.ISCURRENTFLAG = 1) AND ((WPHST.STATUS='OPEN') OR (WPHST.STATUS='HOLD'))

Access Enforcer/ CUP - Export/ Import?

Hi, I wanted to know if there is a export functionality in the access enforcer/CUP (GRC v 5.2)?? I wanted to export the workflows and other items I have created outside the current environment and import it to a different environment. Is this actually possible??
Thanks,
Ken

Hi,
You can go to configuration -> initial system data and select the checkboxes in front of the data you want to export. Click on export button and save the file. Now, you can import this data by going to same place in the other CUP system and import the file with 'clean and insert' option.
Regards,
Alpesh

Error in Auto Provisioning ( Access Enforcer )

Hi,
When I go to Access Enforcer -> configuration -> workflow -> auto provisioning , I get this error:
Application error occurred during request processing.
Details:   java.lang.NullPointerException: null
Exception id: [7ECF26E5A402006000000926000BB04A0004653E942D3D44]
This is how my trace file look like:
#1.#7ECF26E5A402006000000926000BB04A0004653E942D3D44#1237219355213#com.sap.engine.services.servlets_jsp.client.RequestInfoServer#sap.com/AEEAR#com.sap.engine.services.servlets_jsp.client.RequestInfoServer#J2EE_ADMIN#49704##n/a##d9a08ca0124311dec4817ecf26e5a402#SAPEngine_Application_Thread[impl:3]_6##0#0#Error##Plain###application [AE] Processing HTTP request to servlet [AEController] finished with error. The error is: java.lang.NullPointerException
        at java.lang.String.compareTo(String.java:449)
        at com.virsa.ae.service.cache.DropDown.compareTo(DropDown.java:71)
        at java.util.Arrays.mergeSort(Arrays.java:1166)
        at java.util.Arrays.mergeSort(Arrays.java:1178)
        at java.util.Arrays.sort(Arrays.java:1093)
        at java.util.Collections.sort(Collections.java:127)
        at com.virsa.ae.service.cache.AECacheUtil.getSystemsDropDown(AECacheUtil.java:963)
        at com.virsa.ae.service.cache.AECacheUtil.getSystemsDropDown(AECacheUtil.java:907)
        at jsp_cfg_workflow_provision_by_system1236276468461._jspService(jsp_cfg_workflow_provision_by_system1236276468461.java:28)
        at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)
        at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)
        at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.include(RequestDispatcherImpl.java:473)
        at com.sap.engine.services.servlets_jsp.server.jsp.PageContextImpl.include(PageContextImpl.java:178)
        at jsp_cfg_work_flow_auto_provisioning1236276463205._jspService(jsp_cfg_work_flow_auto_provisioning1236276463205.java:221)
        at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)
        at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)
        at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
        at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:452)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
        at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
        at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:452)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
        at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
        at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
        at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
        at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
        at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
        at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
        at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
        at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
        at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
        at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
        at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
        at java.security.AccessController.doPrivileged(AccessController.java:219)
        at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)
        at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)
#1.#7ECF26E5A402006000000928000BB04A0004653E942D3FBA#1237219355213#com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl#sap.com/AEEAR#com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl#J2EE_ADMIN#49704##n/a##d9a08ca0124311dec4817ecf26e5a402#SAPEngine_Application_Thread[impl:3]_6##0#0#Error#1#/System/Server/WebRequests#Plain###application [AE] Processing HTTP request to servlet [AEController] finished with error.
Please suggest.

Hemant,
    Try re-uploading the initial data file you received with the installation. Once you re-import the file, reboot your J2EE engine and test again.
Regards,
Alpesh

Access Enforcer Implemntation

Hi,
I have experiance on CC &FF and never installed Access enforcer.So our company planned to go Access enforcer on exising landscape.
So how I can implement access enforcer, is there a step-by-step document?
Can I implement on same system where we are running CC?
Do I need to install any additional add-ons or components ?
How long will it take to implement for this compoenet?
Please give your thoughts.
- Jim

Jim,
As it is suggested by Frank, need to have the product knowledge thorughly before going to management.
As implementation of CUP will require lot of understanding of other areas including your landscape design, workflows with different modules & configuration HR trigerrs.
Please find the few features from CUP :->
1) Automates, accelerates and tracks the user access request process using workflow for SAP and non-SAP systems
2) Integrated risk analysis and mitigation capabilities keep the system clean during compliant provisioning
3) User authentication from either LDAP or SAP systems
4) Password Self Service for end users
5) Automated email notification to appropriate parties
6)Actually provisions user accounts and access changes into the backend SAP systems

Access Enforcer(error in approving the request) and import roles

Dear all,
error in approving the request at security stage(last)
manager and role owner are successfully approved.
and also importing roles into access enforcer was not successful.
imortstatus : 0 roles imported of 28 records found.
please find the system log:
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.messaging.MessageFormatter : parseDesc :   : INTO the method : desc :Please specify a file to import.paramNames :paramsMap :{FIELD_NAME=#_!FIELD_NAME#_!}
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:01:34,625 [SAPEngine_Application_Thread[impl:3]_8] DEBUG com.virsa.ae.service.cache.AECacheUtil : getResourceBundle :   : INTO the method : en
2008-09-05 13:02:28,234 [Thread-47] DEBUG

In Addition to my previous response:
I meant to include the following:
Some of the fields that need to be properly defined with attributes are:
       System: must have the know SAP system defined here
       Role Approver (i presently are using most of the roles without having need for approval; I created a user called NOAPPRV in AE)
       Functional Area: need to have all the areas defined that roles will be assigned to
       Company: I only have one company so that's an easy one
Some areas I presently do not use but found they must ne coded and coded properly:
       ResponsibilityID:   N/A (coded as is)
       CommentsMandatory: NO (coded as is)
       Parent Role Owner:   NO
       Business Process: NA (I believe I originally coded N/A and it did not like that)
       Sub Process: NA (again N/A I believe error on me)
       Reaffirm Period: presently I am using 0 (zero)
       LastReaffirm: presently using 12/31/9999
Hope this helps a bit
I wanted to include an attachment with a sample of my Role Import spreadsheet but I'm not sure exactly how to do that; if I figure that out or someone can provide me the process I will include it
Jerry Synoga
Ryerson Inc.
630-758-2021

Access enforcer and User Data Source for HR

We are on Access Enforcer 5.2 - service pack 2:
My problem is that when creating a new request in AE, I able to get a list of all users when I point my User Data Source to either SAP or UME. However when I attempt to create a request whilst pointing the User Data Source at the SAPHR system, I do not get any users back (and we have user set up in the SAP HR system).
Ive changed the connector to YES under the HR System box, Ive changed the Data Source Type and Details Source Type to point at the SAPHR and still it fails to fetch any users.
I've tried looking at the log, but can't get much out of it.
I would appreciate it, if anyone could provide any assistance.
Thanks you in advance.
Amarjit
Message was edited by:
amarjit singh

Hi Micheal,
Thanks for your reply.
I'm pointing both Data Source Type and Details Source Type to the same system SAPHR and to the same system name (which is our dev system)
Regards,
Amarjit

Connector problem with access enforcer

Hi Guys,
I am facing a really strange problem with my connectors.
We have a test installation of GRC which was down for about 3 months.
During this time we migrated our central SLD to another system so I needed to change the connection after getting the system up again.
Anyhow I still can't modify, test or even create a new connector for access enforcer.
The only error I get is "Action failed".
I tried to analyze the logs but found no help there too.
2007-06-18 20:41:56,833 [SAPEngine_Application_Thread[impl:3]_4] ERROR java.lang.NullPointerException
java.lang.NullPointerException
     at com.virsa.ae.dao.sqlj.SAPConnectorDAO.iterToDTO(SAPConnectorDAO.sqlj:75)
     at com.virsa.ae.dao.sqlj.SAPConnectorDAO.findByConnectorName(SAPConnectorDAO.sqlj:15)
     at com.virsa.ae.configuration.bo.ConnectorsBO.findSAPConnectorDetails(ConnectorsBO.java:76)
     at com.virsa.ae.configuration.actions.ManageConnectorsAction.testConnection(ManageConnectorsAction.java:163)
     at com.virsa.ae.configuration.actions.ManageConnectorsAction.execute(ManageConnectorsAction.java:66)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:229)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:412)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code))
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:390)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:264)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:347)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:325)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:887)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:241)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java(Compiled Code))
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java(Compiled Code))
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java(Compiled Code))
     at java.security.AccessController.doPrivileged1(Native Method)
     at java.security.AccessController.doPrivileged(AccessController.java(Compiled Code))
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java(Compiled Code))
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java(Compiled Code))
Did anybody here face a problem like that?
Kind regards,
Bastian
Message was edited by:
        Bastian Schneider
Message was edited by:
        Bastian Schneider

I had a simular problem with CC and I had to contact SAP. They gave me a script to run against the database that remove the connector. The problem seemed somewhat common for CC 5.1. Not sure if this applies to AE.

Multi User request in Access Enforcer

Is anyone aware of a user limit in an access enforcer multi user request?
We get errors when we submit a multi user access enforcer request with more than 25 users.
Thanks

Hi
There is no standard limit even though we advice to keep the user to max of 20 .
The limit depends upon the email content you have configured .
In case in your email notifications you have taken the argument USERID then mulitple user creation request causes issue and the limit gets set to anything between 20-25 , again depending on content of the email .
Thanks

Workflow in Access Enforce

Similar Messages

Maybe you are looking for